add UserHelper::find_user_by_login() and rewrite some user checks to invoke it instead of going through PDO

5 files changed, 44 insertions, 61 deletions

diff --git a/classes/api.php b/classes/api.php
index 7e4691b32..fd783a63e 100755
--- a/classes/api.php
+++ b/classes/api.php
@@ -59,35 +59,25 @@ class API extends Handler {
 
 		if (SINGLE_USER_MODE) $login = "admin";
 
-		$sth = $this->pdo->prepare("SELECT id FROM ttrss_users WHERE LOWER(login) = LOWER(?)");
-		$sth->execute([$login]);
-
-		if ($row = $sth->fetch()) {
-			$uid = $row["id"];
+		if ($uid = UserHelper::find_user_by_login($login)) {
+			if (get_pref("ENABLE_API_ACCESS", $uid)) {
+				if (UserHelper::authenticate($login, $password, false,  Auth_Base::AUTH_SERVICE_API)) {               // try login with normal password
+					$this->wrap(self::STATUS_OK, array("session_id" => session_id(),
+						"api_level" => self::API_LEVEL));
+				} else if (UserHelper::authenticate($login, $password_base64, false, Auth_Base::AUTH_SERVICE_API)) { // else try with base64_decoded password
+					$this->wrap(self::STATUS_OK,	array("session_id" => session_id(),
+						"api_level" => self::API_LEVEL));
+				} else {                                                         // else we are not logged in
+					user_error("Failed login attempt for $login from " . UserHelper::get_user_ip(), E_USER_WARNING);
+					$this->wrap(self::STATUS_ERR, array("error" => "LOGIN_ERROR"));
+				}
+			} else {
+				$this->wrap(self::STATUS_ERR, array("error" => "API_DISABLED"));
+			}
 		} else {
-			$uid = 0;
-		}
-
-		if (!$uid) {
 			$this->wrap(self::STATUS_ERR, array("error" => "LOGIN_ERROR"));
 			return;
 		}
-
-		if (get_pref("ENABLE_API_ACCESS", $uid)) {
-			if (UserHelper::authenticate($login, $password, false,  Auth_Base::AUTH_SERVICE_API)) {               // try login with normal password
-				$this->wrap(self::STATUS_OK, array("session_id" => session_id(),
-					"api_level" => self::API_LEVEL));
-			} else if (UserHelper::authenticate($login, $password_base64, false, Auth_Base::AUTH_SERVICE_API)) { // else try with base64_decoded password
-				$this->wrap(self::STATUS_OK,	array("session_id" => session_id(),
-					"api_level" => self::API_LEVEL));
-			} else {                                                         // else we are not logged in
-				user_error("Failed login attempt for $login from " . UserHelper::get_user_ip(), E_USER_WARNING);
-				$this->wrap(self::STATUS_ERR, array("error" => "LOGIN_ERROR"));
-			}
-		} else {
-			$this->wrap(self::STATUS_ERR, array("error" => "API_DISABLED"));
-		}
-
 	}
 
 	function logout() {
diff --git a/classes/auth/base.php b/classes/auth/base.php
index 1d68ae537..d54e9d8a2 100644
--- a/classes/auth/base.php
+++ b/classes/auth/base.php
@@ -15,13 +15,14 @@ abstract class Auth_Base extends Plugin implements IAuthModule {
 
 	// Auto-creates specified user if allowed by system configuration
 	// Can be used instead of find_user_by_login() by external auth modules
-	function auto_create_user($login, $password = false) {
+	function auto_create_user(string $login, $password = false) {
 		if ($login && defined('AUTH_AUTO_CREATE') && AUTH_AUTO_CREATE) {
-			$user_id = $this->find_user_by_login($login);
-
-			if (!$password) $password = make_password();
+			$user_id = UserHelper::find_user_by_login($login);
 
 			if (!$user_id) {
+
+				if (!$password) $password = make_password();
+
 				$salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
 				$pwd_hash = encrypt_password($password, $salt, true);
 
@@ -30,26 +31,18 @@ abstract class Auth_Base extends Plugin implements IAuthModule {
 						VALUES (LOWER(?), 0, null, NOW(), ?,?)");
 				$sth->execute([$login, $pwd_hash, $salt]);
 
-				return $this->find_user_by_login($login);
+				return UserHelper::find_user_by_login($login);
 
 			} else {
 				return $user_id;
 			}
 		}
 
-		return $this->find_user_by_login($login);
+		return UserHelper::find_user_by_login($login);
 	}
 
-	function find_user_by_login($login) {
-		$sth = $this->pdo->prepare("SELECT id FROM ttrss_users WHERE
-			LOWER(login) = LOWER(?)");
-		$sth->execute([$login]);
-
-		if ($row = $sth->fetch()) {
-			return $row["id"];
-		} else {
-			return false;
-		}
-
+	// @deprecated
+	function find_user_by_login(string $login) {
+		return UserHelper::find_user_by_login($login);
 	}
 }
diff --git a/classes/handler/public.php b/classes/handler/public.php
index a1ed667be..c6310f18b 100755
--- a/classes/handler/public.php
+++ b/classes/handler/public.php
@@ -248,19 +248,15 @@ class Handler_Public extends Handler {
 		$login = clean($_REQUEST["login"]);
 		$fresh = clean($_REQUEST["fresh"]) == "1";
 
-		$sth = $this->pdo->prepare("SELECT id FROM ttrss_users WHERE LOWER(login) = LOWER(?)");
-		$sth->execute([$login]);
-
-		if ($row = $sth->fetch()) {
-			$uid = $row["id"];
+		$uid = UserHelper::find_user_by_login($login);
 
+		if ($uid) {
 			print Feeds::getGlobalUnread($uid);
 
 			if ($fresh) {
 				print ";";
 				print Feeds::getFeedArticles(-3, false, true, $uid);
 			}
-
 		} else {
 			print "-1;User not found";
 		}
diff --git a/classes/pref/users.php b/classes/pref/users.php
index 45c4b82b8..67daa884f 100644
--- a/classes/pref/users.php
+++ b/classes/pref/users.php
@@ -237,22 +237,14 @@ class Pref_Users extends Handler_Protected {
 
 			if (!$login) return; // no blank usernames
 
-			$sth = $this->pdo->prepare("SELECT id FROM ttrss_users WHERE
-				LOWER(login) = LOWER(?)");
-			$sth->execute([$login]);
-
-			if (!$sth->fetch()) {
+			if (!UserHelper::find_user_by_login($login)) {
 
 				$sth = $this->pdo->prepare("INSERT INTO ttrss_users
 					(login,pwd_hash,access_level,last_login,created, salt)
 					VALUES (LOWER(?), ?, 0, null, NOW(), ?)");
 				$sth->execute([$login, $pwd_hash, $salt]);
 
-				$sth = $this->pdo->prepare("SELECT id FROM ttrss_users WHERE
-					LOWER(login) = LOWER(?) AND pwd_hash = ?");
-				$sth->execute([$login, $pwd_hash]);
-
-				if ($row = $sth->fetch()) {
+				if ($new_uid = UserHelper::find_user_by_login($login)) {
 
 					$new_uid = $row['id'];
 
diff --git a/classes/userhelper.php b/classes/userhelper.php
index 4519f2803..6c6ad10d9 100644
--- a/classes/userhelper.php
+++ b/classes/userhelper.php
@@ -1,8 +1,7 @@
 <?php
 class UserHelper {
 
-	static function authenticate($login, $password, $check_only = false, $service = false) {
-
+	static function authenticate(string $login = null, string $password = null, bool $check_only = false, string $service = null) {
 		if (!SINGLE_USER_MODE) {
 			$user_id = false;
 			$auth_module = false;
@@ -71,7 +70,7 @@ class UserHelper {
 		}
 	}
 
-	static function load_user_plugins($owner_uid, $pluginhost = false) {
+	static function load_user_plugins(int $owner_uid, PluginHost $pluginhost = null) {
 
 		if (!$pluginhost) $pluginhost = PluginHost::getInstance();
 
@@ -145,4 +144,17 @@ class UserHelper {
 		}
 	}
 
+	static function find_user_by_login(string $login) {
+		$pdo = Db::pdo();
+
+		$sth = $pdo->prepare("SELECT id FROM ttrss_users WHERE
+			LOWER(login) = LOWER(?)");
+		$sth->execute([$login]);
+
+		if ($row = $sth->fetch()) {
+			return $row["id"];
+		}
+
+		return false;
+	}
 }