← All changes | includes/my-wordpress/comment-stats.php +186 -51 0.9.2 → 1.1.10 View file →

		@@ -1,7 +1,7 @@
1	1	<?php
2	2	/**
3		- * Desktop Mode — My WordPress: per-comment dossier endpoint.
	3	+ * OpenStation — My WordPress: per-comment dossier endpoint.
4	4	*
5	5	* `GET /desktop-mode/v1/comment-stats/<id>` returns the rendered
6	6	* comment + author + parent post + thread context + reply tree +
7	7	* a count of how active the author has been across the site. Powers
		@@ -7,17 +7,36 @@
7	7	* a count of how active the author has been across the site. Powers
8	8	* the right preview pane in the My WordPress folder when a comment
9	9	* is selected.
10	10	*
11		- * Permissions:
12		- * - The comment must be readable by the current user (approved,
13		- * OR the user can `moderate_comments`, OR they're the comment
14		- * author).
	11	+ * Permissions, in gate order:
	12	+ * - The route wears the module's authorization gate,
	13	+ * `openstation_my_wordpress_user_can_use()` — `edit_posts` by
	14	+ * default, filterable. (That gate does *not* decide WP Explorer's
	15	+ * window or launcher; the app declares its own capabilities. See
	16	+ * the helper's docblock in `window.php`.)
	17	+ * - The caller must be able to read the comment's parent post —
	18	+ * see `openstation_my_wordpress_can_read_comment_post()` — so a
	19	+ * low-capability author cannot read comments on posts they can't
	20	+ * otherwise see: private, sealed behind a password, or of a post
	21	+ * type with no readable front end at all.
	22	+ * - Past those two gates, the comment itself must be visible —
	23	+ * `openstation_my_wordpress_comment_is_visible()`: approved, OR the
	24	+ * user can `moderate_comments`, OR they're the comment author.
	25	+ * - The thread around it is scoped to the post those two gates just
	26	+ * authorized: `comment_post_ID` and `comment_parent` are independent
	27	+ * columns, so "the parent of a readable comment" is not by itself a
	28	+ * readable comment. Within that post the two thread members are
	29	+ * filtered differently:
	30	+ * - the parent runs the same visibility test as the requested
	31	+ * comment (approved, moderator, or own);
	32	+ * - replies are approved only — plus pending ones for a
	33	+ * moderator, as a moderation aid. Spam and trash never ship,
	34	+ * and there is no own-reply exception.
15	35	* - Author email / IP / user-agent only ship to viewers with
16	36	* `moderate_comments`.
17	37	*
18		- * @package WPDesktopMode
19		- * @since 0.8.0
	38	+ * @package OpenStation
20	39	*/
21	40
22	41	defined( 'ABSPATH' ) || exit;
23	42
		@@ -22,20 +41,23 @@
22	41	defined( 'ABSPATH' ) || exit;
23	42
24	43	/**
25	44	* Register the route.
26		- *
27		- * @since 0.8.0
28	45	*/
29		-function desktop_mode_my_wordpress_register_comment_stats_route() {
	46	+function openstation_my_wordpress_register_comment_stats_route() {
30	47	register_rest_route(
31	48	'desktop-mode/v1',
32	49	'/comment-stats/(?P<id>\d+)',
33	50	array(
34	51	'methods' => WP_REST_Server::READABLE,
35		- 'callback' => 'desktop_mode_my_wordpress_comment_stats_callback',
	52	+ 'callback' => 'openstation_my_wordpress_comment_stats_callback',
36	53	'permission_callback' => static function () {
37		- return is_user_logged_in();
	54	+ // The dossier is an author's tool, so it wears the
	55	+ // module's authorization gate rather than a gate of its
	56	+ // own. Bare is_user_logged_in() let any subscriber read
	57	+ // it (OPENSTA-155). WP Explorer's window and launcher
	58	+ // are gated separately, by the app's own capabilities.
	59	+ return openstation_my_wordpress_user_can_use();
38	60	},
39	61	'args' => array(
40	62	'id' => array(
41	63	'required' => true,
		@@ -45,39 +67,133 @@
45	67	),
46	68	)
47	69	);
48	70	}
49		-add_action( 'rest_api_init', 'desktop_mode_my_wordpress_register_comment_stats_route' );
	71	+add_action( 'rest_api_init', 'openstation_my_wordpress_register_comment_stats_route' );
50	72
51	73	/**
	74	+ * Whether the current user may read the post a comment belongs to.
	75	+ *
	76	+ * Three gates, in order:
	77	+ *
	78	+ * 1. **No parent at all.** An orphaned comment (`comment_post_ID` of
	79	+ * 0, or a post since deleted) has nothing to authorize against, so
	80	+ * it is moderators-only.
	81	+ * 2. **A sealed parent** needs `edit_post` — the escape hatch
	82	+ * `WP_REST_Posts_Controller::check_password_required()` grants.
	83	+ * Note `post_password_required()` reads the `wp-postpass` cookie:
	84	+ * a caller who has already entered the password is *not* looking at
	85	+ * a sealed post, and falls through to the gates below like any
	86	+ * other reader.
	87	+ * 3. **A parent whose post type has no readable front end** needs
	88	+ * `edit_post` too. This is the branch `read_post` alone misses:
	89	+ * `map_meta_cap()` resolves `read_post` on a *published* post to
	90	+ * the type's `read` capability, which is plain `read` on any post
	91	+ * type registered with `map_meta_cap`, and every logged-in user
	92	+ * holds it. So a published post of an internal post type — a
	93	+ * plugin's submission log, queue or internal note, none of which
	94	+ * a visitor can open — would otherwise read like a public post.
	95	+ * `openstation_ai_can_read_post()` takes the same position.
	96	+ *
	97	+ * Anything else is Core's `read_post`, matching
	98	+ * `WP_REST_Comments_Controller::check_read_post_permission()`. Unlike
	99	+ * the AI sibling this keeps `read_post` as the floor for viewable types
	100	+ * rather than short-circuiting publicly viewable posts: that helper
	101	+ * serves search, which is about public content, while this one mirrors
	102	+ * Core's single-comment read.
	103	+ *
	104	+ * @param WP_Post|null $post Parent post, or null when it no longer exists.
	105	+ * @return bool
	106	+ */
	107	+function openstation_my_wordpress_can_read_comment_post( $post ) {
	108	+ if ( ! $post ) {
	109	+ return current_user_can( 'moderate_comments' );
	110	+ }
	111	+ if ( post_password_required( $post ) && ! current_user_can( 'edit_post', $post->ID ) ) {
	112	+ return false;
	113	+ }
	114	+ $post_type = get_post_type_object( $post->post_type );
	115	+ if ( ! $post_type || ! is_post_type_viewable( $post_type ) ) {
	116	+ return current_user_can( 'edit_post', $post->ID );
	117	+ }
	118	+ return current_user_can( 'read_post', $post->ID );
	119	+}
	120	+
	121	+/**
	122	+ * Whether a comment's own moderation state lets the current user see it.
	123	+ *
	124	+ * The parent-post gate above decides whether the caller may see comments
	125	+ * on that post at all; this decides whether they may see *this* comment:
	126	+ * approved ones are public, anything pending, spam or trashed is for
	127	+ * moderators and for the person who wrote it.
	128	+ *
	129	+ * Applied to the requested comment and to the thread parent alike —
	130	+ * the parent is reached by id, not by a query that filters on status,
	131	+ * so without this its excerpt would ship whatever its status. Replies
	132	+ * are NOT run through it: their query filters on status in SQL, with
	133	+ * narrower rules (see the replies section of the callback).
	134	+ *
	135	+ * @param WP_Comment $comment Comment to test.
	136	+ * @return bool
	137	+ */
	138	+function openstation_my_wordpress_comment_is_visible( $comment ) {
	139	+ if ( '1' === (string) $comment->comment_approved ) {
	140	+ return true;
	141	+ }
	142	+ if ( current_user_can( 'moderate_comments' ) ) {
	143	+ return true;
	144	+ }
	145	+ $author_id = (int) $comment->user_id;
	146	+ return $author_id > 0 && (int) get_current_user_id() === $author_id;
	147	+}
	148	+
	149	+/**
52	150	* Aggregator callback.
53	151	*
54		- * @since 0.8.0
55		- *
56	152	* @param WP_REST_Request $request REST request.
57	153	* @return array|WP_Error
58	154	*/
59		-function desktop_mode_my_wordpress_comment_stats_callback( $request ) {
	155	+function openstation_my_wordpress_comment_stats_callback( $request ) {
60	156	global $wpdb;
	157	+ // `\d+` matches 0 and absint() keeps it, so the zero has to be
	158	+ // refused here: get_comment( 0 ) falls back to $GLOBALS['comment'],
	159	+ // which would answer /comment-stats/0 with whatever comment another
	160	+ // plugin happened to leave in the global instead of the documented
	161	+ // 404. Same hazard as get_post( 0 ) below, one level up.
61	162	$comment_id = (int) $request->get_param( 'id' );
62		- $comment = get_comment( $comment_id );
	163	+ $comment = $comment_id > 0 ? get_comment( $comment_id ) : null;
63	164	if ( ! $comment ) {
64	165	return new WP_Error(
65		- 'desktop_mode_comment_not_found',
	166	+ 'openstation_comment_not_found',
66	167	__( 'Comment not found.', 'desktop-mode' ),
67	168	array( 'status' => 404 )
68	169	);
69	170	}
70	171
	172	+ // Object-level authorization: refuse when the caller can't read
	173	+ // the comment's parent post (OPENSTA-155). Fetched once here and
	174	+ // reused for the parent-post payload below. The explicit zero
	175	+ // check matters: get_post( 0 ) falls back to the global post, so
	176	+ // an orphaned comment would be authorized against whatever post
	177	+ // happened to be global instead of hitting the moderators-only
	178	+ // branch.
	179	+ $post = $comment->comment_post_ID
	180	+ ? get_post( (int) $comment->comment_post_ID )
	181	+ : null;
	182	+ if ( ! openstation_my_wordpress_can_read_comment_post( $post ) ) {
	183	+ return new WP_Error(
	184	+ 'openstation_comment_forbidden',
	185	+ __( 'You do not have permission to view this comment.', 'desktop-mode' ),
	186	+ array( 'status' => 403 )
	187	+ );
	188	+ }
	189	+
71	190	$can_moderate = current_user_can( 'moderate_comments' );
72	191	$is_approved = '1' === (string) $comment->comment_approved;
73		- $is_self = is_user_logged_in()
74		- && (int) get_current_user_id() === (int) $comment->user_id
75		- && (int) $comment->user_id > 0;
76	192
77		- if ( ! $is_approved && ! $can_moderate && ! $is_self ) {
	193	+ if ( ! openstation_my_wordpress_comment_is_visible( $comment ) ) {
78	194	return new WP_Error(
79		- 'desktop_mode_comment_forbidden',
	195	+ 'openstation_comment_forbidden',
80	196	__( 'You do not have permission to view this comment.', 'desktop-mode' ),
81	197	array( 'status' => 403 )
82	198	);
83	199	}
		@@ -82,21 +198,22 @@
82	198	);
83	199	}
84	200
85	201	// ----- Comment body ------------------------------------------------
86		- $content_filtered = apply_filters( 'comment_text', $comment->comment_content, $comment, array() );
	202	+ /** This filter is documented in wp-includes/comment-template.php */
	203	+ $content_filtered = apply_filters( 'comment_text', $comment->comment_content, $comment, array() ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Core's filter, applied so comment bodies render as they do everywhere else.
87	204	$body = array(
88		- 'id' => (int) $comment->comment_ID,
89		- 'parent' => (int) $comment->comment_parent,
90		- 'date' => mysql2date( 'c', $comment->comment_date_gmt, false ),
91		- 'status' => $is_approved
	205	+ 'id' => (int) $comment->comment_ID,
	206	+ 'parent' => (int) $comment->comment_parent,
	207	+ 'date' => mysql2date( 'c', $comment->comment_date_gmt, false ),
	208	+ 'status' => $is_approved
92	209	? 'approved'
93	210	: ( '0' === (string) $comment->comment_approved
94	211	? 'pending'
95	212	: (string) $comment->comment_approved ),
96		- 'rendered' => (string) $content_filtered,
	213	+ 'rendered' => (string) $content_filtered,
97	214	'rendered_raw' => (string) $comment->comment_content,
98		- 'editLink' => $can_moderate
	215	+ 'editLink' => $can_moderate
99	216	? esc_url_raw(
100	217	admin_url(
101	218	'comment.php?action=editcomment&c=' . $comment->comment_ID
102	219	)
		@@ -125,31 +242,30 @@
125	242	}
126	243	if ( $author['userId'] > 0 ) {
127	244	$user = get_userdata( $author['userId'] );
128	245	if ( $user ) {
129		- $author['displayName'] = $user->display_name;
130		- $author['profileLink'] = get_author_posts_url( $user->ID );
	246	+ $author['displayName'] = $user->display_name;
	247	+ $author['profileLink'] = get_author_posts_url( $user->ID );
131	248	}
132	249	}
133	250
134	251	// ----- Parent post -------------------------------------------------
135		- $post = get_post( (int) $comment->comment_post_ID );
136	252	$post_payload = null;
137	253	if ( $post ) {
138		- $post_author = $post->post_author > 0
	254	+ $post_author = $post->post_author > 0
139	255	? get_userdata( (int) $post->post_author )
140	256	: null;
141	257	$post_payload = array(
142		- 'id' => (int) $post->ID,
143		- 'title' => get_the_title( $post ),
144		- 'link' => (string) get_permalink( $post ),
	258	+ 'id' => (int) $post->ID,
	259	+ 'title' => get_the_title( $post ),
	260	+ 'link' => (string) get_permalink( $post ),
145	261	'editLink' => current_user_can( 'edit_post', $post->ID )
146	262	? (string) get_edit_post_link( $post->ID, 'raw' )
147	263	: '',
148		- 'status' => (string) $post->post_status,
149		- 'type' => (string) $post->post_type,
150		- 'date' => mysql2date( 'c', $post->post_date_gmt, false ),
151		- 'author' => $post_author
	264	+ 'status' => (string) $post->post_status,
	265	+ 'type' => (string) $post->post_type,
	266	+ 'date' => mysql2date( 'c', $post->post_date_gmt, false ),
	267	+ 'author' => $post_author
152	268	? array(
153	269	'id' => (int) $post_author->ID,
154	270	'name' => $post_author->display_name,
155	271	'avatarUrl' => (string) get_avatar_url(
		@@ -161,17 +277,26 @@
161	277	);
162	278	}
163	279
164	280	// ----- Parent comment (if this is a reply) -------------------------
	281	+ // Only the thread above it on the SAME post, and only if its own
	282	+ // status allows. The gates at the top authorized one post and one
	283	+ // comment; `comment_post_ID` and `comment_parent` are independent
	284	+ // columns, and wp_insert_comment() will happily write a parent that
	285	+ // lives on another post, so an excerpt from an unreadable post could
	286	+ // otherwise ride in here on a readable comment.
165	287	$parent_payload = null;
166	288	if ( (int) $comment->comment_parent > 0 ) {
167	289	$parent_comment = get_comment( (int) $comment->comment_parent );
168		- if ( $parent_comment ) {
	290	+ if ( $parent_comment
	291	+ && (int) $parent_comment->comment_post_ID === (int) $comment->comment_post_ID
	292	+ && openstation_my_wordpress_comment_is_visible( $parent_comment )
	293	+ ) {
169	294	$parent_payload = array(
170		- 'id' => (int) $parent_comment->comment_ID,
	295	+ 'id' => (int) $parent_comment->comment_ID,
171	296	'authorName' => (string) $parent_comment->comment_author,
172		- 'date' => mysql2date( 'c', $parent_comment->comment_date_gmt, false ),
173		- 'excerpt' => wp_trim_words(
	297	+ 'date' => mysql2date( 'c', $parent_comment->comment_date_gmt, false ),
	298	+ 'excerpt' => wp_trim_words(
174	299	wp_strip_all_tags( $parent_comment->comment_content ),
175	300	40
176	301	),
177	302	);
		@@ -178,19 +303,31 @@
178	303	}
179	304	}
180	305
181	306	// ----- Replies (direct children) -----------------------------------
182		- $reply_rows = $wpdb->get_results(
	307	+ // Scoped to the authorized post for the same reason as the parent
	308	+ // above: `comment_parent` alone would pull in a comment stored
	309	+ // against a post the caller cannot read. A reply on another post is
	310	+ // not a reply to this thread anyway.
	311	+ //
	312	+ // Static SQL literal — must not go through a %s placeholder, which
	313	+ // would quote it into an adjacent string literal and break the clause.
	314	+ $reply_status_sql = $can_moderate
	315	+ ? "comment_approved IN ( '0', '1' )"
	316	+ : "comment_approved = '1'";
	317	+ $reply_rows = $wpdb->get_results(
	318	+ // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- $reply_status_sql is a fixed literal chosen above; no user input.
183	319	$wpdb->prepare(
184	320	"SELECT comment_ID, comment_author, comment_author_email,
185	321	comment_date_gmt, comment_content, comment_approved, user_id
186	322	FROM {$wpdb->comments}
187	323	WHERE comment_parent = %d
188		- AND ( comment_approved = '1' %s )
	324	+ AND comment_post_ID = %d
	325	+ AND {$reply_status_sql}
189	326	ORDER BY comment_date_gmt ASC
190	327	LIMIT 20",
191	328	$comment->comment_ID,
192		- $can_moderate ? "OR comment_approved = '0'" : ''
	329	+ $comment->comment_post_ID
193	330	),
194	331	ARRAY_A
195	332	);
196	333	$replies = array();
		@@ -246,15 +383,13 @@
246	383
247	384	/**
248	385	* Filter the per-comment dossier payload.
249	386	*
250		- * @since 0.8.0
251		- *
252	387	* @param array $payload Stats payload.
253	388	* @param int $comment_id Comment id.
254	389	*/
255	390	return apply_filters(
256		- 'desktop_mode_my_wordpress_comment_stats',
	391	+ 'openstation_my_wordpress_comment_stats',
257	392	$payload,
258	393	$comment_id
259	394	);
260	395	}