← All changes | modules/comments/base.php +75 -95 12.7.3 → 10.5.3 View file →

		@@ -1,22 +1,11 @@
1		-<?php //phpcs:ignore WordPress.Files.FileName.InvalidClassFileName
2		-/**
3		- * Jetpack comments base file - where the code shared between WP.com Highlander and Jetpack Highlander is defined
4		- *
5		- * @package automattic/jetpack
6		- */
	1	+<?php
7	2
8		-use Automattic\Jetpack\Image_CDN\Image_CDN_Core;
9		-
10	3	/**
11	4	* All the code shared between WP.com Highlander and Jetpack Highlander
12	5	*/
13	6	class Highlander_Comments_Base {
14		-
15		- /**
16		- * Constructor
17		- */
18		- public function __construct() {
	7	+ function __construct() {
19	8	$this->setup_globals();
20	9	$this->setup_actions();
21	10	$this->setup_filters();
22	11	}
		@@ -22,30 +11,27 @@
22	11	}
23	12
24	13	/**
25	14	* Set any global variables or class variables
26		- *
27		- * @since 1.4
	15	+ * @since JetpackComments (1.4)
28	16	*/
29	17	protected function setup_globals() {}
30	18
31	19	/**
32	20	* Setup actions for methods in this class
33		- *
34		- * @since 1.4
	21	+ * @since JetpackComments (1.4)
35	22	*/
36	23	protected function setup_actions() {
37		- // Before a comment is posted.
	24	+ // Before a comment is posted
38	25	add_action( 'pre_comment_on_post', array( $this, 'allow_logged_out_user_to_comment_as_external' ) );
39	26
40		- // After a comment is posted.
	27	+ // After a comment is posted
41	28	add_action( 'comment_post', array( $this, 'set_comment_cookies' ) );
42	29	}
43	30
44	31	/**
45	32	* Setup filters for methods in this class
46		- *
47		- * @since 1.4
	33	+ * @since JetpackComments (1.4)
48	34	*/
49	35	protected function setup_filters() {
50	36	add_filter( 'comments_array', array( $this, 'comments_array' ) );
51	37	add_filter( 'preprocess_comment', array( $this, 'allow_logged_in_user_to_comment_as_guest' ), 0 );
		@@ -52,46 +38,42 @@
52	38	}
53	39
54	40	/**
55	41	* Is this a Highlander POST request?
56		- * Optionally restrict to one or more credentials slug (facebook, ...)
	42	+ * Optionally restrict to one or more credentials slug (facebook, twitter, ...)
57	43	*
58		- * @param mixed ...$args Comments credentials slugs.
	44	+ * @param string Comment credentials slug
	45	+ * @param ...
59	46	* @return false|string false if it's not a Highlander POST request. The matching credentials slug if it is.
60	47	*/
61		- public function is_highlander_comment_post( ...$args ) {
62		-
63		- // phpcs:disable WordPress.Security.NonceVerification.Missing -- Nonce verification should happen in Jetpack_Comments::pre_comment_on_post(). Internal ref for details: p1645643468937519/1645189749.180299-slack-C02HQGKMFJ8
	48	+ function is_highlander_comment_post( ...$args ) {
64	49	if ( empty( $_POST['hc_post_as'] ) ) {
65	50	return false;
66	51	}
67		- $hc_post_as = wp_unslash( $_POST['hc_post_as'] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitized here by comparing against known values.
68		- // phpcs:enable WordPress.Security.NonceVerification.Missing
69	52
70	53	if ( $args ) {
71	54	foreach ( $args as $id_source ) {
72		- if ( $id_source === $hc_post_as ) {
	55	+ if ( $id_source === $_POST['hc_post_as'] ) {
73	56	return $id_source;
74	57	}
75	58	}
76	59	return false;
77	60	}
78		- return is_string( $hc_post_as ) && in_array( $hc_post_as, $this->id_sources, true ) ? $hc_post_as : false;
	61	+
	62	+ return is_string( $_POST['hc_post_as'] ) && in_array( $_POST['hc_post_as'], $this->id_sources ) ? $_POST['hc_post_as'] : false;
79	63	}
80	64
81	65	/**
82	66	* Signs an array of scalars with the self-hosted blog's Jetpack Token
83	67	*
84		- * If parameter values are not scalars a WP_Error is returned, otherwise a keyed hash value is returned using the HMAC method.
85		- *
86		- * @param array $parameters Comment parameters.
87		- * @param string $key Key used for generating the HMAC variant of the message digest.
	68	+ * @param array $parameters
	69	+ * @param string $key
88	70	* @return string HMAC
89	71	*/
90		- public static function sign_remote_comment_parameters( $parameters, $key ) {
	72	+ static function sign_remote_comment_parameters( $parameters, $key ) {
91	73	unset(
92		- $parameters['sig'], // Don't sign the signature.
93		- $parameters['replytocom'] // This parameter is unsigned - it changes dynamically as the comment form moves from parent comment to parent comment.
	74	+ $parameters['sig'], // Don't sign the signature
	75	+ $parameters['replytocom'] // This parameter is unsigned - it changes dynamically as the comment form moves from parent comment to parent comment
94	76	);
95	77
96	78	ksort( $parameters );
97	79
		@@ -106,20 +88,20 @@
106	88
107	89	return hash_hmac( 'sha1', implode( ':', $signing ), $key );
108	90	}
109	91
110		- /**
111		- * Adds comment author email and whether the comment is approved to the comments array
	92	+ /*
	93	+ * After commenting as a guest while logged in, the user needs to see both:
112	94	*
113		- * After commenting as a guest while logged in, the user needs to see both:
114	95	* ( user_id = blah AND comment_approved = 0 )
115		- * and ( comment_author_email = blah AND comment_approved = 0 )
116		- * Core only does the first since the user is logged in, so this adds the second to the comments array.
	96	+ * and
	97	+ * ( comment_author_email = blah AND comment_approved = 0 )
117	98	*
118		- * @param array $comments All comment data.
119		- * @return array A modified array of comment data.
120		- */
121		- public function comments_array( $comments ) {
	99	+ * Core only does the first since the user is logged in.
	100	+ *
	101	+ * Add the second to the comments array.
	102	+ */
	103	+ function comments_array( $comments ) {
122	104	global $wpdb, $post;
123	105
124	106	$commenter = $this->get_current_commenter();
125	107
		@@ -153,15 +135,15 @@
153	135
154	136	/**
155	137	* Comment sort comparator: comment_date_gmt
156	138	*
157		- * @since 1.4
158		- * @param object $a The first comment to compare dates with.
159		- * @param object $b The second comment to compare dates with.
	139	+ * @since JetpackComments (1.4)
	140	+ * @param object $a
	141	+ * @param object $b
160	142	* @return int
161	143	*/
162	144	public function sort_comments_by_comment_date_gmt( $a, $b ) {
163		- if ( $a->comment_date_gmt === $b->comment_date_gmt ) {
	145	+ if ( $a->comment_date_gmt == $b->comment_date_gmt ) {
164	146	return 0;
165	147	}
166	148
167	149	return $a->comment_date_gmt < $b->comment_date_gmt ? -1 : 1;
		@@ -169,13 +151,13 @@
169	151
170	152	/**
171	153	* Get the current commenter's information from their cookie
172	154	*
173		- * @since 1.4
	155	+ * @since JetpackComments (1.4)
174	156	* @return array Commenters information from cookie
175	157	*/
176	158	protected function get_current_commenter() {
177		- // Defaults.
	159	+ // Defaults
178	160	$user_id = 0;
179	161	$comment_author = '';
180	162	$comment_author_email = '';
181	163	$comment_author_url = '';
		@@ -180,17 +162,17 @@
180	162	$comment_author_email = '';
181	163	$comment_author_url = '';
182	164
183	165	if ( isset( $_COOKIE[ 'comment_author_' . COOKIEHASH ] ) ) {
184		- $comment_author = sanitize_text_field( wp_unslash( $_COOKIE[ 'comment_author_' . COOKIEHASH ] ) );
	166	+ $comment_author = $_COOKIE[ 'comment_author_' . COOKIEHASH ];
185	167	}
186	168
187	169	if ( isset( $_COOKIE[ 'comment_author_email_' . COOKIEHASH ] ) ) {
188		- $comment_author_email = sanitize_email( wp_unslash( $_COOKIE[ 'comment_author_email_' . COOKIEHASH ] ) );
	170	+ $comment_author_email = $_COOKIE[ 'comment_author_email_' . COOKIEHASH ];
189	171	}
190	172
191	173	if ( isset( $_COOKIE[ 'comment_author_url_' . COOKIEHASH ] ) ) {
192		- $comment_author_url = esc_url_raw( wp_unslash( $_COOKIE[ 'comment_author_url_' . COOKIEHASH ] ) );
	174	+ $comment_author_url = $_COOKIE[ 'comment_author_url_' . COOKIEHASH ];
193	175	}
194	176
195	177	if ( is_user_logged_in() ) {
196	178	$user = wp_get_current_user();
		@@ -200,15 +182,16 @@
200	182	return compact( 'comment_author', 'comment_author_email', 'comment_author_url', 'user_id' );
201	183	}
202	184
203	185	/**
204		- * Allows a logged out user to leave a comment as a facebook credentialed user.
	186	+ * Allows a logged out user to leave a comment as a facebook or twitter credentialed user.
205	187	* Overrides WordPress' core comment_registration option to treat these commenters as "registered" (verified) users.
206	188	*
207		- * @since 1.4
	189	+ * @since JetpackComments (1.4)
	190	+ * @return If no
208	191	*/
209		- public function allow_logged_out_user_to_comment_as_external() {
210		- if ( ! $this->is_highlander_comment_post( 'facebook' ) ) {
	192	+ function allow_logged_out_user_to_comment_as_external() {
	193	+ if ( ! $this->is_highlander_comment_post( 'facebook', 'twitter', 'googleplus' ) ) {
211	194	return;
212	195	}
213	196
214	197	add_filter( 'pre_option_comment_registration', '__return_zero' );
		@@ -215,29 +198,29 @@
215	198	add_filter( 'pre_option_require_name_email', '__return_zero' );
216	199	}
217	200
218	201	/**
219		- * Allow a logged in user to post as a guest, or FB credentialed request.
	202	+ * Allow a logged in user to post as a guest, FB, or twitter credentialed request.
220	203	* Bypasses WordPress' core overrides that force a logged in user to comment as that user.
221	204	* Respects comment_registration option.
222	205	*
223		- * @since 1.4
224		- * @param array $comment_data All data for a specific comment.
225		- * @return array Modified comment data, or an error if the required fields or a valid email address are not entered.
	206	+ * @since JetpackComments (1.4)
	207	+ * @param array $comment_data
	208	+ * @return int
226	209	*/
227		- public function allow_logged_in_user_to_comment_as_guest( $comment_data ) {
228		- // Bail if user registration is allowed.
	210	+ function allow_logged_in_user_to_comment_as_guest( $comment_data ) {
	211	+ // Bail if user registration is allowed
229	212	if ( get_option( 'comment_registration' ) ) {
230	213	return $comment_data;
231	214	}
232	215
233		- // Bail if user is not logged in or not a post request.
234		- if ( ! isset( $_SERVER['REQUEST_METHOD'] ) || 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) || ! is_user_logged_in() ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- simple comparison
	216	+ // Bail if user is not logged in or not a post request
	217	+ if ( 'POST' != strtoupper( $_SERVER['REQUEST_METHOD'] ) || ! is_user_logged_in() ) {
235	218	return $comment_data;
236	219	}
237	220
238		- // Bail if this is not a guest or external service credentialed request.
239		- if ( ! $this->is_highlander_comment_post( 'guest', 'facebook' ) ) {
	221	+ // Bail if this is not a guest or external service credentialed request
	222	+ if ( ! $this->is_highlander_comment_post( 'guest', 'facebook', 'twitter', 'googleplus' ) ) {
240	223	return $comment_data;
241	224	}
242	225
243	226	$user = wp_get_current_user();
		@@ -246,20 +229,18 @@
246	229	'comment_author' => 'display_name',
247	230	'comment_author_email' => 'user_email',
248	231	'comment_author_url' => 'user_url',
249	232	) as $comment_field => $user_field ) {
250		- if ( addslashes( $user->$user_field ) !== $comment_data[ $comment_field ] ) {
251		- return $comment_data; // some other plugin already did something funky.
	233	+ if ( $comment_data[ $comment_field ] != addslashes( $user->$user_field ) ) {
	234	+ return $comment_data; // some other plugin already did something funky
252	235	}
253	236	}
254	237
255		- // phpcs:disable WordPress.Security.NonceVerification.Missing -- Nonce verification should happen in Jetpack_Comments::pre_comment_on_post()
256		- // phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitization too
257	238	if ( get_option( 'require_name_email' ) ) {
258		- if ( isset( $_POST['email'] ) && 6 > strlen( wp_unslash( $_POST['email'] ) ) || empty( $_POST['author'] ) ) {
259		- wp_die( esc_html__( 'Error: please fill the required fields (name, email).', 'jetpack' ), 400 );
260		- } elseif ( ! isset( $_POST['email'] ) || ! is_email( wp_unslash( $_POST['email'] ) ) ) {
261		- wp_die( esc_html__( 'Error: please enter a valid email address.', 'jetpack' ), 400 );
	239	+ if ( 6 > strlen( $_POST['email'] ) || empty( $_POST['author'] ) ) {
	240	+ wp_die( __( 'Error: please fill the required fields (name, email).', 'jetpack' ), 400 );
	241	+ } elseif ( ! is_email( $_POST['email'] ) ) {
	242	+ wp_die( __( 'Error: please enter a valid email address.', 'jetpack' ), 400 );
262	243	}
263	244	}
264	245
265	246	$author_change = false;
		@@ -267,19 +248,17 @@
267	248	'comment_author' => 'author',
268	249	'comment_author_email' => 'email',
269	250	'comment_author_url' => 'url',
270	251	) as $comment_field => $post_field ) {
271		- if ( ( ! isset( $_POST[ $post_field ] ) || $comment_data[ $comment_field ] !== $_POST[ $post_field ] ) && 'url' !== $post_field ) {
	252	+ if ( $comment_data[ $comment_field ] != $_POST[ $post_field ] && 'url' != $post_field ) {
272	253	$author_change = true;
273	254	}
274		- $comment_data[ $comment_field ] = isset( $_POST[ $post_field ] ) ? wp_unslash( $_POST[ $post_field ] ) : null;
	255	+ $comment_data[ $comment_field ] = $_POST[ $post_field ];
275	256	}
276		- // phpcs:enable WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
277	257
278		- // Mark as guest comment if name or email were changed.
	258	+ // Mark as guest comment if name or email were changed
279	259	if ( $author_change ) {
280		- $comment_data['user_ID'] = 0;
281		- $comment_data['user_id'] = $comment_data['user_ID'];
	260	+ $comment_data['user_id'] = $comment_data['user_ID'] = 0;
282	261	}
283	262
284	263	return $comment_data;
285	264	}
		@@ -286,13 +265,14 @@
286	265
287	266	/**
288	267	* Set the comment cookies or bail if comment is invalid
289	268	*
290		- * @since 1.4
291		- * @param int $comment_id The comment ID.
	269	+ * @since JetpackComments (1.4)
	270	+ * @param type $comment_id
	271	+ * @return If comment is invalid
292	272	*/
293	273	public function set_comment_cookies( $comment_id ) {
294		- // Get comment and bail if it's invalid somehow.
	274	+ // Get comment and bail if it's invalid somehow
295	275	$comment = get_comment( $comment_id );
296	276	if ( empty( $comment ) || is_wp_error( $comment ) ) {
297	277	return;
298	278	}
		@@ -301,16 +281,16 @@
301	281	if ( empty( $id_source ) ) {
302	282	return;
303	283	}
304	284
305		- // Set comment author cookies.
	285	+ // Set comment author cookies
306	286	// phpcs:ignore WordPress.WP.CapitalPDangit
307		- if ( ( 'wordpress' !== $id_source ) && is_user_logged_in() ) {
	287	+ if ( ( 'wordpress' != $id_source ) && is_user_logged_in() ) {
308	288	/** This filter is already documented in core/wp-includes/comment-functions.php */
309	289	$comment_cookie_lifetime = apply_filters( 'comment_cookie_lifetime', 30000000 );
310		- setcookie( 'comment_author_' . COOKIEHASH, $comment->comment_author, time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN, is_ssl(), true );
311		- setcookie( 'comment_author_email_' . COOKIEHASH, $comment->comment_author_email, time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN, is_ssl(), true );
312		- setcookie( 'comment_author_url_' . COOKIEHASH, esc_url( $comment->comment_author_url ), time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN, is_ssl(), true );
	290	+ setcookie( 'comment_author_' . COOKIEHASH, $comment->comment_author, time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN );
	291	+ setcookie( 'comment_author_email_' . COOKIEHASH, $comment->comment_author_email, time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN );
	292	+ setcookie( 'comment_author_url_' . COOKIEHASH, esc_url( $comment->comment_author_url ), time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN );
313	293	}
314	294	}
315	295
316	296	/**
		@@ -315,15 +295,15 @@
315	295
316	296	/**
317	297	* Get an avatar from Photon
318	298	*
319		- * @since 1.4
320		- * @param string $url The avatar URL.
321		- * @param int $size The avatar size.
	299	+ * @since JetpackComments (1.4)
	300	+ * @param string $url
	301	+ * @param int $size
322	302	* @return string
323	303	*/
324	304	protected function photon_avatar( $url, $size ) {
325	305	$size = (int) $size;
326	306
327		- return Image_CDN_Core::cdn_url( $url, array( 'resize' => "$size,$size" ) );
	307	+ return jetpack_photon_url( $url, array( 'resize' => "$size,$size" ) );
328	308	}
329	309	}