class.wpcom-json-api-comment-endpoint.php — Jetpack – WP Security, Backup, Speed, & Growth 14.4.2

jetpack / json-endpoints / class.wpcom-json-api-comment-endpoint.php

jetpack / json-endpoints Last commit date

class.wpcom-json-api-comment-endpoint.php

253 lines

1	<?php //phpcs:ignore WordPress.Files.FileName.InvalidClassFileName
2	/**
3	* Comment endpoint.
4	*
5	* @todo - can this file be written without overriding global variables?
6	*
7	* @phpcs:disable WordPress.WP.GlobalVariablesOverride.Prohibited
8	*/
9	/**
10	* Comment endpoint class.
11	*/
12	abstract class WPCOM_JSON_API_Comment_Endpoint extends WPCOM_JSON_API_Endpoint {
13	/**
14	* Comment object array.
15	*
16	* @var $comment_object_format
17	*/
18	public $comment_object_format = array(
19	// explicitly document and cast all output.
20	'ID' => '(int) The comment ID.',
21	'post' => "(object>post_reference) A reference to the comment's post.",
22	'author' => '(object>author) The author of the comment.',
23	'date' => "(ISO 8601 datetime) The comment's creation time.",
24	'URL' => '(URL) The full permalink URL to the comment.',
25	'short_URL' => '(URL) The wp.me short URL.',
26	'content' => '(HTML) <code>context</code> dependent.',
27	'raw_content' => '(string) Raw comment content.',
28	'status' => array(
29	'approved' => 'The comment has been approved.',
30	'unapproved' => 'The comment has been held for review in the moderation queue.',
31	'spam' => 'The comment has been marked as spam.',
32	'trash' => 'The comment is in the trash.',
33	),
34	'parent' => "(object>comment_reference\|false) A reference to the comment's parent, if it has one.",
35	'type' => array(
36	'comment' => 'The comment is a regular comment.',
37	'trackback' => 'The comment is a trackback.',
38	'pingback' => 'The comment is a pingback.',
39	'review' => 'The comment is a product review.',
40	),
41	'like_count' => '(int) The number of likes for this comment.',
42	'i_like' => '(bool) Does the current user like this comment?',
43	'meta' => '(object) Meta data',
44	'can_moderate' => '(bool) Whether current user can moderate the comment.',
45	'i_replied' => '(bool) Has the current user replied to this comment?',
46	);
47
48	/**
49	* Class constructor.
50	*
51	* @param object $args - arguments passed to constructor.
52	*/
53	public function __construct( $args ) {
54	if ( ! $this->response_format ) {
55	$this->response_format =& $this->comment_object_format;
56	}
57	parent::__construct( $args );
58	}
59
60	/**
61	* Get the comment.
62	*
63	* @param int $comment_id - the ID of the comment.
64	* @param string $context - the context of the comment (displayed or edited).
65	*/
66	public function get_comment( $comment_id, $context ) {
67	global $blog_id;
68
69	$comment = get_comment( $comment_id );
70	if ( ! $comment \|\| is_wp_error( $comment ) ) {
71	return new WP_Error( 'unknown_comment', 'Unknown comment', 404 );
72	}
73
74	/**
75	* Filter the comment types that are allowed to be returned.
76	*
77	* @since 14.2
78	*
79	* @module json-api
80	*
81	* @param array $types Array of comment types.
82	*/
83	$types = apply_filters( 'jetpack_json_api_comment_types', array( '', 'comment', 'pingback', 'trackback', 'review' ) );
84
85	// @todo - can we make this comparison strict without breaking anything?
86	// phpcs:ignore WordPress.PHP.StrictInArray.MissingTrueStrict
87	if ( ! in_array( $comment->comment_type, $types ) ) {
88	return new WP_Error( 'unknown_comment', 'Unknown comment', 404 );
89	}
90
91	$post = get_post( $comment->comment_post_ID );
92	if ( ! $post \|\| is_wp_error( $post ) ) {
93	return new WP_Error( 'unknown_post', 'Unknown post', 404 );
94	}
95
96	$status = wp_get_comment_status( $comment->comment_ID );
97
98	// Permissions.
99	switch ( $context ) {
100	case 'edit':
101	if ( ! current_user_can( 'edit_comment', $comment->comment_ID ) ) {
102	return new WP_Error( 'unauthorized', 'User cannot edit comment', 403 );
103	}
104
105	$GLOBALS['post'] = $post;
106	$comment = get_comment_to_edit( $comment->comment_ID );
107	foreach ( array( 'comment_author', 'comment_author_email', 'comment_author_url' ) as $field ) {
108	$comment->$field = htmlspecialchars_decode( $comment->$field, ENT_QUOTES );
109	}
110	break;
111	case 'display':
112	if ( 'approved' !== $status ) {
113	$current_user_id = get_current_user_id();
114	$user_can_read_comment = false;
115	// @todo - can we make this comparison strict without breaking anything?
116	// phpcs:ignore Universal.Operators.StrictComparisons.LooseEqual
117	if ( $current_user_id && $comment->user_id && $current_user_id == $comment->user_id ) {
118	$user_can_read_comment = true;
119	} elseif (
120	$comment->comment_author_email && $comment->comment_author
121	&&
122	isset( $this->api->token_details['user'] )
123	&&
124	isset( $this->api->token_details['user']['user_email'] )
125	&&
126	$this->api->token_details['user']['user_email'] === $comment->comment_author_email
127	&&
128	$this->api->token_details['user']['display_name'] === $comment->comment_author
129	) {
130	$user_can_read_comment = true;
131	} else {
132	$user_can_read_comment = current_user_can( 'edit_posts' );
133	}
134
135	if ( ! $user_can_read_comment ) {
136	return new WP_Error( 'unauthorized', 'User cannot read unapproved comment', 403 );
137	}
138	}
139
140	$GLOBALS['post'] = $post;
141	setup_postdata( $post );
142	break;
143	default:
144	return new WP_Error( 'invalid_context', 'Invalid API CONTEXT', 400 );
145	}
146
147	$can_view = $this->user_can_view_post( $post->ID );
148	if ( ! $can_view \|\| is_wp_error( $can_view ) ) {
149	return $can_view;
150	}
151
152	$GLOBALS['comment'] = $comment;
153	$response = array();
154
155	foreach ( array_keys( $this->comment_object_format ) as $key ) {
156	switch ( $key ) {
157	case 'ID':
158	// explicitly cast all output.
159	$response[ $key ] = (int) $comment->comment_ID;
160	break;
161	case 'post':
162	$response[ $key ] = (object) array(
163	'ID' => (int) $post->ID,
164	'title' => (string) get_the_title( $post->ID ),
165	'type' => (string) $post->post_type,
166	'link' => (string) $this->links->get_post_link( $this->api->get_blog_id_for_output(), $post->ID ),
167	);
168	break;
169	case 'author':
170	$response[ $key ] = (object) $this->get_author( $comment, current_user_can( 'edit_comment', $comment->comment_ID ) );
171	break;
172	case 'date':
173	$response[ $key ] = (string) $this->format_date( $comment->comment_date_gmt, $comment->comment_date );
174	break;
175	case 'URL':
176	$response[ $key ] = (string) esc_url_raw( get_comment_link( $comment->comment_ID ) );
177	break;
178	case 'short_URL':
179	// @todo - pagination
180	$response[ $key ] = (string) esc_url_raw( wp_get_shortlink( $post->ID ) . "%23comment-{$comment->comment_ID}" );
181	break;
182	case 'content':
183	if ( 'display' === $context ) {
184	ob_start();
185	comment_text();
186	$response[ $key ] = (string) ob_get_clean();
187	} else {
188	$response[ $key ] = (string) $comment->comment_content;
189	}
190	break;
191	case 'raw_content':
192	$response[ $key ] = (string) $comment->comment_content;
193	break;
194	case 'status':
195	$response[ $key ] = (string) $status;
196	break;
197	case 'parent': // May be object or false.
198	$parent = $comment->comment_parent ? get_comment( $comment->comment_parent ) : null;
199	if ( $parent ) {
200	$response[ $key ] = (object) array(
201	'ID' => (int) $parent->comment_ID,
202	'type' => (string) ( $parent->comment_type ? $parent->comment_type : 'comment' ),
203	'link' => (string) $this->links->get_comment_link( $blog_id, $parent->comment_ID ),
204	);
205	} else {
206	$response[ $key ] = false;
207	}
208	break;
209	case 'type':
210	$response[ $key ] = (string) ( $comment->comment_type ? $comment->comment_type : 'comment' );
211	break;
212	case 'like_count':
213	if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
214	$response[ $key ] = (int) $this->api->comment_like_count( $blog_id, $post->ID, $comment->comment_ID );
215	}
216	break;
217	case 'i_like':
218	if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
219	$response[ $key ] = (bool) Likes::comment_like_current_user_likes( $blog_id, (int) $comment->comment_ID );
220	}
221	break;
222	case 'meta':
223	$response[ $key ] = (object) array(
224	'links' => (object) array(
225	'self' => (string) $this->links->get_comment_link( $this->api->get_blog_id_for_output(), $comment->comment_ID ),
226	'help' => (string) $this->links->get_comment_link( $this->api->get_blog_id_for_output(), $comment->comment_ID, 'help' ),
227	'site' => (string) $this->links->get_site_link( $this->api->get_blog_id_for_output() ),
228	'post' => (string) $this->links->get_post_link( $this->api->get_blog_id_for_output(), $comment->comment_post_ID ),
229	'replies' => (string) $this->links->get_comment_link( $this->api->get_blog_id_for_output(), $comment->comment_ID, 'replies/' ),
230	'likes' => (string) $this->links->get_comment_link( $this->api->get_blog_id_for_output(), $comment->comment_ID, 'likes/' ),
231	),
232	);
233	break;
234	case 'can_moderate':
235	$response[ $key ] = (bool) current_user_can( 'edit_comment', $comment_id );
236	break;
237	case 'i_replied':
238	$response[ $key ] = (bool) 0 < get_comments(
239	array(
240	'user_id' => get_current_user_id(),
241	'parent' => $comment->comment_ID,
242	'count' => true,
243	)
244	);
245	break;
246	}
247	}
248
249	unset( $GLOBALS['comment'], $GLOBALS['post'] );
250	return $response;
251	}
252	}
253