← All changes | modules/comments/base.php +59 -25 12.4.2 → 16.2 View file →

		@@ -10,10 +10,23 @@
10	10	/**
11	11	* All the code shared between WP.com Highlander and Jetpack Highlander
12	12	*/
13	13	class Highlander_Comments_Base {
	14	+ /**
	15	+ * ID sources.
	16	+ *
	17	+ * @var array
	18	+ */
	19	+ public $id_sources;
14	20
15	21	/**
	22	+ * The default comment scheme, if set.
	23	+ *
	24	+ * @var ?string
	25	+ */
	26	+ public $default_color_scheme;
	27	+
	28	+ /**
16	29	* Constructor
17	30	*/
18	31	public function __construct() {
19	32	$this->setup_globals();
		@@ -23,9 +36,9 @@
23	36
24	37	/**
25	38	* Set any global variables or class variables
26	39	*
27		- * @since JetpackComments (1.4)
	40	+ * @since 1.4
28	41	*/
29	42	protected function setup_globals() {}
30	43
31	44	/**
		@@ -30,9 +43,9 @@
30	43
31	44	/**
32	45	* Setup actions for methods in this class
33	46	*
34		- * @since JetpackComments (1.4)
	47	+ * @since 1.4
35	48	*/
36	49	protected function setup_actions() {
37	50	// Before a comment is posted.
38	51	add_action( 'pre_comment_on_post', array( $this, 'allow_logged_out_user_to_comment_as_external' ) );
		@@ -43,9 +56,9 @@
43	56
44	57	/**
45	58	* Setup filters for methods in this class
46	59	*
47		- * @since JetpackComments (1.4)
	60	+ * @since 1.4
48	61	*/
49	62	protected function setup_filters() {
50	63	add_filter( 'comments_array', array( $this, 'comments_array' ) );
51	64	add_filter( 'preprocess_comment', array( $this, 'allow_logged_in_user_to_comment_as_guest' ), 0 );
		@@ -52,9 +65,9 @@
52	65	}
53	66
54	67	/**
55	68	* Is this a Highlander POST request?
56		- * Optionally restrict to one or more credentials slug (facebook, twitter, ...)
	69	+ * Optionally restrict to one or more credentials slug (facebook, ...)
57	70	*
58	71	* @param mixed ...$args Comments credentials slugs.
59	72	* @return false|string false if it's not a Highlander POST request. The matching credentials slug if it is.
60	73	*/
		@@ -153,25 +166,21 @@
153	166
154	167	/**
155	168	* Comment sort comparator: comment_date_gmt
156	169	*
157		- * @since JetpackComments (1.4)
	170	+ * @since 1.4
158	171	* @param object $a The first comment to compare dates with.
159	172	* @param object $b The second comment to compare dates with.
160	173	* @return int
161	174	*/
162	175	public function sort_comments_by_comment_date_gmt( $a, $b ) {
163		- if ( $a->comment_date_gmt === $b->comment_date_gmt ) {
164		- return 0;
165		- }
166		-
167		- return $a->comment_date_gmt < $b->comment_date_gmt ? -1 : 1;
	176	+ return $a->comment_date_gmt <=> $b->comment_date_gmt;
168	177	}
169	178
170	179	/**
171	180	* Get the current commenter's information from their cookie
172	181	*
173		- * @since JetpackComments (1.4)
	182	+ * @since 1.4
174	183	* @return array Commenters information from cookie
175	184	*/
176	185	protected function get_current_commenter() {
177	186	// Defaults.
		@@ -200,15 +209,16 @@
200	209	return compact( 'comment_author', 'comment_author_email', 'comment_author_url', 'user_id' );
201	210	}
202	211
203	212	/**
204		- * Allows a logged out user to leave a comment as a facebook or twitter credentialed user.
	213	+ * Allows a logged out user to leave a comment as a facebook/wp.com credentialed user.
205	214	* Overrides WordPress' core comment_registration option to treat these commenters as "registered" (verified) users.
206	215	*
207		- * @since JetpackComments (1.4)
	216	+ * @since 1.4
208	217	*/
209	218	public function allow_logged_out_user_to_comment_as_external() {
210		- if ( ! $this->is_highlander_comment_post( 'facebook', 'twitter' ) ) {
	219	+ // phpcs:ignore WordPress.WP.CapitalPDangit.MisspelledInText
	220	+ if ( ! $this->is_highlander_comment_post( 'facebook', 'wordpress' ) ) {
211	221	return;
212	222	}
213	223
214	224	add_filter( 'pre_option_comment_registration', '__return_zero' );
		@@ -215,13 +225,13 @@
215	225	add_filter( 'pre_option_require_name_email', '__return_zero' );
216	226	}
217	227
218	228	/**
219		- * Allow a logged in user to post as a guest, FB, or twitter credentialed request.
	229	+ * Allow a logged in user to post as a guest, or FB credentialed request.
220	230	* Bypasses WordPress' core overrides that force a logged in user to comment as that user.
221	231	* Respects comment_registration option.
222	232	*
223		- * @since JetpackComments (1.4)
	233	+ * @since 1.4
224	234	* @param array $comment_data All data for a specific comment.
225	235	* @return array Modified comment data, or an error if the required fields or a valid email address are not entered.
226	236	*/
227	237	public function allow_logged_in_user_to_comment_as_guest( $comment_data ) {
		@@ -235,9 +245,9 @@
235	245	return $comment_data;
236	246	}
237	247
238	248	// Bail if this is not a guest or external service credentialed request.
239		- if ( ! $this->is_highlander_comment_post( 'guest', 'facebook', 'twitter' ) ) {
	249	+ if ( ! $this->is_highlander_comment_post( 'guest', 'facebook' ) ) {
240	250	return $comment_data;
241	251	}
242	252
243	253	$user = wp_get_current_user();
		@@ -286,9 +296,9 @@
286	296
287	297	/**
288	298	* Set the comment cookies or bail if comment is invalid
289	299	*
290		- * @since JetpackComments (1.4)
	300	+ * @since 1.4
291	301	* @param int $comment_id The comment ID.
292	302	*/
293	303	public function set_comment_cookies( $comment_id ) {
294	304	// Get comment and bail if it's invalid somehow.
		@@ -302,15 +312,39 @@
302	312	return;
303	313	}
304	314
305	315	// Set comment author cookies.
	316	+ // We don't set the cookies if they are logged in with WordPress.com because they already have a cookie set.
306	317	// phpcs:ignore WordPress.WP.CapitalPDangit
307		- if ( ( 'wordpress' !== $id_source ) && is_user_logged_in() ) {
308		- /** This filter is already documented in core/wp-includes/comment-functions.php */
309		- $comment_cookie_lifetime = apply_filters( 'comment_cookie_lifetime', 30000000 );
310		- setcookie( 'comment_author_' . COOKIEHASH, $comment->comment_author, time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN, is_ssl(), true );
311		- setcookie( 'comment_author_email_' . COOKIEHASH, $comment->comment_author_email, time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN, is_ssl(), true );
312		- setcookie( 'comment_author_url_' . COOKIEHASH, esc_url( $comment->comment_author_url ), time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN, is_ssl(), true );
	318	+ if ( 'wordpress' !== $id_source ) {
	319	+ // phpcs:disable WordPress.Security.NonceVerification -- Nonce verification should happen in Jetpack_Comments::pre_comment_on_post().
	320	+ $is_consenting_to_cookies = ( isset( $_POST['wp-comment-cookies-consent'] ) );
	321	+
	322	+ $cookie_options = array(
	323	+ 'expires' => time() + apply_filters( 'comment_cookie_lifetime', YEAR_IN_SECONDS ),
	324	+ 'path' => COOKIEPATH,
	325	+ 'domain' => COOKIE_DOMAIN,
	326	+ 'secure' => is_ssl(),
	327	+ 'httponly' => true,
	328	+ );
	329	+
	330	+ // If there is no consent, remove any cookies that may have been set.
	331	+ if ( ( 'guest' === $id_source ) && ! $is_consenting_to_cookies ) {
	332	+ $cookie_options['expires'] = time() - YEAR_IN_SECONDS;
	333	+ }
	334	+
	335	+ // Set samesite to None if the request is from Jetpack iframe.
	336	+ // This is needed because it is considered third party.
	337	+ if ( isset( $_REQUEST['for'] ) && 'jetpack' === $_REQUEST['for'] ) {
	338	+ $cookie_options['samesite'] = 'None';
	339	+ }
	340	+ // phpcs:enable WordPress.Security.NonceVerification
	341	+
	342	+ // phpcs:disable Jetpack.Functions.SetCookie.MissingTrueHTTPOnly
	343	+ isset( $comment->comment_author ) ? setcookie( 'comment_author_' . COOKIEHASH, $comment->comment_author, $cookie_options ) : null;
	344	+ isset( $comment->comment_author_email ) ? setcookie( 'comment_author_email_' . COOKIEHASH, $comment->comment_author_email, $cookie_options ) : null;
	345	+ isset( $comment->comment_author_url ) ? setcookie( 'comment_author_url_' . COOKIEHASH, esc_url( $comment->comment_author_url ), $cookie_options ) : null;
	346	+ // phpcs:enable Jetpack.Functions.SetCookie.MissingTrueHTTPOnly
313	347	}
314	348	}
315	349
316	350	/**
		@@ -315,9 +349,9 @@
315	349
316	350	/**
317	351	* Get an avatar from Photon
318	352	*
319		- * @since JetpackComments (1.4)
	353	+ * @since 1.4
320	354	* @param string $url The avatar URL.
321	355	* @param int $size The avatar size.
322	356	* @return string
323	357	*/