class.wpcom-json-api-comment-endpoint.php — Jetpack – WP Security, Backup, Speed, & Growth 13.8.2

jetpack / json-endpoints / class.wpcom-json-api-comment-endpoint.php

jetpack / json-endpoints Last commit date

class.wpcom-json-api-comment-endpoint.php

243 lines

1	<?php //phpcs:ignore WordPress.Files.FileName.InvalidClassFileName
2	/**
3	* Comment endpoint.
4	*
5	* @todo - can this file be written without overriding global variables?
6	*
7	* @phpcs:disable WordPress.WP.GlobalVariablesOverride.Prohibited
8	*/
9	/**
10	* Comment endpoint class.
11	*/
12	abstract class WPCOM_JSON_API_Comment_Endpoint extends WPCOM_JSON_API_Endpoint {
13	/**
14	* Comment object array.
15	*
16	* @var $comment_object_format
17	*/
18	public $comment_object_format = array(
19	// explicitly document and cast all output.
20	'ID' => '(int) The comment ID.',
21	'post' => "(object>post_reference) A reference to the comment's post.",
22	'author' => '(object>author) The author of the comment.',
23	'date' => "(ISO 8601 datetime) The comment's creation time.",
24	'URL' => '(URL) The full permalink URL to the comment.',
25	'short_URL' => '(URL) The wp.me short URL.',
26	'content' => '(HTML) <code>context</code> dependent.',
27	'raw_content' => '(string) Raw comment content.',
28	'status' => array(
29	'approved' => 'The comment has been approved.',
30	'unapproved' => 'The comment has been held for review in the moderation queue.',
31	'spam' => 'The comment has been marked as spam.',
32	'trash' => 'The comment is in the trash.',
33	),
34	'parent' => "(object>comment_reference\|false) A reference to the comment's parent, if it has one.",
35	'type' => array(
36	'comment' => 'The comment is a regular comment.',
37	'trackback' => 'The comment is a trackback.',
38	'pingback' => 'The comment is a pingback.',
39	'review' => 'The comment is a product review.',
40	),
41	'like_count' => '(int) The number of likes for this comment.',
42	'i_like' => '(bool) Does the current user like this comment?',
43	'meta' => '(object) Meta data',
44	'can_moderate' => '(bool) Whether current user can moderate the comment.',
45	'i_replied' => '(bool) Has the current user replied to this comment?',
46	);
47
48	/**
49	* Class constructor.
50	*
51	* @param object $args - arguments passed to constructor.
52	*/
53	public function __construct( $args ) {
54	if ( ! $this->response_format ) {
55	$this->response_format =& $this->comment_object_format;
56	}
57	parent::__construct( $args );
58	}
59
60	/**
61	* Get the comment.
62	*
63	* @param int $comment_id - the ID of the comment.
64	* @param string $context - the context of the comment (displayed or edited).
65	*/
66	public function get_comment( $comment_id, $context ) {
67	global $blog_id;
68
69	$comment = get_comment( $comment_id );
70	if ( ! $comment \|\| is_wp_error( $comment ) ) {
71	return new WP_Error( 'unknown_comment', 'Unknown comment', 404 );
72	}
73
74	$types = array( '', 'comment', 'pingback', 'trackback', 'review' );
75	// @todo - can we make this comparison strict without breaking anything?
76	// phpcs:ignore WordPress.PHP.StrictInArray.MissingTrueStrict
77	if ( ! in_array( $comment->comment_type, $types ) ) {
78	return new WP_Error( 'unknown_comment', 'Unknown comment', 404 );
79	}
80
81	$post = get_post( $comment->comment_post_ID );
82	if ( ! $post \|\| is_wp_error( $post ) ) {
83	return new WP_Error( 'unknown_post', 'Unknown post', 404 );
84	}
85
86	$status = wp_get_comment_status( $comment->comment_ID );
87
88	// Permissions.
89	switch ( $context ) {
90	case 'edit':
91	if ( ! current_user_can( 'edit_comment', $comment->comment_ID ) ) {
92	return new WP_Error( 'unauthorized', 'User cannot edit comment', 403 );
93	}
94
95	$GLOBALS['post'] = $post;
96	$comment = get_comment_to_edit( $comment->comment_ID );
97	foreach ( array( 'comment_author', 'comment_author_email', 'comment_author_url' ) as $field ) {
98	$comment->$field = htmlspecialchars_decode( $comment->$field, ENT_QUOTES );
99	}
100	break;
101	case 'display':
102	if ( 'approved' !== $status ) {
103	$current_user_id = get_current_user_id();
104	$user_can_read_comment = false;
105	// @todo - can we make this comparison strict without breaking anything?
106	// phpcs:ignore Universal.Operators.StrictComparisons.LooseEqual
107	if ( $current_user_id && $comment->user_id && $current_user_id == $comment->user_id ) {
108	$user_can_read_comment = true;
109	} elseif (
110	$comment->comment_author_email && $comment->comment_author
111	&&
112	isset( $this->api->token_details['user'] )
113	&&
114	isset( $this->api->token_details['user']['user_email'] )
115	&&
116	$this->api->token_details['user']['user_email'] === $comment->comment_author_email
117	&&
118	$this->api->token_details['user']['display_name'] === $comment->comment_author
119	) {
120	$user_can_read_comment = true;
121	} else {
122	$user_can_read_comment = current_user_can( 'edit_posts' );
123	}
124
125	if ( ! $user_can_read_comment ) {
126	return new WP_Error( 'unauthorized', 'User cannot read unapproved comment', 403 );
127	}
128	}
129
130	$GLOBALS['post'] = $post;
131	setup_postdata( $post );
132	break;
133	default:
134	return new WP_Error( 'invalid_context', 'Invalid API CONTEXT', 400 );
135	}
136
137	$can_view = $this->user_can_view_post( $post->ID );
138	if ( ! $can_view \|\| is_wp_error( $can_view ) ) {
139	return $can_view;
140	}
141
142	$GLOBALS['comment'] = $comment;
143	$response = array();
144
145	foreach ( array_keys( $this->comment_object_format ) as $key ) {
146	switch ( $key ) {
147	case 'ID':
148	// explicitly cast all output.
149	$response[ $key ] = (int) $comment->comment_ID;
150	break;
151	case 'post':
152	$response[ $key ] = (object) array(
153	'ID' => (int) $post->ID,
154	'title' => (string) get_the_title( $post->ID ),
155	'type' => (string) $post->post_type,
156	'link' => (string) $this->links->get_post_link( $this->api->get_blog_id_for_output(), $post->ID ),
157	);
158	break;
159	case 'author':
160	$response[ $key ] = (object) $this->get_author( $comment, current_user_can( 'edit_comment', $comment->comment_ID ) );
161	break;
162	case 'date':
163	$response[ $key ] = (string) $this->format_date( $comment->comment_date_gmt, $comment->comment_date );
164	break;
165	case 'URL':
166	$response[ $key ] = (string) esc_url_raw( get_comment_link( $comment->comment_ID ) );
167	break;
168	case 'short_URL':
169	// @todo - pagination
170	$response[ $key ] = (string) esc_url_raw( wp_get_shortlink( $post->ID ) . "%23comment-{$comment->comment_ID}" );
171	break;
172	case 'content':
173	if ( 'display' === $context ) {
174	ob_start();
175	comment_text();
176	$response[ $key ] = (string) ob_get_clean();
177	} else {
178	$response[ $key ] = (string) $comment->comment_content;
179	}
180	break;
181	case 'raw_content':
182	$response[ $key ] = (string) $comment->comment_content;
183	break;
184	case 'status':
185	$response[ $key ] = (string) $status;
186	break;
187	case 'parent': // May be object or false.
188	$parent = $comment->comment_parent ? get_comment( $comment->comment_parent ) : null;
189	if ( $parent ) {
190	$response[ $key ] = (object) array(
191	'ID' => (int) $parent->comment_ID,
192	'type' => (string) ( $parent->comment_type ? $parent->comment_type : 'comment' ),
193	'link' => (string) $this->links->get_comment_link( $blog_id, $parent->comment_ID ),
194	);
195	} else {
196	$response[ $key ] = false;
197	}
198	break;
199	case 'type':
200	$response[ $key ] = (string) ( $comment->comment_type ? $comment->comment_type : 'comment' );
201	break;
202	case 'like_count':
203	if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
204	$response[ $key ] = (int) $this->api->comment_like_count( $blog_id, $post->ID, $comment->comment_ID );
205	}
206	break;
207	case 'i_like':
208	if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
209	$response[ $key ] = (bool) Likes::comment_like_current_user_likes( $blog_id, (int) $comment->comment_ID );
210	}
211	break;
212	case 'meta':
213	$response[ $key ] = (object) array(
214	'links' => (object) array(
215	'self' => (string) $this->links->get_comment_link( $this->api->get_blog_id_for_output(), $comment->comment_ID ),
216	'help' => (string) $this->links->get_comment_link( $this->api->get_blog_id_for_output(), $comment->comment_ID, 'help' ),
217	'site' => (string) $this->links->get_site_link( $this->api->get_blog_id_for_output() ),
218	'post' => (string) $this->links->get_post_link( $this->api->get_blog_id_for_output(), $comment->comment_post_ID ),
219	'replies' => (string) $this->links->get_comment_link( $this->api->get_blog_id_for_output(), $comment->comment_ID, 'replies/' ),
220	'likes' => (string) $this->links->get_comment_link( $this->api->get_blog_id_for_output(), $comment->comment_ID, 'likes/' ),
221	),
222	);
223	break;
224	case 'can_moderate':
225	$response[ $key ] = (bool) current_user_can( 'edit_comment', $comment_id );
226	break;
227	case 'i_replied':
228	$response[ $key ] = (bool) 0 < get_comments(
229	array(
230	'user_id' => get_current_user_id(),
231	'parent' => $comment->comment_ID,
232	'count' => true,
233	)
234	);
235	break;
236	}
237	}
238
239	unset( $GLOBALS['comment'], $GLOBALS['post'] );
240	return $response;
241	}
242	}
243