← All changes | includes/features/bbp_voting/ajax.php +146 -122 1.3.1 → 2.5.0 View file →

		@@ -1,122 +1,146 @@
1		-<?php
2		-if ( ! defined( 'ABSPATH' ) ) {
3		- exit; // Exit if accessed directly.
4		-}
5		-
6		-// Process a vote.
7		-add_action( 'wp_ajax_bbpress_post_vote_link_clicked', 'bbpress_post_add_vote' );
8		-add_action( 'wp_ajax_nopriv_bbpress_post_vote_link_clicked', 'bbpress_post_add_vote' );
9		-
10		-function bbpress_post_add_vote() {
11		- header( 'Content-type: application/json' );
12		- $post_id = (int) $_POST['post_id'];
13		-
14		- // View only for visitors.
15		- if ( ! is_user_logged_in() && apply_filters( 'bbp_voting_disable_voting_for_visitors', false ) ) {
16		- die( json_encode( [ 'error' => 'Voting is disabled for visitors.' ] ) );
17		- }
18		-
19		- // View only for closed topics
20		- $topic_id = bbp_get_reply_topic_id( $post_id );
21		- $topic_status = get_post_status( $topic_id );
22		- if ( $topic_status == 'closed' && apply_filters( 'bbp_voting_disable_voting_on_closed_topic', false ) ) {
23		- die( json_encode( [ 'error' => 'Voting is disabled on closed topics.' ] ) );
24		- }
25		- // View only for author of post
26		- if ( is_user_logged_in() && apply_filters( 'bbp_voting_disable_author_vote', false ) && get_post_field( 'post_author', $post_id ) == get_current_user_ID() ) {
27		- die( json_encode( [ 'error' => 'Voting is disabled on for the author.' ] ) );
28		- }
29		- // Direction
30		- $direction = (int) $_POST['direction'];
31		- $direction = in_array( $direction, [ 1, -1 ] ) ? $direction : 0; // Enforce 1 or -1
32		- // $voting_cookie = unserialize($_COOKIE['bbp_voting']);
33		- $voting_log = get_post_meta( $post_id, 'bbp_voting_log', true );
34		- $voting_log = is_array( $voting_log ) ? $voting_log : []; // Set up new array
35		- $client_ip = $_SERVER['REMOTE_ADDR'];
36		- $identifier = is_user_logged_in() ? get_current_user_id() : $client_ip;
37		- $admin_bypass = current_user_can( 'administrator' ) && apply_filters( 'bbp_voting_admin_bypass', false );
38		- $remove_vote = false;
39		- $reverse_vote = false;
40		- // Admin bypass skips the restriction checks
41		- if ( ! $admin_bypass ) {
42		- // Catch user voted already (by cookie)
43		- // if(isset($voting_cookie[$post_id])) {
44		- // echo 'Not allowed to vote twice';
45		- // exit;
46		- // } else {
47		- // Catch user voted already (by user ID or IP)
48		- if ( array_key_exists( $identifier, $voting_log ) ) {
49		- // Identifier found
50		- if ( $voting_log[ $identifier ] == $direction ) {
51		- // Voting again in the same direction
52		- $remove_vote = true;
53		- } elseif ( $voting_log[ $identifier ] == $direction * -1 ) {
54		- // Changing the vote in different direction
55		- $reverse_vote = true;
56		- } else {
57		- // Changing vote from 0
58		- }
59		- }
60		- // }
61		- }
62		- // All good, add the user's vote
63		- // But first get all the data
64		- $score = (int) get_post_meta( $post_id, 'bbp_voting_score', true );
65		- $ups = $ups_og = (int) get_post_meta( $post_id, 'bbp_voting_ups', true );
66		- $downs = $downs_og = (int) get_post_meta( $post_id, 'bbp_voting_downs', true );
67		- if ( $direction > 0 ) {
68		- // Up vote
69		- if ( $remove_vote ) {
70		- $ups = $ups - 1;
71		- $score = $score - 1;
72		- } else {
73		- $ups = $ups + 1;
74		- $score = $score + 1;
75		- }
76		- if ( $reverse_vote ) {
77		- $downs = $downs + 1;
78		- $score = $score + 1;
79		- }
80		- } elseif ( $direction < 0 ) {
81		- // Down vote
82		- if ( $remove_vote ) {
83		- $downs = $downs + 1;
84		- $score = $score + 1;
85		- } else {
86		- $downs = $downs - 1;
87		- $score = $score - 1;
88		- }
89		- if ( $reverse_vote ) {
90		- $ups = $ups - 1;
91		- $score = $score - 1;
92		- }
93		- }
94		- // Update the score
95		- update_post_meta( $post_id, 'bbp_voting_score', $score );
96		- // Update the ups and downs if needed
97		- if ( $ups !== $ups_og ) {
98		- update_post_meta( $post_id, 'bbp_voting_ups', $ups );
99		- }
100		- if ( $downs !== $downs_og ) {
101		- update_post_meta( $post_id, 'bbp_voting_downs', $downs );
102		- }
103		- // Hook for additional features like weighted score calculation
104		- do_action( 'bbp_voting_process_score_on_vote', $post_id, $ups, $downs );
105		- // Log the user's ID or IP
106		- $real_direction = $remove_vote ? 0 : $direction;
107		- $voting_log[ $identifier ] = $real_direction;
108		- update_post_meta( $post_id, 'bbp_voting_log', $voting_log );
109		- // Set the cookie
110		- // $voting_cookie[$post_id] = true;
111		- // setcookie('bbp_voting', serialize($voting_cookie), time() + (86400 * 30 * 365), '/');
112		- do_action( 'bbp_voting_voted', $post_id, $real_direction, $score, $identifier );
113		- echo json_encode(
114		- [
115		- 'score' => $score,
116		- 'direction' => $real_direction,
117		- 'ups' => $ups,
118		- 'downs' => $downs,
119		- ]
120		- );
121		- exit;
122		-}
	1	+<?php
	2	+if ( ! defined( 'ABSPATH' ) ) {
	3	+ exit; // Exit if accessed directly.
	4	+}
	5	+
	6	+// Process a vote.
	7	+add_action( 'wp_ajax_bbpress_post_vote_link_clicked', 'bbpress_post_add_vote' );
	8	+add_action( 'wp_ajax_nopriv_bbpress_post_vote_link_clicked', 'bbpress_post_add_vote' );
	9	+
	10	+function bbpress_post_add_vote() {
	11	+ // Verify nonce for security
	12	+ check_ajax_referer( 'forumax-nonce', 'nonce' );
	13	+
	14	+ header( 'Content-type: application/json' );
	15	+ $post_id = (int) $_POST['post_id'];
	16	+
	17	+ // View only for visitors.
	18	+ if ( ! is_user_logged_in() && forumax_get_opt( 'is_disabled_voting_for_non_logged_users', false ) ) {
	19	+ die( json_encode( [ 'error' => 'Voting is disabled for visitors.' ] ) );
	20	+ }
	21	+
	22	+ // View only for closed topics
	23	+ $topic_id = bbp_get_reply_topic_id( $post_id );
	24	+ $topic_status = get_post_status( $topic_id );
	25	+ if ( $topic_status == 'closed' && forumax_get_opt( 'is_disabled_voting_closed_topics', false ) ) {
	26	+ die( json_encode( [ 'error' => 'Voting is disabled on closed topics.' ] ) );
	27	+ }
	28	+ // View only for author of post
	29	+ if ( is_user_logged_in() && forumax_get_opt( 'is_disabled_voting_own_topic_reply', false ) && get_post_field( 'post_author', $post_id ) == get_current_user_ID() ) {
	30	+ die( json_encode( [ 'error' => 'Voting is disabled on for the author.' ] ) );
	31	+ }
	32	+ // Direction
	33	+ $direction = (int) $_POST['direction'];
	34	+ $direction = in_array( $direction, [ 1, -1 ] ) ? $direction : 0; // Enforce 1 or -1
	35	+
	36	+ // Check if down votes are disabled
	37	+ if ( $direction === -1 && forumax_get_opt( 'is_down_votes_disabled', 0 ) != 1 ) {
	38	+ die( json_encode( [ 'error' => 'Down voting is disabled.' ] ) );
	39	+ }
	40	+
	41	+ // $voting_cookie = unserialize($_COOKIE['bbp_voting']);
	42	+ $voting_log = get_post_meta( $post_id, 'bbp_voting_log', true );
	43	+ $voting_log = is_array( $voting_log ) ? $voting_log : []; // Set up new array
	44	+
	45	+ // Use hashed IP for anonymous users (GDPR compliant - real IP is never stored)
	46	+ $identifier = is_user_logged_in() ? get_current_user_id() : forumax_get_hashed_ip();
	47	+ $legacy_identifier = null;
	48	+
	49	+ // Backward compatibility: Check for legacy raw IP entries (pre-2.3.1)
	50	+ // This allows migration from raw IP to hashed IP without losing vote history
	51	+ if ( ! is_user_logged_in() ) {
	52	+ $raw_ip = forumax_get_raw_ip();
	53	+ if ( $raw_ip && array_key_exists( $raw_ip, $voting_log ) ) {
	54	+ $legacy_identifier = $raw_ip;
	55	+ }
	56	+ }
	57	+
	58	+ $admin_bypass = current_user_can( 'administrator' ) && forumax_get_opt( 'is_admin_can_vote_unlimited', false );
	59	+ $remove_vote = false;
	60	+ $reverse_vote = false;
	61	+ // Admin bypass skips the restriction checks
	62	+ if ( ! $admin_bypass ) {
	63	+ // Check for existing vote - first by new hashed identifier, then by legacy raw IP
	64	+ $check_identifier = array_key_exists( $identifier, $voting_log ) ? $identifier : $legacy_identifier;
	65	+
	66	+ if ( $check_identifier && array_key_exists( $check_identifier, $voting_log ) ) {
	67	+ // Identifier found (either hashed or legacy)
	68	+ if ( $voting_log[ $check_identifier ] == $direction ) {
	69	+ // Voting again in the same direction
	70	+ $remove_vote = true;
	71	+ } elseif ( $voting_log[ $check_identifier ] == $direction * -1 ) {
	72	+ // Changing the vote in different direction
	73	+ $reverse_vote = true;
	74	+ } else {
	75	+ // Changing vote from 0
	76	+ }
	77	+
	78	+ // Migrate legacy raw IP to hashed IP (one-time migration per vote)
	79	+ if ( $legacy_identifier && $check_identifier === $legacy_identifier ) {
	80	+ $voting_log[ $identifier ] = $voting_log[ $legacy_identifier ];
	81	+ unset( $voting_log[ $legacy_identifier ] );
	82	+ update_post_meta( $post_id, 'bbp_voting_log', $voting_log );
	83	+ }
	84	+ }
	85	+ }
	86	+ // All good, add the user's vote
	87	+ // But first get all the data
	88	+ $score = (int) get_post_meta( $post_id, 'bbp_voting_score', true );
	89	+ $ups = $ups_og = (int) get_post_meta( $post_id, 'bbp_voting_ups', true );
	90	+ $downs = $downs_og = (int) get_post_meta( $post_id, 'bbp_voting_downs', true );
	91	+ if ( $direction > 0 ) {
	92	+ // Up vote
	93	+ if ( $remove_vote ) {
	94	+ $ups = $ups - 1;
	95	+ $score = $score - 1;
	96	+ } else {
	97	+ $ups = $ups + 1;
	98	+ $score = $score + 1;
	99	+ }
	100	+ if ( $reverse_vote ) {
	101	+ $downs = $downs + 1;
	102	+ $score = $score + 1;
	103	+ }
	104	+ } elseif ( $direction < 0 ) {
	105	+ // Down vote
	106	+ if ( $remove_vote ) {
	107	+ $downs = $downs + 1;
	108	+ $score = $score + 1;
	109	+ } else {
	110	+ $downs = $downs - 1;
	111	+ $score = $score - 1;
	112	+ }
	113	+ if ( $reverse_vote ) {
	114	+ $ups = $ups - 1;
	115	+ $score = $score - 1;
	116	+ }
	117	+ }
	118	+ // Update the score
	119	+ update_post_meta( $post_id, 'bbp_voting_score', $score );
	120	+ // Update the ups and downs if needed
	121	+ if ( $ups !== $ups_og ) {
	122	+ update_post_meta( $post_id, 'bbp_voting_ups', $ups );
	123	+ }
	124	+ if ( $downs !== $downs_og ) {
	125	+ update_post_meta( $post_id, 'bbp_voting_downs', $downs );
	126	+ }
	127	+ // Hook for additional features like weighted score calculation
	128	+ do_action( 'bbp_voting_process_score_on_vote', $post_id, $ups, $downs );
	129	+ // Log the user's ID or IP
	130	+ $real_direction = $remove_vote ? 0 : $direction;
	131	+ $voting_log[ $identifier ] = $real_direction;
	132	+ update_post_meta( $post_id, 'bbp_voting_log', $voting_log );
	133	+ // Set the cookie
	134	+ // $voting_cookie[$post_id] = true;
	135	+ // setcookie('bbp_voting', serialize($voting_cookie), time() + (86400 * 30 * 365), '/');
	136	+ do_action( 'bbp_voting_voted', $post_id, $real_direction, $score, $identifier );
	137	+ echo json_encode(
	138	+ [
	139	+ 'score' => $score,
	140	+ 'direction' => $real_direction,
	141	+ 'ups' => $ups,
	142	+ 'downs' => $downs,
	143	+ ]
	144	+ );
	145	+ exit;
	146	+}