← All changes | includes/extend/akismet.php +62 -54 2.6.17 → 2.6.19 View file →

		@@ -13,9 +13,9 @@
13	13	if ( ! class_exists( 'BBP_Akismet' ) ) :
14	14	/**
15	15	* Loads Akismet extension
16	16	*
17		- * @since 2.0.0 bbPress (r3277)
	17	+ * @since 2.0.0 bbPress (r3278)
18	18	*
19	19	* @package bbPress
20	20	* @subpackage Akismet
21	21	*/
		@@ -23,9 +23,9 @@
23	23
24	24	/**
25	25	* The last post checked by Akismet.
26	26	*
27		- * @since 2.0.0 bbPress (r3277)
	27	+ * @since 2.6.10 bbPress (r7252)
28	28	*
29	29	* @var array $last_post Default empty array.
30	30	*/
31	31	protected $last_post = array();
		@@ -32,9 +32,9 @@
32	32
33	33	/**
34	34	* The main bbPress Akismet loader
35	35	*
36		- * @since 2.0.0 bbPress (r3277)
	36	+ * @since 2.0.0 bbPress (r3278)
37	37	*/
38	38	public function __construct() {
39	39	$this->setup_actions();
40	40	}
		@@ -41,9 +41,9 @@
41	41
42	42	/**
43	43	* Setup the admin hooks
44	44	*
45		- * @since 2.0.0 bbPress (r3277)
	45	+ * @since 2.0.0 bbPress (r3376)
46	46	*
47	47	* @access private
48	48	*/
49	49	private function setup_actions() {
		@@ -90,9 +90,9 @@
90	90
91	91	/**
92	92	* Converts topic/reply data into Akismet comment checking format
93	93	*
94		- * @since 2.0.0 bbPress (r3277)
	94	+ * @since 2.0.0 bbPress (r3278)
95	95	*
96	96	* @param array $post_data
97	97	*
98	98	* @return array Array of post data
		@@ -114,29 +114,24 @@
114	114	$user_data['registered'] = date( 'Y-m-d H:i:s' ); // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date
115	115	$user_data['total_posts'] = (int) bbp_get_user_post_count( $post_data['post_author'] );
116	116
117	117	// Get user data
118		- $userdata = get_userdata( $post_data['post_author'] );
119		- $anonymous_data = bbp_filter_anonymous_post_data();
	118	+ $userdata = get_userdata( $post_data['post_author'] );
120	119
121		- // Author is anonymous
122		- if ( ! bbp_has_errors() ) {
123		- $user_data['name'] = $anonymous_data['bbp_anonymous_name'];
124		- $user_data['email'] = $anonymous_data['bbp_anonymous_email'];
125		- $user_data['website'] = $anonymous_data['bbp_anonymous_website'];
126		-
127		- // Author is logged in
128		- } elseif ( ! empty( $userdata ) ) {
	120	+ // Author has a WordPress account
	121	+ if ( ! empty( $userdata ) ) {
129	122	$user_data['name'] = $userdata->display_name;
130	123	$user_data['email'] = $userdata->user_email;
131	124	$user_data['website'] = $userdata->user_url;
132	125	$user_data['registered'] = $userdata->user_registered;
133	126
134		- // Missing author data, so set some empty strings
135	127	} else {
136		- $user_data['name'] = '';
137		- $user_data['email'] = '';
138		- $user_data['website'] = '';
	128	+ $anonymous_data = bbp_filter_anonymous_post_data();
	129	+ $valid_anonymous = ! bbp_has_errors();
	130	+
	131	+ $user_data['name'] = $valid_anonymous ? $anonymous_data['bbp_anonymous_name'] : '';
	132	+ $user_data['email'] = $valid_anonymous ? $anonymous_data['bbp_anonymous_email'] : '';
	133	+ $user_data['website'] = $valid_anonymous ? $anonymous_data['bbp_anonymous_website'] : '';
139	134	}
140	135
141	136	/** Post **************************************************************/
142	137
		@@ -178,9 +173,11 @@
178	173
179	174	// Set the results (from maybe_spam() above)
180	175	$post_data['bbp_akismet_result_headers'] = $_post['bbp_akismet_result_headers'];
181	176	$post_data['bbp_akismet_result'] = $_post['bbp_akismet_result'];
182		- $post_data['bbp_post_as_submitted'] = $_post;
	177	+ // Intentionally retain extra form and server fields for later Akismet reports.
	178	+ // Third-party plugins may add fields that help identify spam.
	179	+ $post_data['bbp_post_as_submitted'] = $_post;
183	180
184	181	// Avoid recursion by unsetting results from post-as-submitted
185	182	unset(
186	183	$post_data['bbp_post_as_submitted']['bbp_akismet_result_headers'],
		@@ -204,9 +201,9 @@
204	201	* Note: this method also is responsible for allowing users who can moderate to
205	202	* never have their posts marked as spam. This is because they are "trusted"
206	203	* users. However, their posts are still sent to Akismet to be checked.
207	204	*
208		- * @since 2.6.0 bbPress (r6873)
	205	+ * @since 2.6.0 bbPress (r6874)
209	206	*
210	207	* @param array $post_data
211	208	*
212	209	* @return array
		@@ -265,9 +262,9 @@
265	262
266	263	/**
267	264	* Submit a post for spamming or hamming
268	265	*
269		- * @since 2.0.0 bbPress (r3277)
	266	+ * @since 2.0.0 bbPress (r3308)
270	267	*
271	268	* @param int $post_id
272	269	*
273	270	* @global string $akismet_api_host
		@@ -431,9 +428,9 @@
431	428
432	429	/**
433	430	* Ping Akismet service and check for spam/ham response
434	431	*
435		- * @since 2.0.0 bbPress (r3277)
	432	+ * @since 2.0.0 bbPress (r3278)
436	433	*
437	434	* @param array $post_data
438	435	* @param string $check Accepts check|submit
439	436	* @param string $spam Accepts spam|ham
		@@ -461,9 +458,9 @@
461	458	$post_data['blog_lang'] = get_locale();
462	459	$post_data['referrer'] = wp_get_raw_referer();
463	460	$post_data['user_agent'] = bbp_current_author_ua();
464	461
465		- // Loop through _POST args and rekey strings
	462	+ // Keep all form fields, including third-party fields, as Akismet signals.
466	463	if ( ! empty( $_POST ) && is_countable( $_POST ) ) {
467	464	foreach ( $_POST as $key => $value ) {
468	465	if ( is_string( $value ) ) {
469	466	$post_data[ 'POST_' . $key ] = $value;
		@@ -470,21 +467,13 @@
470	467	}
471	468	}
472	469	}
473	470
474		- // Loop through _SERVER args and remove allowed keys
	471	+ // Keep server fields for third-party signals, but omit known credential keys.
475	472	if ( ! empty( $_SERVER ) && is_countable( $_SERVER ) ) {
476		-
477		- // Keys to ignore
478		- $ignore = array( 'HTTP_COOKIE', 'HTTP_COOKIE2', 'PHP_AUTH_PW' );
479		-
480	473	foreach ( $_SERVER as $key => $value ) {
481		-
482		- // Key should not be ignored
483		- if ( ! in_array( $key, $ignore, true ) && is_string( $value ) ) {
	474	+ if ( is_string( $value ) && ! $this->is_sensitive_server_key( $key ) ) {
484	475	$post_data[ $key ] = $value;
485		-
486		- // Key should be ignored
487	476	} else {
488	477	$post_data[ $key ] = '';
489	478	}
490	479	}
		@@ -528,8 +517,30 @@
528	517	return $post_data;
529	518	}
530	519
531	520	/**
	521	+ * Check whether a server key may contain credentials.
	522	+ *
	523	+ * @since 2.6.19 bbPress (r7639)
	524	+ *
	525	+ * @param string $key Server key.
	526	+ * @return bool Whether the key should be omitted.
	527	+ */
	528	+ private function is_sensitive_server_key( $key = '' ) {
	529	+ $sensitive = (bool) preg_match( '/(?:^|_)(?:AUTH(?:ORIZATION)?|COOKIE[0-9]*|PASS(?:WORD|WD)?|PRIVATE|SECRET|TOKEN|NONCE|CREDENTIALS?|KEY)(?:_|$)/i', $key );
	530	+
	531	+ /**
	532	+ * Filters whether a server field is omitted from Akismet requests.
	533	+ *
	534	+ * @since 2.6.19 bbPress (r7639)
	535	+ *
	536	+ * @param bool $sensitive Whether the field may contain credentials.
	537	+ * @param string $key Server key.
	538	+ */
	539	+ return (bool) apply_filters( 'bbp_akismet_is_sensitive_server_key', $sensitive, $key );
	540	+ }
	541	+
	542	+ /**
532	543	* Update post meta after a spam check
533	544	*
534	545	* @since 2.0.0 bbPress (r3308)
535	546	*
		@@ -560,21 +571,18 @@
560	571	// the same topic/reply as was checked by BBP_Akismet::check_post()
561	572	if ( is_object( $_post ) && ! empty( $this->last_post ) && is_array( $as_submitted ) ) {
562	573
563	574	// Get user data
564		- $userdata = get_userdata( $_post->post_author );
565		- $anonymous_data = bbp_filter_anonymous_post_data();
	575	+ $userdata = get_userdata( $_post->post_author );
	576	+ if ( ! empty( $userdata ) ) {
	577	+ $name = $userdata->display_name;
	578	+ $email = $userdata->user_email;
	579	+ } else {
	580	+ $anonymous_data = bbp_filter_anonymous_post_data();
	581	+ $name = ! empty( $anonymous_data['bbp_anonymous_name'] ) ? $anonymous_data['bbp_anonymous_name'] : '';
	582	+ $email = ! empty( $anonymous_data['bbp_anonymous_email'] ) ? $anonymous_data['bbp_anonymous_email'] : '';
	583	+ }
566	584
567		- // Which name?
568		- $name = ! empty( $anonymous_data['bbp_anonymous_name'] )
569		- ? $anonymous_data['bbp_anonymous_name']
570		- : $userdata->display_name;
571		-
572		- // Which email?
573		- $email = ! empty( $anonymous_data['bbp_anonymous_email'] )
574		- ? $anonymous_data['bbp_anonymous_email']
575		- : $userdata->user_email;
576		-
577	585	// More checks
578	586	if (
579	587
580	588	// Post matches
		@@ -763,9 +771,9 @@
763	771	*
764	772	* This code is directly taken from the akismet_http_post() function and
765	773	* documented to bbPress 2.0 standard.
766	774	*
767		- * @since 2.0.0 bbPress (r3466)
	775	+ * @since 2.0.0 bbPress (r3467)
768	776	*
769	777	* @param string $request The request we are sending
770	778	* @param string $host The host to send our request to
771	779	* @param string $path The path from the host
		@@ -808,9 +816,9 @@
808	816
809	817	/**
810	818	* Handles the repeated calls to wp_remote_post(), including SSL support.
811	819	*
812		- * @since 2.6.7 (bbPress r7194)
	820	+ * @since 2.6.7 bbPress (r7195)
813	821	*
814	822	* @param string $host_and_path Scheme-less URL
815	823	* @param array $http_args Array of arguments for wp_remote_post()
816	824	* @return array
		@@ -878,9 +886,9 @@
878	886
879	887	/**
880	888	* Return a user's roles on this site (including super_admin)
881	889	*
882		- * @since 2.3.0 bbPress (r4812)
	890	+ * @since 2.3.0 bbPress (r4813)
883	891	*
884	892	* @param int $user_id
885	893	*
886	894	* @return boolean
		@@ -913,9 +921,9 @@
913	921
914	922	/**
915	923	* Add Aksimet History meta-boxes to topics and replies
916	924	*
917		- * @since 2.4.0 bbPress (r5049)
	925	+ * @since 2.4.0 bbPress (r5050)
918	926	*/
919	927	public function add_metaboxes() {
920	928
921	929	// Topics
		@@ -941,9 +949,9 @@
941	949
942	950	/**
943	951	* Output for Akismet History meta-box
944	952	*
945		- * @since 2.4.0 bbPress (r5049)
	953	+ * @since 2.4.0 bbPress (r5050)
946	954	*/
947	955	public function history_metabox() {
948	956
949	957	// Post ID
		@@ -986,9 +994,9 @@
986	994
987	995	/**
988	996	* Get the number of rows to delete in a single clean-up query.
989	997	*
990		- * @since 2.6.9 bbPress (r7225)
	998	+ * @since 2.6.9 bbPress (r7227)
991	999	*
992	1000	* @param string $filter The name of the filter to run.
993	1001	* @return int
994	1002	*/
		@@ -1012,9 +1020,9 @@
1012	1020
1013	1021	/**
1014	1022	* Get the interval (in days) for spam to remain in the queue.
1015	1023	*
1016		- * @since 2.6.9 bbPress (r7225)
	1024	+ * @since 2.6.9 bbPress (r7227)
1017	1025	*
1018	1026	* @param string $filter The name of the filter to run.
1019	1027	* @return int
1020	1028	*/
		@@ -1276,9 +1284,9 @@
1276	1284
1277	1285	/**
1278	1286	* Maybe OPTIMIZE the _postmeta database table.
1279	1287	*
1280		- * @since 2.7.0 bbPress (r7203)
	1288	+ * @since 2.6.7 bbPress (r7203)
1281	1289	*
1282	1290	* @global wpdb $wpdb
1283	1291	*/
1284	1292	private function maybe_optimize_postmeta() {