ApiCreateAccount.php

Go to the documentation of this file.

<?php
use MediaWiki\Logger\LoggerFactory;

class ApiCreateAccount extends ApiBase {
    public function execute() {
        // If we're in a mode that breaks the same-origin policy, no tokens can
        // be obtained
        if ( $this->lacksSameOriginSecurity() ) {
            $this->dieUsage(
                'Cannot create account when the same-origin policy is not applied', 'aborted'
            );
        }

        // $loginForm->addNewaccountInternal will throw exceptions
        // if wiki is read only (already handled by api), user is blocked or does not have rights.
        // Use userCan in order to hit GlobalBlock checks (according to Special:userlogin)
        $loginTitle = SpecialPage::getTitleFor( 'Userlogin' );
        if ( !$loginTitle->userCan( 'createaccount', $this->getUser() ) ) {
            $this->dieUsage(
                'You do not have the right to create a new account',
                'permdenied-createaccount'
            );
        }
        if ( $this->getUser()->isBlockedFromCreateAccount() ) {
            $this->dieUsage(
                'You cannot create a new account because you are blocked',
                'blocked',
                0,
                [ 'blockinfo' => ApiQueryUserInfo::getBlockInfo( $this->getUser()->getBlock() ) ]
            );
        }

        $params = $this->extractRequestParams();

        // Make sure session is persisted
        MediaWiki\Session\SessionManager::getGlobalSession()->persist();

        if ( $params['mailpassword'] && !$params['email'] ) {
            $this->dieUsageMsg( 'noemail' );
        }

        if ( $params['language'] && !Language::isSupportedLanguage( $params['language'] ) ) {
            $this->dieUsage( 'Invalid language parameter', 'langinvalid' );
        }

        $context = new DerivativeContext( $this->getContext() );
        $context->setRequest( new DerivativeRequest(
            $this->getContext()->getRequest(),
            [
                'type' => 'signup',
                'uselang' => $params['language'],
                'wpName' => $params['name'],
                'wpPassword' => $params['password'],
                'wpRetype' => $params['password'],
                'wpDomain' => $params['domain'],
                'wpEmail' => $params['email'],
                'wpRealName' => $params['realname'],
                'wpCreateaccountToken' => $params['token'],
                'wpCreateaccount' => $params['mailpassword'] ? null : '1',
                'wpCreateaccountMail' => $params['mailpassword'] ? '1' : null
            ]
        ) );

        $loginForm = new LoginForm();
        $loginForm->setContext( $context );
        Hooks::run( 'AddNewAccountApiForm', [ $this, $loginForm ] );
        $loginForm->load();

        $status = $loginForm->addNewAccountInternal();
        LoggerFactory::getInstance( 'authmanager' )->info( 'Account creation attempt via API', [
            'event' => 'accountcreation',
            'status' => $status,
        ] );
        $result = [];
        if ( $status->isGood() ) {
            // Success!
            $user = $status->getValue();

            if ( $params['language'] ) {
                $user->setOption( 'language', $params['language'] );
            }

            if ( $params['mailpassword'] ) {
                // If mailpassword was set, disable the password and send an email.
                $user->setPassword( null );
                $status->merge( $loginForm->mailPasswordInternal(
                    $user,
                    false,
                    'createaccount-title',
                    'createaccount-text'
                ) );
            } elseif ( $this->getConfig()->get( 'EmailAuthentication' ) &&
                Sanitizer::validateEmail( $user->getEmail() )
            ) {
                // Send out an email authentication message if needed
                $status->merge( $user->sendConfirmationMail() );
            }

            // Save settings (including confirmation token)
            $user->saveSettings();

            Hooks::run( 'AddNewAccount', [ $user, $params['mailpassword'] ] );

            if ( $params['mailpassword'] ) {
                $logAction = 'byemail';
            } elseif ( $this->getUser()->isLoggedIn() ) {
                $logAction = 'create2';
            } else {
                $logAction = 'create';
            }
            $user->addNewUserLogEntry( $logAction, (string)$params['reason'] );

            // Add username, id, and token to result.
            $result['username'] = $user->getName();
            $result['userid'] = $user->getId();
            $result['token'] = $user->getToken();
        }

        $apiResult = $this->getResult();

        if ( $status->hasMessage( 'sessionfailure' ) || $status->hasMessage( 'nocookiesfornew' ) ) {
            // Token was incorrect, so add it to result, but don't throw an exception
            // since not having the correct token is part of the normal
            // flow of events.
            $result['token'] = LoginForm::getCreateaccountToken()->toString();
            $result['result'] = 'NeedToken';
            $this->setWarning( 'Fetching a token via action=createaccount is deprecated. ' .
                'Use action=query&meta=tokens&type=createaccount instead.' );
            $this->logFeatureUsage( 'action=createaccount&!token' );
        } elseif ( !$status->isOK() ) {
            // There was an error. Die now.
            $this->dieStatus( $status );
        } elseif ( !$status->isGood() ) {
            // Status is not good, but OK. This means warnings.
            $result['result'] = 'Warning';

            // Add any warnings to the result
            $warnings = $status->getErrorsByType( 'warning' );
            if ( $warnings ) {
                foreach ( $warnings as &$warning ) {
                    ApiResult::setIndexedTagName( $warning['params'], 'param' );
                }
                ApiResult::setIndexedTagName( $warnings, 'warning' );
                $result['warnings'] = $warnings;
            }
        } else {
            // Everything was fine.
            $result['result'] = 'Success';
        }

        // Give extensions a chance to modify the API result data
        Hooks::run( 'AddNewAccountApiResult', [ $this, $loginForm, &$result ] );

        $apiResult->addValue( null, 'createaccount', $result );
    }

    public function mustBePosted() {
        return true;
    }

    public function isReadMode() {
        return false;
    }

    public function isWriteMode() {
        return true;
    }

    public function getAllowedParams() {
        return [
            'name' => [
                ApiBase::PARAM_TYPE => 'user',
                ApiBase::PARAM_REQUIRED => true
            ],
            'password' => [
                ApiBase::PARAM_TYPE => 'password',
            ],
            'domain' => null,
            'token' => [
                ApiBase::PARAM_TYPE => 'string',
                ApiBase::PARAM_REQUIRED => false, // for BC
                ApiBase::PARAM_HELP_MSG => [ 'api-help-param-token', 'createaccount' ],
            ],
            'email' => [
                ApiBase::PARAM_TYPE => 'string',
                ApiBase::PARAM_REQUIRED => $this->getConfig()->get( 'EmailConfirmToEdit' ),
            ],
            'realname' => null,
            'mailpassword' => [
                ApiBase::PARAM_TYPE => 'boolean',
                ApiBase::PARAM_DFLT => false
            ],
            'reason' => null,
            'language' => null
        ];
    }

    protected function getExamplesMessages() {
        return [
            'action=createaccount&name=testuser&password=test123'
                => 'apihelp-createaccount-example-pass',
            'action=createaccount&name=testmailuser&mailpassword=true&reason=MyReason'
                => 'apihelp-createaccount-example-mail',
        ];
    }

    public function getHelpUrls() {
        return 'https://www.mediawiki.org/wiki/API:Account_creation';
    }
}