← All changes | modules/comments/base.php +46 -25 12.3.2 → 14.2 View file →

		@@ -23,9 +23,9 @@
23	23
24	24	/**
25	25	* Set any global variables or class variables
26	26	*
27		- * @since JetpackComments (1.4)
	27	+ * @since 1.4
28	28	*/
29	29	protected function setup_globals() {}
30	30
31	31	/**
		@@ -30,9 +30,9 @@
30	30
31	31	/**
32	32	* Setup actions for methods in this class
33	33	*
34		- * @since JetpackComments (1.4)
	34	+ * @since 1.4
35	35	*/
36	36	protected function setup_actions() {
37	37	// Before a comment is posted.
38	38	add_action( 'pre_comment_on_post', array( $this, 'allow_logged_out_user_to_comment_as_external' ) );
		@@ -43,9 +43,9 @@
43	43
44	44	/**
45	45	* Setup filters for methods in this class
46	46	*
47		- * @since JetpackComments (1.4)
	47	+ * @since 1.4
48	48	*/
49	49	protected function setup_filters() {
50	50	add_filter( 'comments_array', array( $this, 'comments_array' ) );
51	51	add_filter( 'preprocess_comment', array( $this, 'allow_logged_in_user_to_comment_as_guest' ), 0 );
		@@ -52,9 +52,9 @@
52	52	}
53	53
54	54	/**
55	55	* Is this a Highlander POST request?
56		- * Optionally restrict to one or more credentials slug (facebook, twitter, ...)
	56	+ * Optionally restrict to one or more credentials slug (facebook, ...)
57	57	*
58	58	* @param mixed ...$args Comments credentials slugs.
59	59	* @return false|string false if it's not a Highlander POST request. The matching credentials slug if it is.
60	60	*/
		@@ -153,25 +153,21 @@
153	153
154	154	/**
155	155	* Comment sort comparator: comment_date_gmt
156	156	*
157		- * @since JetpackComments (1.4)
	157	+ * @since 1.4
158	158	* @param object $a The first comment to compare dates with.
159	159	* @param object $b The second comment to compare dates with.
160	160	* @return int
161	161	*/
162	162	public function sort_comments_by_comment_date_gmt( $a, $b ) {
163		- if ( $a->comment_date_gmt === $b->comment_date_gmt ) {
164		- return 0;
165		- }
166		-
167		- return $a->comment_date_gmt < $b->comment_date_gmt ? -1 : 1;
	163	+ return $a->comment_date_gmt <=> $b->comment_date_gmt;
168	164	}
169	165
170	166	/**
171	167	* Get the current commenter's information from their cookie
172	168	*
173		- * @since JetpackComments (1.4)
	169	+ * @since 1.4
174	170	* @return array Commenters information from cookie
175	171	*/
176	172	protected function get_current_commenter() {
177	173	// Defaults.
		@@ -200,15 +196,16 @@
200	196	return compact( 'comment_author', 'comment_author_email', 'comment_author_url', 'user_id' );
201	197	}
202	198
203	199	/**
204		- * Allows a logged out user to leave a comment as a facebook or twitter credentialed user.
	200	+ * Allows a logged out user to leave a comment as a facebook/wp.com credentialed user.
205	201	* Overrides WordPress' core comment_registration option to treat these commenters as "registered" (verified) users.
206	202	*
207		- * @since JetpackComments (1.4)
	203	+ * @since 1.4
208	204	*/
209	205	public function allow_logged_out_user_to_comment_as_external() {
210		- if ( ! $this->is_highlander_comment_post( 'facebook', 'twitter' ) ) {
	206	+ // phpcs:ignore WordPress.WP.CapitalPDangit.MisspelledInText
	207	+ if ( ! $this->is_highlander_comment_post( 'facebook', 'wordpress' ) ) {
211	208	return;
212	209	}
213	210
214	211	add_filter( 'pre_option_comment_registration', '__return_zero' );
		@@ -215,13 +212,13 @@
215	212	add_filter( 'pre_option_require_name_email', '__return_zero' );
216	213	}
217	214
218	215	/**
219		- * Allow a logged in user to post as a guest, FB, or twitter credentialed request.
	216	+ * Allow a logged in user to post as a guest, or FB credentialed request.
220	217	* Bypasses WordPress' core overrides that force a logged in user to comment as that user.
221	218	* Respects comment_registration option.
222	219	*
223		- * @since JetpackComments (1.4)
	220	+ * @since 1.4
224	221	* @param array $comment_data All data for a specific comment.
225	222	* @return array Modified comment data, or an error if the required fields or a valid email address are not entered.
226	223	*/
227	224	public function allow_logged_in_user_to_comment_as_guest( $comment_data ) {
		@@ -235,9 +232,9 @@
235	232	return $comment_data;
236	233	}
237	234
238	235	// Bail if this is not a guest or external service credentialed request.
239		- if ( ! $this->is_highlander_comment_post( 'guest', 'facebook', 'twitter' ) ) {
	236	+ if ( ! $this->is_highlander_comment_post( 'guest', 'facebook' ) ) {
240	237	return $comment_data;
241	238	}
242	239
243	240	$user = wp_get_current_user();
		@@ -286,9 +283,9 @@
286	283
287	284	/**
288	285	* Set the comment cookies or bail if comment is invalid
289	286	*
290		- * @since JetpackComments (1.4)
	287	+ * @since 1.4
291	288	* @param int $comment_id The comment ID.
292	289	*/
293	290	public function set_comment_cookies( $comment_id ) {
294	291	// Get comment and bail if it's invalid somehow.
		@@ -302,15 +299,39 @@
302	299	return;
303	300	}
304	301
305	302	// Set comment author cookies.
	303	+ // We don't set the cookies if they are logged in with WordPress.com because they already have a cookie set.
306	304	// phpcs:ignore WordPress.WP.CapitalPDangit
307		- if ( ( 'wordpress' !== $id_source ) && is_user_logged_in() ) {
308		- /** This filter is already documented in core/wp-includes/comment-functions.php */
309		- $comment_cookie_lifetime = apply_filters( 'comment_cookie_lifetime', 30000000 );
310		- setcookie( 'comment_author_' . COOKIEHASH, $comment->comment_author, time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN, is_ssl(), true );
311		- setcookie( 'comment_author_email_' . COOKIEHASH, $comment->comment_author_email, time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN, is_ssl(), true );
312		- setcookie( 'comment_author_url_' . COOKIEHASH, esc_url( $comment->comment_author_url ), time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN, is_ssl(), true );
	305	+ if ( 'wordpress' !== $id_source ) {
	306	+ // phpcs:disable WordPress.Security.NonceVerification -- Nonce verification should happen in Jetpack_Comments::pre_comment_on_post().
	307	+ $is_consenting_to_cookies = ( isset( $_POST['wp-comment-cookies-consent'] ) );
	308	+
	309	+ $cookie_options = array(
	310	+ 'expires' => time() + apply_filters( 'comment_cookie_lifetime', YEAR_IN_SECONDS ),
	311	+ 'path' => COOKIEPATH,
	312	+ 'domain' => COOKIE_DOMAIN,
	313	+ 'secure' => is_ssl(),
	314	+ 'httponly' => true,
	315	+ );
	316	+
	317	+ // If there is no consent, remove any cookies that may have been set.
	318	+ if ( ( 'guest' === $id_source ) && ! $is_consenting_to_cookies ) {
	319	+ $cookie_options['expires'] = time() - YEAR_IN_SECONDS;
	320	+ }
	321	+
	322	+ // Set samesite to None if the request is from Jetpack iframe.
	323	+ // This is needed because it is considered third party.
	324	+ if ( isset( $_REQUEST['for'] ) && 'jetpack' === $_REQUEST['for'] ) {
	325	+ $cookie_options['samesite'] = 'None';
	326	+ }
	327	+ // phpcs:enable WordPress.Security.NonceVerification
	328	+
	329	+ // phpcs:disable Jetpack.Functions.SetCookie.MissingTrueHTTPOnly
	330	+ isset( $comment->comment_author ) ? setcookie( 'comment_author_' . COOKIEHASH, $comment->comment_author, $cookie_options ) : null;
	331	+ isset( $comment->comment_author_email ) ? setcookie( 'comment_author_email_' . COOKIEHASH, $comment->comment_author_email, $cookie_options ) : null;
	332	+ isset( $comment->comment_author_url ) ? setcookie( 'comment_author_url_' . COOKIEHASH, esc_url( $comment->comment_author_url ), $cookie_options ) : null;
	333	+ // phpcs:enable Jetpack.Functions.SetCookie.MissingTrueHTTPOnly
313	334	}
314	335	}
315	336
316	337	/**
		@@ -315,9 +336,9 @@
315	336
316	337	/**
317	338	* Get an avatar from Photon
318	339	*
319		- * @since JetpackComments (1.4)
	340	+ * @since 1.4
320	341	* @param string $url The avatar URL.
321	342	* @param int $size The avatar size.
322	343	* @return string
323	344	*/