jetpack / modules / comments / base.php

base.php in Jetpack – WP Security, Backup, Speed, & Growth 10.8, at modules/comments/base.php

325 lines 10.6 KB

Raw Download Zip

1	<?php //phpcs:ignore WordPress.Files.FileName.InvalidClassFileName
2	/**
3	* Jetpack comments base file - where the code shared between WP.com Highlander and Jetpack Highlander is defined
4	*
5	* @package automattic/jetpack
6	*/
7	/**
8	* All the code shared between WP.com Highlander and Jetpack Highlander
9	*/
10	class Highlander_Comments_Base {
11
12	/**
13	* Constructor
14	*/
15	public function __construct() {
16	$this->setup_globals();
17	$this->setup_actions();
18	$this->setup_filters();
19	}
20
21	/**
22	* Set any global variables or class variables
23	*
24	* @since JetpackComments (1.4)
25	*/
26	protected function setup_globals() {}
27
28	/**
29	* Setup actions for methods in this class
30	*
31	* @since JetpackComments (1.4)
32	*/
33	protected function setup_actions() {
34	// Before a comment is posted.
35	add_action( 'pre_comment_on_post', array( $this, 'allow_logged_out_user_to_comment_as_external' ) );
36
37	// After a comment is posted.
38	add_action( 'comment_post', array( $this, 'set_comment_cookies' ) );
39	}
40
41	/**
42	* Setup filters for methods in this class
43	*
44	* @since JetpackComments (1.4)
45	*/
46	protected function setup_filters() {
47	add_filter( 'comments_array', array( $this, 'comments_array' ) );
48	add_filter( 'preprocess_comment', array( $this, 'allow_logged_in_user_to_comment_as_guest' ), 0 );
49	}
50
51	/**
52	* Is this a Highlander POST request?
53	* Optionally restrict to one or more credentials slug (facebook, twitter, ...)
54	*
55	* @param mixed ...$args Comments credentials slugs.
56	* @return false\|string false if it's not a Highlander POST request. The matching credentials slug if it is.
57	*/
58	public function is_highlander_comment_post( ...$args ) {
59
60	// phpcs:disable WordPress.Security.NonceVerification.Missing -- Nonce verification should happen in Jetpack_Comments::pre_comment_on_post(). Internal ref for details: p1645643468937519/1645189749.180299-slack-C02HQGKMFJ8
61	if ( empty( $_POST['hc_post_as'] ) ) {
62	return false;
63	}
64
65	if ( $args ) {
66	foreach ( $args as $id_source ) {
67	if ( $id_source === $_POST['hc_post_as'] ) {
68	return $id_source;
69	}
70	}
71	return false;
72	}
73	return is_string( $_POST['hc_post_as'] ) && in_array( $_POST['hc_post_as'], $this->id_sources, true ) ? $_POST['hc_post_as'] : false;
74	// phpcs:enable WordPress.Security.NonceVerification.Missing
75	}
76
77	/**
78	* Signs an array of scalars with the self-hosted blog's Jetpack Token
79	*
80	* If parameter values are not scalars a WP_Error is returned, otherwise a keyed hash value is returned using the HMAC method.
81	*
82	* @param array $parameters Comment parameters.
83	* @param string $key Key used for generating the HMAC variant of the message digest.
84	* @return string HMAC
85	*/
86	public static function sign_remote_comment_parameters( $parameters, $key ) {
87	unset(
88	$parameters['sig'], // Don't sign the signature.
89	$parameters['replytocom'] // This parameter is unsigned - it changes dynamically as the comment form moves from parent comment to parent comment.
90	);
91
92	ksort( $parameters );
93
94	$signing = array();
95	foreach ( $parameters as $k => $v ) {
96	if ( ! is_scalar( $v ) ) {
97	return new WP_Error( 'invalid_input', __( 'Invalid request', 'jetpack' ), array( 'status' => 400 ) );
98	}
99
100	$signing[] = "{$k}={$v}";
101	}
102
103	return hash_hmac( 'sha1', implode( ':', $signing ), $key );
104	}
105
106	/**
107	* Adds comment author email and whether the comment is approved to the comments array
108	*
109	* After commenting as a guest while logged in, the user needs to see both:
110	* ( user_id = blah AND comment_approved = 0 )
111	* and ( comment_author_email = blah AND comment_approved = 0 )
112	* Core only does the first since the user is logged in, so this adds the second to the comments array.
113	*
114	* @param array $comments All comment data.
115	* @return array A modified array of comment data.
116	*/
117	public function comments_array( $comments ) {
118	global $wpdb, $post;
119
120	$commenter = $this->get_current_commenter();
121
122	if ( ! $commenter['user_id'] ) {
123	return $comments;
124	}
125
126	if ( ! $commenter['comment_author'] ) {
127	return $comments;
128	}
129
130	$in_moderation_comments = $wpdb->get_results(
131	$wpdb->prepare(
132	"SELECT * FROM `$wpdb->comments` WHERE `comment_post_ID` = %d AND `user_id` = 0 AND `comment_author` = %s AND `comment_author_email` = %s AND `comment_approved` = '0' ORDER BY `comment_date_gmt` /* Highlander_Comments_Base::comments_array() */",
133	$post->ID,
134	wp_specialchars_decode( $commenter['comment_author'], ENT_QUOTES ),
135	$commenter['comment_author_email']
136	)
137	);
138
139	if ( ! $in_moderation_comments ) {
140	return $comments;
141	}
142
143	// @todo ZOMG this is a bad idea
144	$comments = array_merge( $comments, $in_moderation_comments );
145	usort( $comments, array( $this, 'sort_comments_by_comment_date_gmt' ) );
146
147	return $comments;
148	}
149
150	/**
151	* Comment sort comparator: comment_date_gmt
152	*
153	* @since JetpackComments (1.4)
154	* @param object $a The first comment to compare dates with.
155	* @param object $b The second comment to compare dates with.
156	* @return int
157	*/
158	public function sort_comments_by_comment_date_gmt( $a, $b ) {
159	if ( $a->comment_date_gmt === $b->comment_date_gmt ) {
160	return 0;
161	}
162
163	return $a->comment_date_gmt < $b->comment_date_gmt ? -1 : 1;
164	}
165
166	/**
167	* Get the current commenter's information from their cookie
168	*
169	* @since JetpackComments (1.4)
170	* @return array Commenters information from cookie
171	*/
172	protected function get_current_commenter() {
173	// Defaults.
174	$user_id = 0;
175	$comment_author = '';
176	$comment_author_email = '';
177	$comment_author_url = '';
178
179	if ( isset( $_COOKIE[ 'comment_author_' . COOKIEHASH ] ) ) {
180	$comment_author = $_COOKIE[ 'comment_author_' . COOKIEHASH ];
181	}
182
183	if ( isset( $_COOKIE[ 'comment_author_email_' . COOKIEHASH ] ) ) {
184	$comment_author_email = $_COOKIE[ 'comment_author_email_' . COOKIEHASH ];
185	}
186
187	if ( isset( $_COOKIE[ 'comment_author_url_' . COOKIEHASH ] ) ) {
188	$comment_author_url = $_COOKIE[ 'comment_author_url_' . COOKIEHASH ];
189	}
190
191	if ( is_user_logged_in() ) {
192	$user = wp_get_current_user();
193	$user_id = $user->ID;
194	}
195
196	return compact( 'comment_author', 'comment_author_email', 'comment_author_url', 'user_id' );
197	}
198
199	/**
200	* Allows a logged out user to leave a comment as a facebook or twitter credentialed user.
201	* Overrides WordPress' core comment_registration option to treat these commenters as "registered" (verified) users.
202	*
203	* @since JetpackComments (1.4)
204	*/
205	public function allow_logged_out_user_to_comment_as_external() {
206	if ( ! $this->is_highlander_comment_post( 'facebook', 'twitter', 'googleplus' ) ) {
207	return;
208	}
209
210	add_filter( 'pre_option_comment_registration', '__return_zero' );
211	add_filter( 'pre_option_require_name_email', '__return_zero' );
212	}
213
214	/**
215	* Allow a logged in user to post as a guest, FB, or twitter credentialed request.
216	* Bypasses WordPress' core overrides that force a logged in user to comment as that user.
217	* Respects comment_registration option.
218	*
219	* @since JetpackComments (1.4)
220	* @param array $comment_data All data for a specific comment.
221	* @return array Modified comment data, or an error if the required fields or a valid email address are not entered.
222	*/
223	public function allow_logged_in_user_to_comment_as_guest( $comment_data ) {
224	// Bail if user registration is allowed.
225	if ( get_option( 'comment_registration' ) ) {
226	return $comment_data;
227	}
228
229	// Bail if user is not logged in or not a post request.
230	if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) \|\| ! is_user_logged_in() ) {
231	return $comment_data;
232	}
233
234	// Bail if this is not a guest or external service credentialed request.
235	if ( ! $this->is_highlander_comment_post( 'guest', 'facebook', 'twitter', 'googleplus' ) ) {
236	return $comment_data;
237	}
238
239	$user = wp_get_current_user();
240
241	foreach ( array(
242	'comment_author' => 'display_name',
243	'comment_author_email' => 'user_email',
244	'comment_author_url' => 'user_url',
245	) as $comment_field => $user_field ) {
246	if ( addslashes( $user->$user_field ) !== $comment_data[ $comment_field ] ) {
247	return $comment_data; // some other plugin already did something funky.
248	}
249	}
250
251	// phpcs:disable WordPress.Security.NonceVerification.Missing -- Nonce verification should happen in Jetpack_Comments::pre_comment_on_post()
252	if ( get_option( 'require_name_email' ) ) {
253	if ( 6 > strlen( $_POST['email'] ) \|\| empty( $_POST['author'] ) ) {
254	wp_die( esc_html__( 'Error: please fill the required fields (name, email).', 'jetpack' ), 400 );
255	} elseif ( ! is_email( $_POST['email'] ) ) {
256	wp_die( esc_html__( 'Error: please enter a valid email address.', 'jetpack' ), 400 );
257	}
258	}
259
260	$author_change = false;
261	foreach ( array(
262	'comment_author' => 'author',
263	'comment_author_email' => 'email',
264	'comment_author_url' => 'url',
265	) as $comment_field => $post_field ) {
266	if ( $comment_data[ $comment_field ] !== $_POST[ $post_field ] && 'url' !== $post_field ) {
267	$author_change = true;
268	}
269	$comment_data[ $comment_field ] = $_POST[ $post_field ];
270	}
271	// phpcs:enable WordPress.Security.NonceVerification.Missing
272
273	// Mark as guest comment if name or email were changed.
274	if ( $author_change ) {
275	$comment_data['user_ID'] = 0;
276	$comment_data['user_id'] = $comment_data['user_ID'];
277	}
278
279	return $comment_data;
280	}
281
282	/**
283	* Set the comment cookies or bail if comment is invalid
284	*
285	* @since JetpackComments (1.4)
286	* @param int $comment_id The comment ID.
287	*/
288	public function set_comment_cookies( $comment_id ) {
289	// Get comment and bail if it's invalid somehow.
290	$comment = get_comment( $comment_id );
291	if ( empty( $comment ) \|\| is_wp_error( $comment ) ) {
292	return;
293	}
294
295	$id_source = $this->is_highlander_comment_post();
296	if ( empty( $id_source ) ) {
297	return;
298	}
299
300	// Set comment author cookies.
301	// phpcs:ignore WordPress.WP.CapitalPDangit
302	if ( ( 'wordpress' !== $id_source ) && is_user_logged_in() ) {
303	/** This filter is already documented in core/wp-includes/comment-functions.php */
304	$comment_cookie_lifetime = apply_filters( 'comment_cookie_lifetime', 30000000 );
305	setcookie( 'comment_author_' . COOKIEHASH, $comment->comment_author, time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN );
306	setcookie( 'comment_author_email_' . COOKIEHASH, $comment->comment_author_email, time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN );
307	setcookie( 'comment_author_url_' . COOKIEHASH, esc_url( $comment->comment_author_url ), time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN );
308	}
309	}
310
311	/**
312	* Get an avatar from Photon
313	*
314	* @since JetpackComments (1.4)
315	* @param string $url The avatar URL.
316	* @param int $size The avatar size.
317	* @return string
318	*/
319	protected function photon_avatar( $url, $size ) {
320	$size = (int) $size;
321
322	return jetpack_photon_url( $url, array( 'resize' => "$size,$size" ) );
323	}
324	}
325