PluginProbe
ActivityPub / 7.8.2
ActivityPub v7.8.2
9.3.1 9.3.0 9.2.2 9.2.1 9.2.0 9.1.0 9.0.2 9.0.1 9.0.0 8.3.0 8.2.1 8.2.0 8.1.1 1.0.5 1.0.6 1.0.7 1.0.8 1.0.9 1.1.0 1.2.0 1.3.0 2.0.0 2.0.1 2.1.0 2.1.1 All 160 releases
← All changes | includes/class-comment.php +22 -216 8.2.07.8.2 View file →
@@ -7,9 +7,9 @@
7 7
8 8 namespace Activitypub;
9 9
10 10 use Activitypub\Collection\Actors;
11 -use Activitypub\Collection\Remote_Posts;
11 +use Activitypub\Collection\Posts;
12 12
13 13 /**
14 14 * ActivityPub Comment Class.
15 15 *
@@ -28,50 +28,16 @@
28 28 \add_filter( 'comment_class', array( self::class, 'comment_class' ), 10, 3 );
29 29 \add_filter( 'comment_feed_where', array( static::class, 'comment_feed_where' ) );
30 30 \add_filter( 'get_comment_link', array( self::class, 'remote_comment_link' ), 11, 2 );
31 31 \add_action( 'pre_get_comments', array( static::class, 'comment_query' ) );
32 - \add_filter( 'pre_comment_approved', array( static::class, 'pre_comment_approved' ), 11, 2 );
32 + \add_filter( 'pre_comment_approved', array( static::class, 'pre_comment_approved' ), 10, 2 );
33 33 \add_filter( 'get_avatar_comment_types', array( static::class, 'get_avatar_comment_types' ), 99 );
34 34 \add_action( 'update_option_activitypub_allow_likes', array( self::class, 'maybe_update_comment_counts' ), 10, 2 );
35 35 \add_action( 'update_option_activitypub_allow_reposts', array( self::class, 'maybe_update_comment_counts' ), 10, 2 );
36 - \add_filter( 'pre_wp_update_comment_count_now', array( static::class, 'pre_wp_update_comment_count_now' ), 5, 3 );
37 - \add_filter( 'get_comment_author', array( static::class, 'render_emoji' ), 10, 2 );
38 - \add_filter( 'comment_author', array( static::class, 'unescape_emoji' ), 20 ); // After esc_html().
39 - \add_filter( 'rest_comment_query', array( static::class, 'rest_comment_query' ) );
40 - \add_filter( 'comment_text', array( static::class, 'render_blocks' ), 5 ); // Before other filters.
36 + \add_filter( 'pre_wp_update_comment_count_now', array( static::class, 'pre_wp_update_comment_count_now' ), 10, 3 );
41 37 }
42 38
43 39 /**
44 - * Render blocks in comment content.
45 - *
46 - * Comments don't automatically parse blocks like posts do.
47 - * This filter applies do_blocks() to render activitypub/emoji
48 - * and activitypub/image blocks in comment content.
49 - *
50 - * @param string $content The comment content.
51 - *
52 - * @return string The content with blocks rendered.
53 - */
54 - public static function render_blocks( $content ) {
55 - if ( empty( $content ) || ! \str_contains( $content, '<!-- wp:activitypub/' ) ) {
56 - return $content;
57 - }
58 -
59 - $blocks = \parse_blocks( $content );
60 - $output = '';
61 -
62 - foreach ( $blocks as $block ) {
63 - if ( ! empty( $block['blockName'] ) && \str_starts_with( $block['blockName'], 'activitypub/' ) ) {
64 - $output .= \render_block( $block );
65 - } else {
66 - $output .= \serialize_block( $block );
67 - }
68 - }
69 -
70 - return $output;
71 - }
72 -
73 - /**
74 40 * Remove edit capabilities for comments received via ActivityPub.
75 41 *
76 42 * @param array $caps Array of capabilities.
77 43 * @param string $cap Capability name.
@@ -92,12 +58,10 @@
92 58
93 59 /**
94 60 * Filter the comment reply link.
95 61 *
96 - * Handles three cases for replies to fediverse comments:
97 - * 1. User can federate → show normal reply link
98 - * 2. User is logged in but can't federate → show warning (no reply link)
99 - * 3. User is not logged in → show remote reply block
62 + * We don't want to show the comment reply link for federated comments
63 + * if the user is disabled for federation.
100 64 *
101 65 * @param string $link The HTML markup for the comment reply link.
102 66 * @param array $args An array of arguments overriding the defaults.
103 67 * @param \WP_Comment $comment The object of the comment being replied.
@@ -108,42 +72,8 @@
108 72 if ( self::are_comments_allowed( $comment ) ) {
109 73 return $link;
110 74 }
111 75
112 - // Logged-in user without ActivityPub capability - show warning instead of reply link.
113 - if ( \is_user_logged_in() ) {
114 - $author = \esc_html( $comment->comment_author );
115 -
116 - $message = sprintf(
117 - /* translators: %s: comment author name */
118 - \__( '%s is on the Fediverse. To reply to them, ask your administrator to enable ActivityPub for your account.', 'activitypub' ),
119 - $author
120 - );
121 -
122 - // Add link to users page if current user can edit users.
123 - if ( \current_user_can( 'edit_users' ) ) {
124 - $message = sprintf(
125 - /* translators: 1: comment author name, 2: URL to the users management page */
126 - \__( '%1$s is on the Fediverse. To reply to them, <a href="%2$s">enable ActivityPub for your account</a>.', 'activitypub' ),
127 - $author,
128 - \esc_url( \admin_url( 'users.php' ) )
129 - );
130 - }
131 -
132 - $warning = sprintf(
133 - '<p class="activitypub-reply-warning"><em>%s</em></p>',
134 - \wp_kses( $message, array( 'a' => array( 'href' => array() ) ) )
135 - );
136 -
137 - /**
138 - * Filters the warning message shown to logged-in users without ActivityPub capability.
139 - *
140 - * @param string $warning The warning HTML markup.
141 - * @param \WP_Comment $comment The comment being replied to.
142 - */
143 - return \apply_filters( 'activitypub_federation_warning', $warning, $comment );
144 - }
145 -
146 76 if ( ! \WP_Block_Type_Registry::get_instance()->is_registered( 'activitypub/remote-reply' ) ) {
147 77 \register_block_type_from_metadata( ACTIVITYPUB_PLUGIN_DIR . 'build/remote-reply' );
148 78 }
149 79
@@ -183,14 +113,13 @@
183 113 if ( ! $current_user ) {
184 114 return false;
185 115 }
186 116
187 - if ( is_single_user() && \user_can( $current_user, 'activitypub' ) ) {
188 - // On a single user site, comments by users with the `activitypub` capability will be federated as the blog user.
117 + if ( is_single_user() && \user_can( $current_user, 'publish_posts' ) ) {
118 + // On a single user site, comments by users with the `publish_posts` capability will be federated as the blog user.
189 119 $current_user = Actors::BLOG_USER_ID;
190 120 }
191 121
192 - // User is not allowed to federate comments.
193 122 return user_can_activitypub( $current_user );
194 123 }
195 124
196 125 /**
@@ -289,9 +218,9 @@
289 218 return false;
290 219 }
291 220
292 221 if ( is_single_user() && \user_can( $user_id, 'activitypub' ) ) {
293 - // On a single user site, comments by users with the `activitypub` capability will be federated as the blog user.
222 + // On a single user site, comments by users with the `publish_posts` capability will be federated as the blog user.
294 223 $user_id = Actors::BLOG_USER_ID;
295 224 }
296 225
297 226 // User is not allowed to federate comments.
@@ -580,9 +509,9 @@
580 509 */
581 510 public static function get_comment_types() {
582 511 global $activitypub_comment_types;
583 512
584 - return (array) $activitypub_comment_types;
513 + return $activitypub_comment_types;
585 514 }
586 515
587 516 /**
588 517 * Is this a registered comment type.
@@ -767,16 +696,16 @@
767 696 if ( defined( 'ACTIVITYPUB_REQUEST' ) && ACTIVITYPUB_REQUEST ) {
768 697 return;
769 698 }
770 699
771 - // Do not exclude likes and reposts on REST requests (handled by rest_comment_query).
700 + // Do not exclude likes and reposts on REST requests.
772 701 if ( \wp_is_serving_rest_request() ) {
773 702 return;
774 703 }
775 704
776 - // Filter post types for admin requests.
705 + // Do only exclude interactions of `ap_post` post type.
777 706 if ( \is_admin() ) {
778 - $query->query_vars['post_type'] = self::get_allowed_comment_post_types();
707 + $query->query_vars['post_type'] = array_diff( \get_post_types_by_support( 'comments' ), self::hide_for() );
779 708 return;
780 709 }
781 710
782 711 // Do not exclude likes and reposts on non-singular pages.
@@ -783,60 +712,18 @@
783 712 if ( ! \is_singular() ) {
784 713 return;
785 714 }
786 715
787 - // Do not exclude likes and reposts if the query is for specific types.
716 + // Do not exclude likes and reposts if the query is for comments.
788 717 if ( ! empty( $query->query_vars['type__in'] ) || ! empty( $query->query_vars['type'] ) ) {
789 718 return;
790 719 }
791 720
792 - // Do not exclude likes and reposts if the query is already excluding other comment types.
793 - if ( ! empty( $query->query_vars['type__not_in'] ) ) {
794 - return;
795 - }
796 -
797 721 // Exclude likes and reposts by the ActivityPub plugin.
798 722 $query->query_vars['type__not_in'] = self::get_comment_type_slugs();
799 723 }
800 724
801 725 /**
802 - * Filters comments in REST API requests.
803 - *
804 - * Excludes comments on ActivityPub post types and ActivityPub comment
805 - * types (likes, reposts) from the REST API.
806 - *
807 - * @param array $prepared_args Array of arguments for WP_Comment_Query.
808 - *
809 - * @return array Modified array of arguments.
810 - */
811 - public static function rest_comment_query( $prepared_args ) {
812 - // Exclude comments on ActivityPub post types.
813 - $prepared_args['post_type'] = self::get_allowed_comment_post_types();
814 -
815 - // Exclude ActivityPub comment types (likes, reposts) unless explicitly requested.
816 - if ( empty( $prepared_args['type'] ) && empty( $prepared_args['type__in'] ) ) {
817 - $prepared_args['type__not_in'] = self::get_comment_type_slugs();
818 - }
819 -
820 - return $prepared_args;
821 - }
822 -
823 - /**
824 - * Returns post types that should show comments (excluding hidden post types).
825 - *
826 - * @return array Array of post type names.
827 - */
828 - private static function get_allowed_comment_post_types() {
829 - $hide_for = self::hide_for();
830 -
831 - if ( empty( $hide_for ) ) {
832 - return \get_post_types_by_support( 'comments' );
833 - }
834 -
835 - return \array_diff( \get_post_types_by_support( 'comments' ), $hide_for );
836 - }
837 -
838 - /**
839 726 * Filter the comment status before it is set.
840 727 *
841 728 * @param int|string|\WP_Error $approved The approved comment status.
842 729 * @param array $comment_data The comment data.
@@ -843,14 +730,9 @@
843 730 *
844 731 * @return int|string|\WP_Error The approval status. 1, 0, 'spam', 'trash', or WP_Error.
845 732 */
846 733 public static function pre_comment_approved( $approved, $comment_data ) {
847 - /*
848 - * Only return early for already-approved comments, trash, or errors.
849 - * Don't short-circuit on 'spam' - we may want to override Akismet.
850 - * Respect 'trash' since it comes from the WordPress disallowed list.
851 - */
852 - if ( 1 === $approved || '1' === $approved || 'trash' === $approved || \is_wp_error( $approved ) ) {
734 + if ( $approved || \is_wp_error( $approved ) ) {
853 735 return $approved;
854 736 }
855 737
856 738 // Maybe auto-approve likes and reposts.
@@ -860,19 +742,8 @@
860 742 ) {
861 743 return 1;
862 744 }
863 745
864 - /*
865 - * Always auto-approve comments on remote posts (ap_post) since
866 - * they are not visible in the WP admin comment moderation screen.
867 - */
868 - $post_id = $comment_data['comment_post_ID'];
869 - $post = \get_post( $post_id );
870 -
871 - if ( $post && \in_array( $post->post_type, self::hide_for(), true ) ) {
872 - return 1;
873 - }
874 -
875 746 if ( '1' !== \get_option( 'comment_previously_approved' ) ) {
876 747 return $approved;
877 748 }
878 749
@@ -893,8 +764,15 @@
893 764 if ( 1 === (int) $ok_to_comment ) {
894 765 return 1;
895 766 }
896 767
768 + $post_id = $comment_data['comment_post_ID'];
769 + $post = \get_post( $post_id );
770 +
771 + if ( $post && in_array( $post->post_type, self::hide_for(), true ) ) {
772 + return 1;
773 + }
774 +
897 775 return $approved;
898 776 }
899 777
900 778 /**
@@ -924,31 +802,8 @@
924 802 if ( null === $new_count ) {
925 803 $excluded_types = array_filter( self::get_comment_type_slugs(), array( self::class, 'is_comment_type_enabled' ) );
926 804
927 805 if ( ! empty( $excluded_types ) ) {
928 - /*
929 - * Include 'note' type when Gutenberg's filter is registered, so a
930 - * single query excludes both ActivityPub and Gutenberg types.
931 - */
932 - if ( \has_filter( 'pre_wp_update_comment_count_now', 'gutenberg_exclude_notes_from_comment_count' ) ) {
933 - $excluded_types[] = 'note';
934 - }
935 -
936 - /**
937 - * Filters the comment types excluded from the comment count.
938 - *
939 - * Runs at priority 5 on `pre_wp_update_comment_count_now` so that
940 - * a single query can exclude types from multiple plugins. Other
941 - * plugins can hook here to add their own comment types.
942 - *
943 - * @since 8.0.0
944 - *
945 - * @param string[] $excluded_types The comment type slugs to exclude.
946 - * @param int $post_id The post ID.
947 - */
948 - $excluded_types = \apply_filters( 'activitypub_excluded_comment_types', $excluded_types, $post_id );
949 - $excluded_types = array_unique( array_filter( $excluded_types ) );
950 -
951 806 global $wpdb;
952 807
953 808 // phpcs:ignore WordPress.DB
954 809 $new_count = (int) $wpdb->get_var( $wpdb->prepare( "SELECT COUNT(*) FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved = '1' AND comment_type NOT IN ('" . implode( "','", $excluded_types ) . "')", $post_id ) );
@@ -976,9 +831,9 @@
976 831 *
977 832 * @return string[] Array of post type names to hide comments for.
978 833 */
979 834 public static function hide_for() {
980 - $post_types = array( Remote_Posts::POST_TYPE );
835 + $post_types = array( Posts::POST_TYPE );
981 836
982 837 /**
983 838 * Filters the list of post types to hide comments for.
984 839 *
@@ -984,55 +839,6 @@
984 839 *
985 840 * @param string[] $post_types Array of post type names to hide comments for.
986 841 */
987 842 return \apply_filters( 'activitypub_hide_comments_for', $post_types );
988 - }
989 -
990 - /**
991 - * Render emoji in comment author name.
992 - *
993 - * Replaces emoji shortcodes with img tags on the get_comment_author filter.
994 - * Emoji data is retrieved from the linked remote actor.
995 - *
996 - * @param string $author The comment author name.
997 - * @param string $comment_id The comment ID as a numeric string.
998 - *
999 - * @return string The comment author name with rendered emoji.
1000 - */
1001 - public static function render_emoji( $author, $comment_id ) {
1002 - $remote_actor_id = \get_comment_meta( $comment_id, '_activitypub_remote_actor_id', true );
1003 -
1004 - if ( empty( $remote_actor_id ) ) {
1005 - return $author;
1006 - }
1007 -
1008 - $emoji_data = \get_post_meta( $remote_actor_id, '_activitypub_emoji', true );
1009 -
1010 - if ( empty( $emoji_data ) ) {
1011 - return $author;
1012 - }
1013 -
1014 - return Emoji::replace_from_json( $author, $emoji_data );
1015 - }
1016 -
1017 - /**
1018 - * Selectively unescape emoji images in comment author.
1019 - *
1020 - * This runs at priority 20 after WordPress's esc_html() filter on comment_author.
1021 - *
1022 - * @param string $author The comment author name (already escaped by WordPress).
1023 - *
1024 - * @return string The comment author name with emoji images unescaped.
1025 - */
1026 - public static function unescape_emoji( $author ) {
1027 - // Only attempt to unescape if there are emoji images present in the escaped string.
1028 - if ( false === \strpos( $author, 'class=&quot;emoji&quot;' ) ) {
1029 - return $author;
1030 - }
1031 -
1032 - // Decode entities so we can selectively restore emoji <img> tags.
1033 - $decoded = \html_entity_decode( $author, ENT_QUOTES | ENT_HTML5, 'UTF-8' );
1034 -
1035 - // Use strict KSES validation to only allow valid emoji img tags.
1036 - return \wp_kses( $decoded, Emoji::get_kses_allowed_html() );
1037 843 }
1038 844 }