<?php
/**
 * @file
 * The password policy module allows you to enforce a specific level of
 * password complexity for the user passwords on the system.
 */

/****************************************************************************/

define('PASSWORD_POLICY_ENTRIES_PER_PAGE', 20);

/****************************************************************************/
/* Core API hooks                                                           */
/****************************************************************************/

/**
 * Implements hook_help().
 */
function password_policy_help($path, $arg) {
  switch ($path) {
    case "admin/help#password_policy":
      return '<p>' . t('The password policy module allows you to enforce a specific level of password complexity for the user passwords on the system.') . '</p>';
  }
}

/**
 * Implements hook_init().
 */
function password_policy_init() {
  global $user;

  // Check password reset status and force a reset if needed.
  if (_password_policy_is_password_change_forced($user->uid) &&
      !_password_policy_is_path_allowed_when_password_change_forced()) {
    _password_policy_set_password_change_forced_message();
    _password_policy_go_to_password_change_page();
  }
}

/**
 * Determines whether user is to be forced to change their password.
 *
 * Uses static variable to avoid redundantly querying database in single
 * request, which can happen when both password_policy_init() and
 * password_policy_user($op='load') are called.
 *
 * @param $uid
 *   User ID.
 *
 * @return
 *   TRUE if a password change is to be forced, FALSE otherwise.
 */
function _password_policy_is_password_change_forced($uid) {
  static $force_change = array();
  if ($uid == 0) {
    return FALSE;
  }
  if (!isset($force_change[$uid])) {
    $force_change[$uid] = db_result(db_query('SELECT force_change FROM {password_policy_force_change} WHERE uid=%d', $uid));
  }
  return $force_change[$uid];
}

/**
 * Determines whether access to path allowed when user password change forced.
 *
 * @return
 *   TRUE if the path is allowed, FALSE otherwise.
 */
function _password_policy_is_path_allowed_when_password_change_forced() {
  $current_path = $_GET['q'];
  $excluded_paths = _password_policy_get_excluded_page_paths();
  $password_change_paths = _password_policy_get_password_change_paths();
  $allowed_paths = array_merge($excluded_paths, $password_change_paths);
  return in_array($current_path, $allowed_paths);
}

/**
 * Gets paths of pages excluded from redirection to change password.
 */
function _password_policy_get_excluded_page_paths() {
  $excluded_paths = variable_get('password_policy_exclude_pages', 'logout');
  $excluded_paths = explode("\n", $excluded_paths);
  return array_map('trim', $excluded_paths);
}

/**
 * Sets message indicating a password change is forced.
 */
function _password_policy_set_password_change_forced_message() {
  drupal_set_message(t('Your password has expired. You must change your password to proceed on the site.'), 'error', FALSE);
}

/**
 * Redirects user to password change page.
 *
 * The password change page path depends on whether Password Policy Password
 * Tab is enabled.  When there are multiple paths, the first is assumed to be
 * preferred.
 */
function _password_policy_go_to_password_change_page() {
  $password_change_paths = _password_policy_get_password_change_paths();
  $preferred_password_change_path = $password_change_paths[0];
  $destination = drupal_get_destination();
  unset($_GET['destination']);
  drupal_goto($preferred_password_change_path, $destination);
}

/**
 * Gets paths that allow user to change their password.
 */
function _password_policy_get_password_change_paths() {
  global $user;
  $custom_path = _password_policy_get_custom_password_change_path();
  if (isset($custom_path)) {
    return array($custom_path);
  }
  else {
    return array(
      "user/{$user->uid}/edit/account",
      "user/{$user->uid}/edit",
    );
  }
}

/**
 * Gets custom password change path.
 *
 * This is used in particular by the Password Policy Password Tab module to set
 * an alternate password change page path.
 *
 * @return
 *   The custom path if a custom path is set, NULL otherwise.
 */
function _password_policy_get_custom_password_change_path() {
  global $user;
  $subpath = variable_get('password_policy_change_url', NULL);
  if (isset($subpath)) {
    return "user/{$user->uid}/edit/$subpath";
  }
  else {
    return NULL;
  }
}

/**
 * Implements hook_theme().
 */

function password_policy_theme() {
  return array(
    'password_policy_admin_list' => array(
      'arguments' => array('form' => NULL),
      'file' => 'password_policy.theme.inc',
    ),
  );
}

/**
 * Implements hook_perm().
 */
function password_policy_perm() {
  return array('unblock expired accounts', 'force password change');
}

/**
 * Implements hook_menu().
 */
function password_policy_menu() {
  $items['admin/settings/password_policy'] = array(
    'title' => 'Password policies',
    'description' => 'Configures policies for user account passwords.',
    'page callback' => 'drupal_get_form',
    'page arguments' => array('password_policy_admin_settings'),
    'access arguments' => array('administer site configuration'),
    'file' => 'password_policy.admin.inc',
  );
  $items['admin/settings/password_policy/configure'] = array(
    'title' => 'Settings',
    'type' => MENU_DEFAULT_LOCAL_TASK,
  );
  $items['admin/settings/password_policy/list'] = array(
    'title' => 'List',
    'type' => MENU_LOCAL_TASK,
    'page callback' => 'drupal_get_form',
    'page arguments' => array('password_policy_admin_list'),
    'access arguments' => array('administer site configuration'),
    'weight' => 1,
    'file' => 'password_policy.admin.inc',
  );
  $items['admin/settings/password_policy/add'] = array(
    'title' => 'Add',
    'type' => MENU_LOCAL_TASK,
    'page callback' => 'drupal_get_form',
    'page arguments' => array('password_policy_admin_form', NULL),
    'access arguments' => array('administer site configuration'),
    'weight' => 2,
    'file' => 'password_policy.admin.inc',
  );
  $items['admin/settings/password_policy/%password_policy_policy'] = array(
    'title callback' => 'password_policy_format_title',
    'title arguments' => array(3),
    'type' => MENU_CALLBACK,
    'page callback' => 'password_policy_admin_view',
    'page arguments' => array(3),
    'access arguments' => array('administer site configuration'),
    'file' => 'password_policy.admin.inc',
  );
  $items['admin/settings/password_policy/%password_policy_policy/view'] = array(
    'title' => 'View',
    'type' => MENU_DEFAULT_LOCAL_TASK,
  );
  $items['admin/settings/password_policy/%password_policy_policy/edit'] = array(
    'title' => 'Edit',
    'type' => MENU_LOCAL_TASK,
    'page callback' => 'drupal_get_form',
    'page arguments' => array('password_policy_admin_form', 3),
    'access arguments' => array('administer site configuration'),
    'weight' => 1,
    'file' => 'password_policy.admin.inc',
  );
  $items['admin/settings/password_policy/delete'] = array(
    'title' => 'Delete',
    'type' => MENU_CALLBACK,
    'page callback' => 'drupal_get_form',
    'page arguments' => array('password_policy_admin_delete'),
    'access arguments' => array('administer site configuration'),
    'file' => 'password_policy.admin.inc',
  );
  $items['admin/settings/password_policy/password_change'] = array(
    'title' => 'Force password change',
    'description' => 'Force users to change their password',
    'page callback' => 'drupal_get_form',
    'page arguments' => array('password_policy_password_change_settings'),
    'access arguments' => array('force password change'),
    'file' => 'password_policy.admin.inc',
    'type' => MENU_LOCAL_TASK,
    'weight' => 10,
  );
  $items['admin/user/expired'] = array(
    'title' => 'Expired accounts',
    'description' => 'Lists all expired accounts.',
    'page callback' => 'password_policy_expired_list',
    'page arguments' => array('password_policy_list_expired'),
    'access arguments' => array('unblock expired accounts'),
  );
  $items['admin/user/expired/unblock/%password_policy_uid'] = array(
    'title' => 'Unblock',
    'type' => MENU_CALLBACK,
    'page callback' => 'drupal_get_form',
    'page arguments' => array('password_policy_expired_unblock_confirm', 4),
    'access arguments' => array('unblock expired accounts'),
  );
  return $items;
}

/**
 * Load policy array from the database.
 *
 * @param $pid
 *   The policy id
 *
 * @return
 *   A populated policy array or NULL if not found.
 */
function password_policy_policy_load($pid) {
  static $policies = array();

  if (is_numeric($pid)) {
    if (isset($policies[$pid])) {
      return $policies[$pid];
    }
    else {
      $policy = _password_policy_load_policy_by_pid($pid);
      if ($policy) {
        $policies[$pid] = $policy;
        return $policy;
      }
    }
  }
  return FALSE;
}

/**
 * Load user object from the database.
 *
 * @param $id
 *   The user id
 *
 * @return
 *   A populated user object or NULL if not found.
 */
function password_policy_uid_load($id) {
  if (is_numeric($id)) {
    $account = user_load(array('uid' => $id));
    if ($account) {
      return $account;
    }
  }
  return FALSE;
}

/**
 * Display a password policy form title.
 *
 * @param $policy
 *   Policy array
 *
 * @return
 *   A policy's title string
 */
function password_policy_format_title($policy) {
  return $policy['name'];
}

/**
 * Implements hook_user().
 */
function password_policy_user($op, &$edit, &$account, $category = NULL) {
  global $user;

  switch ($op) {
    case 'load':
      $account->force_password_change = _password_policy_is_password_change_forced($account->uid);
      break;

    case 'validate':
      global $user;
      if (isset($account->uid) && $account->force_password_change == 1) {
        // Admins can edit accounts without having to reset passwords.
        if ($edit['pass'] == '' && $user->uid == $account->uid) {
          form_set_error('pass', t('Your password has expired. You must change your password to proceed on the site.'));
        }
      }
      break;

    case 'insert':
      $force = isset($edit['force_password_change']) ? $edit['force_password_change'] : variable_get('password_policy_new_login_change', 0);
      db_query('INSERT INTO {password_policy_force_change} VALUES(%d, %d)', $account->uid, $force);
      if (array_key_exists('pass', $edit)) {
        // New users do not yet have an uid during the validation step, but
        // they do have at this insert step.  Store their first password in the
        // system for use with the history constraint (if used).
        if ($account->uid) {
          _password_policy_store_password($account->uid, $edit['pass']);
        }
      }
      break;

    case 'update':
      if (!empty($account->force_password_change) && array_key_exists('pass', $edit) && $user->uid == $account->uid) {
        db_query('UPDATE {password_policy_force_change} SET force_change = 0 WHERE uid = %d', $account->uid);
      }
      elseif (!empty($edit['force_password_change'])) {
        db_query('UPDATE {password_policy_force_change} SET force_change = 1 WHERE uid = %d', $account->uid);
        if ($user->uid != $account->uid) {
          drupal_set_message(t('@user will be required to change their password the next time they log in.', array('@user' => $account->name)));
        }
        watchdog('password policy', '@user flagged to change password on next login by @admin', array('@user' => $account->name, '@admin' => $user->name), WATCHDOG_NOTICE);
      }
      elseif (isset($edit['force_password_change'])) {
        db_query('UPDATE {password_policy_force_change} SET force_change = 0 WHERE uid = %d', $account->uid);
      }

      if (isset($edit['status']) && $edit['status'] != $account->status && $edit['status'] == 1) {
        // Account is being unblocked.
        db_query('UPDATE {password_policy_expiration} SET unblocked = %d WHERE uid = %d', time(), $account->uid);
      }
      break;

    case 'after_update':
      // Store hash of newly set password
      if (array_key_exists('pass', $edit)) {
        _password_policy_store_password($account->uid, $edit['pass']);
      }
      break;

    case 'login':
      $roles = is_array($account->roles) ? array_keys($account->roles) : array();
      $policy = _password_policy_load_active_policy($roles);
      // A value $edit['name'] is NULL for a one time login
      if ($policy && ((!empty($account->uid) && $account->uid > 1) || variable_get('password_policy_admin', 0)) && !empty($edit['name'])) {
        // Calculate expiration and warning times.
        $expiration = $policy['expiration'];
        $warning = max(explode(',', $policy['warning']));
        $expiration_seconds = $expiration*60*60*24;
        $warning_seconds = $warning*60*60*24;
        // The policy was enabled
        $policy_start = $policy['created'];
        if (variable_get('password_policy_begin', 0) == 1) {
          $policy_start -= $expiration_seconds;
        }
        if (!empty($expiration)) {
          // Account expiration is active.
          // Get the last password change time.
          $result = db_query_range("SELECT * FROM {password_policy_history} WHERE uid = %d ORDER BY created DESC", $account->uid, 0, 1);
          if ($row = db_fetch_object($result)) {
            $last_change = $row->created;
          }
          else {
            // User has not changed their password since this module was
            // enabled.
            $last_change = $account->created;
          }
          $time = time();
          if ($time > max($policy_start, $last_change) + $expiration_seconds) {
            if (variable_get('password_policy_block', 0) == 0) {
              // User is blocked immediately and cannot change his password
              // after expiration.
              _password_policy_block_account($account);
            }
            else {
              // Redirect user and let password force change handle.
              db_query('UPDATE {password_policy_force_change} SET force_change=%d WHERE uid=%d', 1, $account->uid);
              _password_policy_set_password_change_forced_message();
              _password_policy_go_to_password_change_page();
            }
          }
          elseif ($time > max($policy_start, $last_change) + $expiration_seconds - $warning_seconds) {
            // The warning is shown on login and the user is transferred to the
            // password change page.
            $days_left = ceil((max($policy_start, $last_change) + $expiration_seconds - $time)/(60*60*24));
            drupal_set_message(format_plural($days_left, 'Your password will expire in less than one day. Please change it.', 'Your password will expire in less than @count days. Please change it.'));
            $destination = drupal_get_destination();
            unset($_REQUEST['destination']);
            drupal_goto('user/' . $account->uid . '/edit' . (module_exists('password_policy_password_tab') ? '/password' : ''), $destination);
          }
        }
      }
      break;

    case 'delete':
      db_query("DELETE FROM {password_policy_history} WHERE uid = %d", $account->uid);
      db_query("DELETE FROM {password_policy_expiration} WHERE uid = %d", $account->uid);
      db_query("DELETE FROM {password_policy_force_change} WHERE uid = %d", $account->uid);
      break;

    case 'register':
    case 'form':
      // Force Password Change on user account.
      if (($category == 'account' || $op == 'register') && user_access('force password change')) {
        if ($category == 'account') {
          $force_change = db_result(db_query_range('SELECT force_change FROM {password_policy_force_change} WHERE uid=%d', $account->uid, 0, 1));
        }
        else {
          $force_change = variable_get('password_policy_new_login_change', 0);
        }

        $form['password_policy'] = array(
          '#type' => 'fieldset',
          '#title' => t('Password settings'),
        );
        $form['password_policy']['force_password_change'] = array(
          '#type' => 'checkbox',
          '#title' => t('Force password change on next login'),
          '#description' => t('If already logged in, the user will be forced to change their password upon their next page request.'),
          '#default_value' => $force_change
        );
        return $form;
      }
      break;
  }
}

/**
 * Implements hook_form_alter().
 */
function password_policy_form_alter(&$form, $form_state, $form_id) {
  switch ($form_id) {
    case "user_profile_form":
    case "user_register":
      // Password change form.
      $uid = isset($form['#uid']) ? $form['#uid'] : NULL;
      //if ($uid == 1 && !variable_get('password_policy_admin', 0)) { break; }
      $roles = isset($form['_account']['#value']) ? array_keys($form['_account']['#value']->roles) : array();
      $policy = _password_policy_load_active_policy($roles);
      $translate = array();
      if (!empty($policy['policy'])) {
        // Some policy constraints are active.
        password_policy_add_policy_js($policy, $uid);
        foreach ($policy['policy'] as $key => $value) {
          $translate['constraint_' . $key] = _password_policy_constraint_error($key, $value);
        }
      }

      // Printing out the restrictions.
      if (variable_get('password_policy_show_restrictions', 0) && !empty($translate)) {
        $restriction_html = '<div id="account-pass-restrictions">' . theme('item_list', $translate, t('Password Requirements')) . '</div>';
        if (isset($form['account']) && is_array($form['account'])) {
          $form['account']['pass']['#prefix'] = $restriction_html;
        }
        else {
          $form['pass']['#prefix'] = $restriction_html;
        }
      }

      // Set a custom form validate and submit handlers.
      $form['#validate'][] = 'password_policy_password_validate';
      break;
    case 'password_policy_password_tab':
      $form['submit']['#weight'] = 10;
      break;
  }
}

/**
 * Implements hook_cron().
 */
function password_policy_cron() {
  // Short circuit if no policies are active that use expiration.
  if (!db_result(db_query("SELECT COUNT(*) FROM {password_policy} WHERE enabled = 1 AND expiration > 0"))) {
    return;
  }

  // Get all users' last password change time. We don't touch blocked accounts
  $result = db_query('
    SELECT u.uid AS uid,
           u.created AS created_u,
           p.created AS created_p,
           e.pid AS pid,
           e.warning AS warning,
           e.unblocked AS unblocked
      FROM {users} u
           LEFT JOIN {password_policy_history} p ON u.uid = p.uid
           LEFT JOIN {password_policy_expiration} e ON u.uid = e.uid
     WHERE u.uid > 0 AND u.status = 1 ORDER BY p.created ASC
  ');
  while ($row = db_fetch_object($result)) {
    if ($row->uid == 1 && !variable_get('password_policy_admin', 0))
      continue;

    // Use account creation timestamp if there is no entry in password history
    // table.
    $accounts[$row->uid] = empty($row->created_p) ? $row->created_u : $row->created_p;
    // Last time a warning was mailed out (if was). We need it because we send
    // warnings only once a day, not on all cron runs.
    $warns[$row->uid] = $row->warning;
    // The user was last time unblocked (if was). We don't block this account
    // again for some period of time.
    $unblocks[$row->uid] = $row->unblocked;
    // The user was last time unblocked (if was). We don't block this account
    // again for some period of time.
    $pids[$row->uid] = $row->pid;
  }

  if ($accounts) {
    foreach ($accounts as $uid => $last_change) {
      /* Alternative: $result = db_query("SELECT p.* FROM {password_policy} p INNER JOIN {password_policy_role} r ON p.pid = r.pid INNER JOIN {users_roles} u ON r.rid = u.rid WHERE p.enabled = 1 AND u.uid = %d ORDER BY p.weight LIMIT 1", $uid); */
      $roles = array(DRUPAL_AUTHENTICATED_RID);
      $result = db_query("SELECT rid FROM {users_roles} WHERE uid = %d ORDER BY rid", $uid);
      while ($row = db_fetch_object($result)) {
        $roles[] = $row->rid;
      }
      $policy = _password_policy_load_active_policy($roles);
      if ($policy) {
        $expiration = $policy['expiration'];
        $warnings = !empty($policy['warning']) ? explode(',', $policy['warning']) : array();
        if (!empty($expiration)) {
          // Calculate expiration time.
          $expiration_seconds = $expiration*60*60*24;
          $policy_start = $policy['created'];
          if (variable_get('password_policy_begin', 0) == 1) {
            $policy_start -= $expiration_seconds;
          }
          rsort($warnings, SORT_NUMERIC);
          $time = time();
          // Check expiration and warning days for each account.
          if (!empty($warnings)) {
            foreach ($warnings as $warning) {
              // Loop through all configured warning send out days. If today is
              // the day we send out the warning.
              $warning_seconds = $warning*60*60*24;
              // Warning start time.
              $start_period = max($policy_start, $last_change) + $expiration_seconds - $warning_seconds;
              // Warning end time. We create a one day window for cron to run.
              $end_period = $start_period + 60*60*24;
              if ($warns[$uid] && $warns[$uid] > $start_period && $warns[$uid] < $end_period) {
                // A warning was already mailed out
                continue;
              }
              if ($time > $start_period && $time < $end_period) {
                // A warning falls in the one day window, so we send out the
                // warning.
                $account = user_load(array('uid' => $uid));
                $message = drupal_mail('password_policy', 'warning', $account->mail, user_preferred_language($account), array('account' => $account, 'days_left' => $warning));
                if ($message['result']) {
                  // The mail was sent out successfully.
                  watchdog('password_policy', 'Password expiration warning mailed to %username at %email.', array('%username' => $account->name, '%email' => $account->mail));
                }
                if ($pids[$uid]) {
                  db_query("UPDATE {password_policy_expiration} SET warning = %d WHERE uid = %d", $time, $uid);
                }
                else {
                  db_query("INSERT INTO {password_policy_expiration} (uid, warning) VALUES (%d, %d)", $uid, $time);
                }
              }
            }
          }
          if ($time > max($policy_start, $last_change) + $expiration_seconds && $time > $unblocks[$uid] + 60*60*24 && variable_get('password_policy_block', 0) == 0) {
            // Block expired accounts. Unblocked accounts are not blocked for
            // 24h.  One time login lasts for a 24h.
            db_query("UPDATE {users} SET status = 0 WHERE uid = %d", $uid);
            if ($pids[$uid]) {
              db_query("UPDATE {password_policy_expiration} SET blocked = %d WHERE uid = %d", $time, $uid);
            }
            else {
              db_query("INSERT INTO {password_policy_expiration} (uid, blocked) VALUES (%d, %d)", $uid, $time);
            }

            $account = user_load(array('uid' => $uid));
            watchdog('password_policy', 'Password for user %name has expired.', array('%name' => $account->name), WATCHDOG_NOTICE, l(t('edit'), 'user/' . $account->uid . '/edit'));
          }
        }
      }
    }
  }
}

/**
 * Implements hook_mail().
 */
function password_policy_mail($key, &$message, $params) {
  $language = $message['language'];
  $variables = password_policy_mail_tokens($params, $language);
  $message['subject'] .= _password_policy_mail_text($key . '_subject', $language, $variables);
  $message['body'][] = _password_policy_mail_text($key . '_body', $language, $variables);
}

/**
 * Implements hook_simpletest().
 */
function password_policy_simpletest() {
  // Scan through mymodule/tests directory for any .test files to tell
  // SimpleTest module.
  $tests = file_scan_directory(drupal_get_path('module', 'password_policy') . '/tests', '\.test');
  return array_keys($tests);
}

/****************************************************************************/
/* FAPI                                                                     */
/****************************************************************************/

/**
 * Password save validate handler.
 */
function password_policy_password_validate($form, &$form_state) {
  $values = $form_state['values'];
  $account = isset($form['_account']['#value']) ? $form['_account']['#value'] : (object)array('uid' => 0);

  if (!empty($values['pass']) && !isset($values['auth_openid'])) {
    $error = _password_policy_constraint_validate($values['pass'], $account);
    if ($error) {
      form_set_error('pass', t('Your password has not met the following requirement(s):') . '<ul><li>' . implode('</li><li>', $error) . '</li></ul>');
    }
  }
}

/****************************************************************************/
/* Expired accounts UI                                                      */
/****************************************************************************/

/**
 * Lists all expired accounts.
 */
function password_policy_expired_list() {
  $header[] = array('data' => t('Username'), 'field' => 'name');
  $header[] = array('data' => t('Blocked'), 'field' => 'blocked', 'sort' => 'desc');
  $header[] = array('data' => t('Unblocked'), 'field' => 'unblocked');
  $header[] = array('data' => t('Action'));

  $result = pager_query("SELECT p.*, u.name FROM {password_policy_expiration} p INNER JOIN {users} u ON p.uid = u.uid WHERE p.blocked > 0" . tablesort_sql($header), PASSWORD_POLICY_ENTRIES_PER_PAGE, 0, NULL);
  while ($row = db_fetch_object($result)) {
    $entry[$row->uid]['name'] = l($row->name, 'user/' . $row->uid);
    $entry[$row->uid]['blocked'] = format_date($row->blocked, 'medium');
    $entry[$row->uid]['unblocked'] = $row->unblocked < $row->blocked ? '' : format_date($row->unblocked, 'medium');
    $entry[$row->uid]['action'] = $row->unblocked < $row->blocked ? l(t('unblock'), 'admin/user/expired/unblock/' . $row->uid, array('query' => array('destination' => 'admin/user/expired'))) : '';
  }
  if (!isset($entry)) {
    $colspan = '4';
    $entry[] = array(array('data' => t('No entries'), 'colspan' => $colspan));
  }
  $page = theme('table', $header, $entry);
  $page .= theme('pager', NULL, PASSWORD_POLICY_ENTRIES_PER_PAGE, 0);

  return $page;
}

/**
 * Confirm unblocking the expired account.
 */
function password_policy_expired_unblock_confirm($form, $account) {
  return confirm_form(
    array(
      'account' => array(
        '#type' => 'value',
        '#value' => $account,
      ),
    ),
    t('Are you sure you would like to unblock the user %user?', array('%user' => $account->name)),
    'admin/user/expired',
    t('This action cannot be undone.'),
    t('Unblock user'),
    t('Cancel')
  );
}

/**
 * Unblocks the expired account.
 */
function password_policy_expired_unblock_confirm_submit($form, &$form_state) {
  // Unblock the user
  _password_policy_unblock($form_state['values']['account']);
  drupal_goto('admin/user/expired');
}

/****************************************************************************/
/* Mail handling                                                            */
/****************************************************************************/

/**
 * Returns a mail string for a variable name.
 *
 * Used by password_policy_mail() and the settings forms to retrieve strings.
 */
function _password_policy_mail_text($key, $language = NULL, $variables = array()) {
  $langcode = isset($language) ? $language->language : NULL;

  if ($admin_setting = variable_get('password_policy_' . $key, FALSE)) {
    // An admin setting overrides the default string.
    return strtr($admin_setting, $variables);
  }
  else {
    // No override, return with default strings.
    switch ($key) {
      case 'warning_subject':
        return t('Password expiration warning for !username at !site', $variables, $langcode);
      case 'warning_body':
        return t("!username,\n\nYour password at !site will expire in less than !days_left day(s).\n\nPlease go to !edit_uri to change your password.", $variables, $langcode);
    }
  }
}

/**
 * Return an array of token to value mappings for user e-mail messages.
 *
 * @param $params
 *  Structured array with the parameters.
 * @param $language
 *  Language object to generate the tokens with.
 *
 * @return
 *  Array of mappings from token names to values (for use with strtr()).
 */
function password_policy_mail_tokens($params, $language) {
  global $base_url;
  $account = $params['account'];
  $tokens = array(
   '!username' => $account->name,
   '!mailto' => $account->mail,
   '!site' => variable_get('site_name', 'SuiteDesk'),
   '!uri' => $base_url,
   '!uri_brief' => drupal_substr($base_url, drupal_strlen('http://')),
   '!date' => format_date(time(), 'medium', '', NULL, $language->language),
   '!login_uri' => url('user', array('absolute' => TRUE)),
   '!edit_uri' => url('user/' . $account->uid . '/edit' . (module_exists('password_policy_password_tab') ? '/password' : ''), array('absolute' => TRUE)),
   '!days_left' => isset($params['days_left']) ? $params['days_left'] : NULL,
   '!login_url' => isset($params['login_url']) ? $params['login_url'] : NULL,
  );
    return $tokens;
}

/****************************************************************************/
/* Constraints API                                                          */
/****************************************************************************/

/**
 * Validates user password. Returns NULL on success or array with error messages
 * from the constraints on failure.
 *
 * @param $pass
 *   Clear text password.
 * @param &$account
 *   Populated user object.
 *
 * @return
 *   NULL or array with error messages.
 */
function _password_policy_constraint_validate($pass, &$account) {
  _password_policy_constraints();

  $error = NULL;
  $roles = (isset($account->roles) && is_array($account->roles)) ? array_keys($account->roles) : array();
  $policy = _password_policy_load_active_policy($roles);
  if (!empty($policy['policy'])) {
    foreach ($policy['policy'] as $key => $value) {
      if (!call_user_func('password_policy_constraint_' . $key . '_validate', $pass, $value, $account->uid)) {
        $error[] = call_user_func('password_policy_constraint_' . $key . '_error', $value);
      }
    }
  }
  return $error;
}

/**
 * Gets the constraint's name and description.
 *
 * @param $name
 *   Name of the constraint.
 *
 * @return
 *   Array containing the name and description.
 */
function _password_policy_constraint_description($name) {
  _password_policy_constraints();
  return call_user_func('password_policy_constraint_' . $name . '_description');
}

/**
 * Gets the constraint's error message.
 *
 * @param $name
 *   Name of the constraint.
 * @param $constraint
 *   Constraint value.
 *
 * @return
 *   Error message.
 */
function _password_policy_constraint_error($name, $constraint) {
  _password_policy_constraints();
  return call_user_func('password_policy_constraint_' . $name . '_error', $constraint);
}

/**
 * Gets the javascript code from the constraint to be added to the password
 * validation.
 *
 * @param $name
 *   Name of the constraint.
 * @param $constraint
 *   Constraint value.
 * @param $uid
 *   User's id.
 *
 * @return
 *   Javascript code snippet for the constraint.
 */
function _password_policy_constraint_js($name, $constraint, $uid) {
  _password_policy_constraints();
  if (function_exists('password_policy_constraint_' . $name . '_js')) {
    return call_user_func('password_policy_constraint_' . $name . '_js', $constraint, $uid);
  }
}

/****************************************************************************/
/* Auxiliary functions                                                      */
/****************************************************************************/

/**
 * Load contraints inc files.
 */
function _password_policy_constraints() {
  static $_password_policy;

  if (!isset($_password_policy)) {
    // Save all available constraints in a static variable.
    $dir = drupal_get_path('module', 'password_policy') . '/constraints';
    $constraints = file_scan_directory($dir, '^constraint.*\.inc$');
    $_password_policy = array();

    foreach ($constraints as $file) {
      if (is_file($file->filename)) {
        include_once($file->filename);
        $_password_policy[] = drupal_substr($file->name, 11);
      }
    }
  }

  return $_password_policy;
}

/**
 * Loads the policy with the specified id.
 *
 * @param $pid
 *   The policy id.
 *
 * @return
 *   A policy array, or NULL if no policy was found.
 */
function _password_policy_load_policy_by_pid($pid) {
  $result = db_query('SELECT * FROM {password_policy} WHERE pid = %d', $pid);
  $row = db_fetch_array($result);
  if (is_array($row)) {
    // fetch and unserialize the serialized policy
    $row['policy'] = unserialize($row['policy']);
    // Fetch roles
    $row['roles'] = array();
    $result = db_query('SELECT rid FROM {password_policy_role} WHERE pid = %d', $pid);
    while ($role = db_fetch_object($result)) {
      $row['roles'][$role->rid] = $role->rid;
    }
    return $row;
  }
  return NULL;
}

/**
 * Loads the first enabled policy that matches the specified roles.
 *
 * @param $roles
 *   An array of role IDs.
 *
 * @return
 *   A policy array, or NULL if no active policy exists.
 */
function _password_policy_load_active_policy($roles) {
  static $cache = array();
  if (empty($roles)) {
    $roles = array(DRUPAL_AUTHENTICATED_RID);
  }
  $key = implode(',', $roles);
  // Use array_key_exists() instead of isset() as NULLs may be in the array.
  if (!array_key_exists($key, $cache)) {
    $result = db_query('SELECT p.* FROM {password_policy} p INNER JOIN {password_policy_role} r ON p.pid = r.pid WHERE p.enabled = 1 AND r.rid IN (' . db_placeholders($roles) . ') ORDER BY p.weight LIMIT 1', $roles);
    $row = db_fetch_array($result);
    if (is_array($row)) {
      // fetch and unserialize the serialized policy
      $row['policy'] = unserialize($row['policy']);
      $cache[$key] = $row;
    }
    else {
      $cache[$key] = NULL;
    }
  }
  return $cache[$key];
}

/**
 * Stores user password hash.
 *
 * @param $uid
 *   User id.
 * @param $pass
 *   Clear text password.
 */
function _password_policy_store_password($uid, $pass) {
  if (module_exists('phpass')) {
    // Get password hash already saved by phpass.  This is only certain to work
    // if this module's weight is less than that of phpass, as it should be.
    $hash = db_result(db_query("SELECT pass FROM {users} WHERE uid = %d", $uid));
  }
  else {
    $hash = md5($pass);
  }
  db_query("INSERT INTO {password_policy_history} (uid, pass, created) VALUES (%d, '%s', %d)", $uid, $hash, time());
}

/**
 * Block the expired account.
 *
 * @param $account
 *   User object.
 */
function _password_policy_block_account($account) {
  if ($account->uid > 1) { // We never block the superuser account.
    db_query("UPDATE {users} SET status = 0 WHERE uid = %d", $account->uid);

    if (db_result(db_query("SELECT pid FROM {password_policy_expiration} WHERE uid = %d", $account->uid))) {
      db_query("UPDATE {password_policy_expiration} SET blocked = %d WHERE uid = %d", time(), $account->uid);
    }
    else {
      db_query("INSERT INTO {password_policy_expiration} (uid, blocked) VALUES (%d, %d)", $account->uid, time());
    }

    watchdog('password_policy', 'Password for user %name has expired.', array('%name' => $account->name), WATCHDOG_NOTICE, l(t('edit'), 'user/' . $account->uid . '/edit'));

    include_once(drupal_get_path('module', 'user') . '/user.pages.inc');
    user_logout();
  }
}

/**
 * Unblocks the expired account.
 *
 * @param $account
 *   User object.
 */
function _password_policy_unblock($account) {
  // Check if user was blocked via this module.
  $pp_blocked = db_result(db_query(
    'SELECT pid FROM {password_policy_expiration} ppe
      WHERE blocked <> 0
      AND unblocked IS NULL
      AND uid = %d', $account->uid
  ));

  if ($pp_blocked) {
    db_query('UPDATE {password_policy_expiration} ppe
      SET unblocked = %d
      WHERE uid = %d AND unblocked IS NULL', time(), $account->uid);
    // Unblock the user.
    user_save($account, array('status' => 1));
    drupal_set_message(t('The user %name has been unblocked.', array('%name' => $account->name)));
  }
}

/**
 * Add password policy JS
 *
 * @param $policy
 *   A policy array.
 * @param $uid
 *   A user ID for which the policy is applied.
 */
function password_policy_add_policy_js($policy, $uid) {

  // Print out the javascript which checks the strength of the password.
  // It overwrites the default core javascript function.
  drupal_add_js(drupal_get_path('module', 'password_policy') . '/password_policy.js', 'module');
  $s = "/**\n";
  $s .= " * Evaluate the strength of a user's password.\n";
  $s .= " *\n";
  $s .= " * Returns the estimated strength and the relevant output message.\n";
  $s .= " */\n";
  $s .= "Drupal.evaluatePasswordStrength = function(value) {\n";
  $s .= "  var strength = \"high\", msg = [], translate = Drupal.settings.password_policy;\n";
  $s .= "  var trimmedSpaces = /^\s+|\s+$/.test(value);\n";
  $s .= "  if (/^\s+$/.test(value)) {\n";
  $s .= "    return { strength: \"low\", message: translate.allSpaces };\n";
  $s .= "  }\n";
  $s .= "  value = value.replace(/^\s+|\s+$/g,'')\n";
  // Print out each constraint's javascript password strength evaluation.
  foreach ($policy['policy'] as $key => $value) {
    $s .= _password_policy_constraint_js($key, $value, $uid);
    // Constraints' error messages are used in javascript.
    $translate['constraint_' . $key] = _password_policy_constraint_error($key, $value);
  }
  $s .= "  msg = msg.length > 0 ? translate.needsMoreVariation +\"<ul><li>\"+ msg.join(\"</li><li>\") +\"</li></ul>\" : \"\";\n";
  $s .= "  if (trimmedSpaces && strength != \"high\") {\n";
  $s .= "    msg = msg.concat(translate.trimmedSpaces);\n";
  $s .= "  }\n";
  $s .= "  return { strength: strength, message: msg };\n";
  $s .= "};\n";
  drupal_add_js($s, 'inline');

  drupal_add_js(array(
    'password_policy' => array_merge(array(
      'strengthTitle' => t('Password quality:'),
      'lowStrength' => t('Bad'),
      'mediumStrength' => t('Good'),
      'highStrength' => t('Good'),
      'trimmedSpaces' => t('The password has spaces at the beginning or end which are ignored.'),
      'allSpaces' => t('The password is all spaces and will not be saved.'),
      'needsMoreVariation' => t('The password does not include enough variation to be secure.'),
      'confirmSuccess' => t('Yes'),
      'confirmFailure' => t('No'),
      'confirmTitle' => t('Passwords match:')), $translate)),
    'setting');
}