class.wpcom-json-api-comment-endpoint.php — Jetpack – WP Security, Backup, Speed, & Growth 10.7.2

jetpack / json-endpoints / class.wpcom-json-api-comment-endpoint.php

jetpack / json-endpoints Last commit date

class.wpcom-json-api-comment-endpoint.php

243 lines

1	<?php //phpcs:ignore WordPress.Files.FileName.InvalidClassFileName
2	/**
3	* Comment endpoint.
4	*
5	* @todo - can this file be written without overriding global variables?
6	* @phpcs:disable WordPress.WP.GlobalVariablesOverride.Prohibited
7	*/
8	/**
9	* Comment endpoint class.
10	*/
11	abstract class WPCOM_JSON_API_Comment_Endpoint extends WPCOM_JSON_API_Endpoint {
12	/**
13	* Comment object array.
14	*
15	* @var $comment_object_format
16	*/
17	public $comment_object_format = array(
18	// explicitly document and cast all output.
19	'ID' => '(int) The comment ID.',
20	'post' => "(object>post_reference) A reference to the comment's post.",
21	'author' => '(object>author) The author of the comment.',
22	'date' => "(ISO 8601 datetime) The comment's creation time.",
23	'URL' => '(URL) The full permalink URL to the comment.',
24	'short_URL' => '(URL) The wp.me short URL.',
25	'content' => '(HTML) <code>context</code> dependent.',
26	'raw_content' => '(string) Raw comment content.',
27	'status' => array(
28	'approved' => 'The comment has been approved.',
29	'unapproved' => 'The comment has been held for review in the moderation queue.',
30	'spam' => 'The comment has been marked as spam.',
31	'trash' => 'The comment is in the trash.',
32	),
33	'parent' => "(object>comment_reference\|false) A reference to the comment's parent, if it has one.",
34	'type' => array(
35	'comment' => 'The comment is a regular comment.',
36	'trackback' => 'The comment is a trackback.',
37	'pingback' => 'The comment is a pingback.',
38	'review' => 'The comment is a product review.',
39	),
40	'like_count' => '(int) The number of likes for this comment.',
41	'i_like' => '(bool) Does the current user like this comment?',
42	'meta' => '(object) Meta data',
43	'can_moderate' => '(bool) Whether current user can moderate the comment.',
44	'i_replied' => '(bool) Has the current user replied to this comment?',
45	);
46
47	/**
48	* Class constructor.
49	*
50	* @param object $args - arguments passed to constructor.
51	*/
52	public function __construct( $args ) {
53	if ( ! $this->response_format ) {
54	$this->response_format =& $this->comment_object_format;
55	}
56	parent::__construct( $args );
57	}
58
59	/**
60	* Get the comment.
61	*
62	* @param int $comment_id - the ID of the comment.
63	* @param string $context - the context of the comment (displayed or edited).
64	*/
65	public function get_comment( $comment_id, $context ) {
66	global $blog_id;
67
68	$comment = get_comment( $comment_id );
69	if ( ! $comment \|\| is_wp_error( $comment ) ) {
70	return new WP_Error( 'unknown_comment', 'Unknown comment', 404 );
71	}
72
73	$types = array( '', 'comment', 'pingback', 'trackback', 'review' );
74	// @todo - can we make this comparison strict without breaking anything?
75	// phpcs:ignore WordPress.PHP.StrictInArray.MissingTrueStrict
76	if ( ! in_array( $comment->comment_type, $types ) ) {
77	return new WP_Error( 'unknown_comment', 'Unknown comment', 404 );
78	}
79
80	$post = get_post( $comment->comment_post_ID );
81	if ( ! $post \|\| is_wp_error( $post ) ) {
82	return new WP_Error( 'unknown_post', 'Unknown post', 404 );
83	}
84
85	$status = wp_get_comment_status( $comment->comment_ID );
86
87	// Permissions.
88	switch ( $context ) {
89	case 'edit':
90	if ( ! current_user_can( 'edit_comment', $comment->comment_ID ) ) {
91	return new WP_Error( 'unauthorized', 'User cannot edit comment', 403 );
92	}
93
94	$GLOBALS['post'] = $post;
95	$comment = get_comment_to_edit( $comment->comment_ID );
96	foreach ( array( 'comment_author', 'comment_author_email', 'comment_author_url' ) as $field ) {
97	$comment->$field = htmlspecialchars_decode( $comment->$field, ENT_QUOTES );
98	}
99	break;
100	case 'display':
101	if ( 'approved' !== $status ) {
102	$current_user_id = get_current_user_id();
103	$user_can_read_comment = false;
104	// @todo - can we make this comparison strict without breaking anything?
105	// phpcs:ignore Universal.Operators.StrictComparisons.LooseEqual
106	if ( $current_user_id && $comment->user_id && $current_user_id == $comment->user_id ) {
107	$user_can_read_comment = true;
108	} elseif (
109	$comment->comment_author_email && $comment->comment_author
110	&&
111	isset( $this->api->token_details['user'] )
112	&&
113	isset( $this->api->token_details['user']['user_email'] )
114	&&
115	$this->api->token_details['user']['user_email'] === $comment->comment_author_email
116	&&
117	$this->api->token_details['user']['display_name'] === $comment->comment_author
118	) {
119	$user_can_read_comment = true;
120	} else {
121	$user_can_read_comment = current_user_can( 'edit_posts' );
122	}
123
124	if ( ! $user_can_read_comment ) {
125	return new WP_Error( 'unauthorized', 'User cannot read unapproved comment', 403 );
126	}
127	}
128
129	$GLOBALS['post'] = $post;
130	setup_postdata( $post );
131	break;
132	default:
133	return new WP_Error( 'invalid_context', 'Invalid API CONTEXT', 400 );
134	}
135
136	$can_view = $this->user_can_view_post( $post->ID );
137	if ( ! $can_view \|\| is_wp_error( $can_view ) ) {
138	return $can_view;
139	}
140
141	$GLOBALS['comment'] = $comment;
142	$response = array();
143
144	foreach ( array_keys( $this->comment_object_format ) as $key ) {
145	switch ( $key ) {
146	case 'ID':
147	// explicitly cast all output.
148	$response[ $key ] = (int) $comment->comment_ID;
149	break;
150	case 'post':
151	$response[ $key ] = (object) array(
152	'ID' => (int) $post->ID,
153	'title' => (string) get_the_title( $post->ID ),
154	'type' => (string) $post->post_type,
155	'link' => (string) $this->links->get_post_link( $this->api->get_blog_id_for_output(), $post->ID ),
156	);
157	break;
158	case 'author':
159	$response[ $key ] = (object) $this->get_author( $comment, current_user_can( 'edit_comment', $comment->comment_ID ) );
160	break;
161	case 'date':
162	$response[ $key ] = (string) $this->format_date( $comment->comment_date_gmt, $comment->comment_date );
163	break;
164	case 'URL':
165	$response[ $key ] = (string) esc_url_raw( get_comment_link( $comment->comment_ID ) );
166	break;
167	case 'short_URL':
168	// @todo - pagination
169	$response[ $key ] = (string) esc_url_raw( wp_get_shortlink( $post->ID ) . "%23comment-{$comment->comment_ID}" );
170	break;
171	case 'content':
172	if ( 'display' === $context ) {
173	ob_start();
174	comment_text();
175	$response[ $key ] = (string) ob_get_clean();
176	} else {
177	$response[ $key ] = (string) $comment->comment_content;
178	}
179	break;
180	case 'raw_content':
181	$response[ $key ] = (string) $comment->comment_content;
182	break;
183	case 'status':
184	$response[ $key ] = (string) $status;
185	break;
186	case 'parent': // May be object or false.
187	if ( $comment->comment_parent ) {
188	$parent = get_comment( $comment->comment_parent );
189	$response[ $key ] = (object) array(
190	'ID' => (int) $parent->comment_ID,
191	'type' => (string) ( $parent->comment_type ? $parent->comment_type : 'comment' ),
192	'link' => (string) $this->links->get_comment_link( $blog_id, $parent->comment_ID ),
193	);
194	} else {
195	$response[ $key ] = false;
196	}
197	break;
198	case 'type':
199	$response[ $key ] = (string) ( $comment->comment_type ? $comment->comment_type : 'comment' );
200	break;
201	case 'like_count':
202	if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
203	$response[ $key ] = (int) $this->api->comment_like_count( $blog_id, $post->ID, $comment->comment_ID );
204	}
205	break;
206	case 'i_like':
207	if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
208	$response[ $key ] = (bool) Likes::comment_like_current_user_likes( $blog_id, $comment->comment_ID );
209	}
210	break;
211	case 'meta':
212	$response[ $key ] = (object) array(
213	'links' => (object) array(
214	'self' => (string) $this->links->get_comment_link( $this->api->get_blog_id_for_output(), $comment->comment_ID ),
215	'help' => (string) $this->links->get_comment_link( $this->api->get_blog_id_for_output(), $comment->comment_ID, 'help' ),
216	'site' => (string) $this->links->get_site_link( $this->api->get_blog_id_for_output() ),
217	'post' => (string) $this->links->get_post_link( $this->api->get_blog_id_for_output(), $comment->comment_post_ID ),
218	'replies' => (string) $this->links->get_comment_link( $this->api->get_blog_id_for_output(), $comment->comment_ID, 'replies/' ),
219	'likes' => (string) $this->links->get_comment_link( $this->api->get_blog_id_for_output(), $comment->comment_ID, 'likes/' ),
220	),
221	);
222	break;
223	case 'can_moderate':
224	$response[ $key ] = (bool) current_user_can( 'edit_comment', $comment_id );
225	break;
226	case 'i_replied':
227	$response[ $key ] = (bool) 0 < get_comments(
228	array(
229	'user_id' => get_current_user_id(),
230	'parent' => $comment->comment_ID,
231	'count' => true,
232	)
233	);
234	break;
235	}
236	}
237
238	unset( $GLOBALS['comment'], $GLOBALS['post'] );
239	return $response;
240	}
241	}
242
243