ApiCreateAccount.php

Go to the documentation of this file.

<?php
class ApiCreateAccount extends ApiBase {
        public function execute() {
                // If we're in JSON callback mode, no tokens can be obtained
                if ( !is_null( $this->getMain()->getRequest()->getVal( 'callback' ) ) ) {
                        $this->dieUsage( 'Cannot create account when using a callback', 'aborted' );
                }

                // $loginForm->addNewaccountInternal will throw exceptions
                // if wiki is read only (already handled by api), user is blocked or does not have rights.
                // Use userCan in order to hit GlobalBlock checks (according to Special:userlogin)
                $loginTitle = SpecialPage::getTitleFor( 'Userlogin' );
                if ( !$loginTitle->userCan( 'createaccount', $this->getUser() ) ) {
                        $this->dieUsage( 'You do not have the right to create a new account', 'permdenied-createaccount' );
                }
                if ( $this->getUser()->isBlockedFromCreateAccount() ) {
                        $this->dieUsage( 'You cannot create a new account because you are blocked', 'blocked' );
                }

                $params = $this->extractRequestParams();

                $result = array();

                // Init session if necessary
                if ( session_id() == '' ) {
                        wfSetupSession();
                }

                if( $params['mailpassword'] && !$params['email'] ) {
                        $this->dieUsageMsg( 'noemail' );
                }

                $context = new DerivativeContext( $this->getContext() );
                $context->setRequest( new DerivativeRequest(
                        $this->getContext()->getRequest(),
                        array(
                                'type' => 'signup',
                                'uselang' => $params['language'],
                                'wpName' => $params['name'],
                                'wpPassword' => $params['password'],
                                'wpRetype' => $params['password'],
                                'wpDomain' => $params['domain'],
                                'wpEmail' => $params['email'],
                                'wpRealName' => $params['realname'],
                                'wpCreateaccountToken' => $params['token'],
                                'wpCreateaccount' => $params['mailpassword'] ? null : '1',
                                'wpCreateaccountMail' => $params['mailpassword'] ? '1' : null
                        )
                ) );

                $loginForm = new LoginForm();
                $loginForm->setContext( $context );
                $loginForm->load();

                $status = $loginForm->addNewaccountInternal();
                $result = array();
                if( $status->isGood() ) {
                        // Success!
                        $user = $status->getValue();

                        // If we showed up language selection links, and one was in use, be
                        // smart (and sensible) and save that language as the user's preference
                        global $wgLoginLanguageSelector, $wgEmailAuthentication;
                        if( $wgLoginLanguageSelector && $params['language'] ) {
                                $user->setOption( 'language', $params['language'] );
                        }

                        if( $params['mailpassword'] ) {
                                // If mailpassword was set, disable the password and send an email.
                                $user->setPassword( null );
                                $status->merge( $loginForm->mailPasswordInternal( $user, false, 'createaccount-title', 'createaccount-text' ) );
                        } elseif( $wgEmailAuthentication && Sanitizer::validateEmail( $user->getEmail() ) ) {
                                // Send out an email authentication message if needed
                                $status->merge( $user->sendConfirmationMail() );
                        }

                        // Save settings (including confirmation token)
                        $user->saveSettings();

                        wfRunHooks( 'AddNewAccount', array( $user, $params['mailpassword'] ) );

                        if ( $params['mailpassword'] ) {
                                $logAction = 'byemail';
                        } elseif ( $this->getUser()->isLoggedIn() ) {
                                $logAction = 'create2';
                        } else {
                                $logAction = 'create';
                        }
                        $user->addNewUserLogEntry( $logAction, (string)$params['reason'] );

                        // Add username, id, and token to result.
                        $result['username'] = $user->getName();
                        $result['userid'] = $user->getId();
                        $result['token'] = $user->getToken();
                }

                $apiResult = $this->getResult();

                if( $status->hasMessage( 'sessionfailure' ) || $status->hasMessage( 'nocookiesfornew' ) ) {
                        // Token was incorrect, so add it to result, but don't throw an exception
                        // since not having the correct token is part of the normal
                        // flow of events.
                        $result['token'] = LoginForm::getCreateaccountToken();
                        $result['result'] = 'needtoken';
                } elseif( !$status->isOK() ) {
                        // There was an error. Die now.
                        // Cannot use dieUsageMsg() directly because extensions
                        // might return custom error messages.
                        $errors = $status->getErrorsArray();
                        if( $errors[0] instanceof Message ) {
                                $code = 'aborted';
                                $desc = $errors[0];
                        } else {
                                $code = array_shift( $errors[0] );
                                $desc = wfMessage( $code, $errors[0] );
                        }
                        $this->dieUsage( $desc, $code );
                } elseif( !$status->isGood() ) {
                        // Status is not good, but OK. This means warnings.
                        $result['result'] = 'warning';

                        // Add any warnings to the result
                        $warnings = $status->getErrorsByType( 'warning' );
                        if( $warnings ) {
                                foreach( $warnings as &$warning ) {
                                        $apiResult->setIndexedTagName( $warning['params'], 'param' );
                                }
                                $apiResult->setIndexedTagName( $warnings, 'warning' );
                                $result['warnings'] = $warnings;
                        }
                } else {
                        // Everything was fine.
                        $result['result'] = 'success';
                }

                $apiResult->addValue( null, 'createaccount', $result );
        }

        public function getDescription() {
                return 'Create a new user account.';
        }

        public function mustBePosted() {
                return true;
        }

        public function isReadMode() {
                return false;
        }

        public function isWriteMode() {
                return true;
        }

        public function getAllowedParams() {
                global $wgEmailConfirmToEdit;
                return array(
                        'name' => array(
                                ApiBase::PARAM_TYPE => 'user',
                                ApiBase::PARAM_REQUIRED => true
                        ),
                        'password' => null,
                        'domain' => null,
                        'token' => null,
                        'email' => array(
                                ApiBase::PARAM_TYPE => 'string',
                                ApiBase::PARAM_REQUIRED => $wgEmailConfirmToEdit
                        ),
                        'realname' => null,
                        'mailpassword' => array(
                                ApiBase::PARAM_TYPE => 'boolean',
                                ApiBase::PARAM_DFLT => false
                        ),
                        'reason' => null,
                        'language' => null
                );
        }

        public function getParamDescription() {
                $p = $this->getModulePrefix();
                return array(
                        'name' => 'Username',
                        'password' => "Password (ignored if {$p}mailpassword is set)",
                        'domain' => 'Domain for external authentication (optional)',
                        'token' => 'Account creation token obtained in first request',
                        'email' => 'Email address of user (optional)',
                        'realname' => 'Real name of user (optional)',
                        'mailpassword' => 'If set to any value, a random password will be emailed to the user',
                        'reason' => 'Optional reason for creating the account to be put in the logs',
                        'language' => 'Language code to set as default for the user (optional, defaults to content language)'
                );
        }

        public function getResultProperties() {
                return array(
                        'createaccount' => array(
                                'result' => array(
                                        ApiBase::PROP_TYPE => array(
                                                'success',
                                                'warning',
                                                'needtoken'
                                        )
                                ),
                                'username' => array(
                                        ApiBase::PROP_TYPE => 'string',
                                        ApiBase::PROP_NULLABLE => true
                                ),
                                'userid' => array(
                                        ApiBase::PROP_TYPE => 'int',
                                        ApiBase::PROP_NULLABLE => true
                                ),
                                'token' => array(
                                        ApiBase::PROP_TYPE => 'string',
                                        ApiBase::PROP_NULLABLE => true
                                ),
                        )
                );
        }

        public function getPossibleErrors() {
                // Note the following errors aren't possible and don't need to be listed:
                // sessionfailure, nocookiesfornew, badretype
                $localErrors = array(
                        'wrongpassword', // Actually caused by wrong domain field. Riddle me that...
                        'sorbs_create_account_reason',
                        'noname',
                        'userexists',
                        'password-name-match', // from User::getPasswordValidity
                        'password-login-forbidden', // from User::getPasswordValidity
                        'noemailtitle',
                        'invalidemailaddress',
                        'externaldberror',
                        'acct_creation_throttle_hit',
                );

                $errors = parent::getPossibleErrors();
                // All local errors are from LoginForm, which means they're actually message keys.
                foreach( $localErrors as $error ) {
                        $errors[] = array( 'code' => $error, 'info' => wfMessage( $error )->parse() );
                }

                $errors[] = array(
                        'code' => 'permdenied-createaccount',
                        'info' => 'You do not have the right to create a new account'
                );
                $errors[] = array(
                        'code' => 'blocked',
                        'info' => 'You cannot create a new account because you are blocked'
                );
                $errors[] = array(
                        'code' => 'aborted',
                        'info' => 'Account creation aborted by hook (info may vary)'
                );

                // 'passwordtooshort' has parameters. :(
                global $wgMinimalPasswordLength;
                $errors[] = array(
                        'code' => 'passwordtooshort',
                        'info' => wfMessage( 'passwordtooshort', $wgMinimalPasswordLength )->parse()
                );
                return $errors;
        }

        public function getExamples() {
                return array(
                        'api.php?action=createaccount&name=testuser&password=test123',
                        'api.php?action=createaccount&name=testmailuser&mailpassword=true&reason=MyReason',
                );
        }

        public function getHelpUrls() {
                return 'https://www.mediawiki.org/wiki/API:Account_creation';
        }
}