← All changes | modules/comments/comments.php +488 -63 12.8.3 → 16.2 View file →

		@@ -6,9 +6,14 @@
6	6	*/
7	7
8	8	require __DIR__ . '/base.php';
9	9	use Automattic\Jetpack\Connection\Tokens;
	10	+use Automattic\Jetpack\Status\Host;
10	11
	12	+if ( ! defined( 'ABSPATH' ) ) {
	13	+ exit( 0 );
	14	+}
	15	+
11	16	/**
12	17	* Main Comments class
13	18	*
14	19	* @package automattic/jetpack
		@@ -83,9 +88,9 @@
83	88	*/
84	89	public function set_default_color_theme_based_on_theme_settings() {
85	90	if ( function_exists( 'twentyeleven_get_theme_options' ) ) {
86	91	$theme_options = twentyeleven_get_theme_options();
87		- $theme_color_scheme = isset( $theme_options['color_scheme'] ) ? $theme_options['color_scheme'] : 'transparent';
	92	+ $theme_color_scheme = $theme_options['color_scheme'] ?? 'transparent';
88	93	} else {
89	94	$theme_color_scheme = get_theme_mod( 'color_scheme', 'transparent' );
90	95	}
91	96	// Default for $theme_color_scheme is 'transparent' just so it doesn't match 'light' or 'dark'.
		@@ -119,13 +124,30 @@
119	124	);
120	125	}
121	126
122	127	/**
	128	+ * Whether the rebuilt Jetpack Comments form has taken over from this one.
	129	+ *
	130	+ * Guarded because this file and the jetpack-comments package can land in
	131	+ * either order on a staged deploy.
	132	+ *
	133	+ * @return bool
	134	+ */
	135	+ private static function new_comments_enabled() {
	136	+ return class_exists( '\Automattic\Jetpack\Comments\Comments' )
	137	+ && \Automattic\Jetpack\Comments\Comments::is_enabled();
	138	+ }
	139	+
	140	+ /**
123	141	* Setup actions for methods in this class
124	142	*
125	143	* @since 1.4
126	144	*/
127	145	protected function setup_actions() {
	146	+ if ( self::new_comments_enabled() ) {
	147	+ return;
	148	+ }
	149	+
128	150	parent::setup_actions();
129	151
130	152	// Selfishly remove everything from the existing comment form.
131	153	remove_all_actions( 'comment_form_before' );
		@@ -130,8 +152,9 @@
130	152	// Selfishly remove everything from the existing comment form.
131	153	remove_all_actions( 'comment_form_before' );
132	154
133	155	// Selfishly add only our actions back to the comment form.
	156	+ add_action( 'comment_form_before', array( $this, 'manage_post_cookie' ) );
134	157	add_action( 'comment_form_before', array( $this, 'comment_form_before' ) );
135	158	add_action( 'comment_form_after', array( $this, 'comment_form_after' ), 1 ); // Set very early since we remove everything outputed before our action.
136	159
137	160	// Before a comment is posted.
		@@ -146,15 +169,69 @@
146	169	*
147	170	* @since 1.6.2
148	171	*/
149	172	protected function setup_filters() {
	173	+ if ( self::new_comments_enabled() ) {
	174	+ return;
	175	+ }
	176	+
150	177	parent::setup_filters();
151	178
152	179	add_filter( 'comment_post_redirect', array( $this, 'capture_comment_post_redirect_to_reload_parent_frame' ), 100 );
	180	+ add_filter( 'comment_duplicate_trigger', array( $this, 'capture_comment_duplicate_trigger' ), 100 );
153	181	add_filter( 'get_avatar', array( $this, 'get_avatar' ), 10, 4 );
	182	+ // Fix comment reply link when `comment_registration` is required.
	183	+ add_filter( 'comment_reply_link', array( $this, 'comment_reply_link' ), 10, 4 );
154	184	}
155	185
156	186	/**
	187	+ * In order for comments to work properly for password-protected posts we need to set `wp-postpass` cookie to SameSite none.
	188	+ */
	189	+ public function manage_post_cookie() {
	190	+ if ( headers_sent() ) {
	191	+ return;
	192	+ }
	193	+
	194	+ $postpass_cookie_key = 'wp-postpass_' . COOKIEHASH;
	195	+
	196	+ if ( empty( $_COOKIE[ $postpass_cookie_key ] ) ) {
	197	+ return;
	198	+ }
	199	+
	200	+ $postpass_cookie_value = sanitize_text_field( wp_unslash( $_COOKIE[ $postpass_cookie_key ] ) );
	201	+
	202	+ if ( empty( $_COOKIE['verbum-wp-postpass'] ) || ( $_COOKIE['verbum-wp-postpass'] !== $postpass_cookie_value ) ) {
	203	+ $expire = apply_filters( 'post_password_expires', time() + 10 * DAY_IN_SECONDS );
	204	+
	205	+ setcookie(
	206	+ $postpass_cookie_key,
	207	+ $postpass_cookie_value,
	208	+ array(
	209	+ 'expires' => $expire,
	210	+ 'samesite' => 'None',
	211	+ 'path' => '/',
	212	+ 'domain' => COOKIE_DOMAIN,
	213	+ 'secure' => is_ssl(),
	214	+ 'httponly' => false, // phpcs:ignore Jetpack.Functions.SetCookie.FoundNonHTTPOnlyFalse -- @todo Can this be set true?
	215	+ )
	216	+ );
	217	+
	218	+ setcookie(
	219	+ 'verbum-wp-postpass',
	220	+ $postpass_cookie_value,
	221	+ array(
	222	+ 'expires' => $expire,
	223	+ 'samesite' => 'None',
	224	+ 'path' => '/',
	225	+ 'domain' => COOKIE_DOMAIN,
	226	+ 'secure' => is_ssl(),
	227	+ 'httponly' => false, // phpcs:ignore Jetpack.Functions.SetCookie.FoundNonHTTPOnlyFalse -- @todo Can this be set true?
	228	+ )
	229	+ );
	230	+ }
	231	+ }
	232	+
	233	+ /**
157	234	* Get the comment avatar from Gravatar or Twitter/Facebook.
158	235	*
159	236	* Leaving the Twitter reference for legacy comments even though support is no longer offered.
160	237	*
		@@ -179,13 +256,72 @@
179	256	! preg_match( '/\.?(graph\.facebook\.com|twimg\.com)$/', $foreign_avatar_hostname ) ) {
180	257	return $avatar;
181	258	}
182	259
183		- // Return the Facebook or Twitter avatar.
184		- return preg_replace( '#src=([\'"])[^\'"]+\\1#', 'src=\\1' . esc_url( set_url_scheme( $this->photon_avatar( $foreign_avatar, $size ), 'https' ) ) . '\\1', $avatar );
	260	+ // Insert the escaped URL through a callback: a preg_replace() replacement string would expand a
	261	+ // `$1` inside it into the captured quote, breaking out of the src attribute (stored-XSS vector).
	262	+ $photon_url = esc_url( set_url_scheme( $this->photon_avatar( $foreign_avatar, $size ), 'https' ) );
	263	+ return preg_replace_callback(
	264	+ '#src=([\'"])[^\'"]+\\1#',
	265	+ static function ( $matches ) use ( $photon_url ) {
	266	+ return 'src=' . $matches[1] . $photon_url . $matches[1];
	267	+ },
	268	+ $avatar
	269	+ );
185	270	}
186	271
187	272	/**
	273	+ * Set comment reply link.
	274	+ * This is to fix the reply link when comment registration is required.
	275	+ *
	276	+ * @param string $reply_link The HTML markup for the comment reply link.
	277	+ * @param array $args An array of arguments overriding the defaults.
	278	+ * @param WP_Comment $comment The object of the comment being replied.
	279	+ * @param WP_Post $post The WP_Post object.
	280	+ *
	281	+ * @return string New reply link.
	282	+ */
	283	+ public function comment_reply_link( $reply_link, $args, $comment, $post ) {
	284	+ // This is only necessary if comment_registration is required to post comments
	285	+ if ( ! get_option( 'comment_registration' ) ) {
	286	+ return $reply_link;
	287	+ }
	288	+
	289	+ $respond_id = esc_attr( $args['respond_id'] );
	290	+ $add_below = esc_attr( $args['add_below'] );
	291	+ /* This is to accommodate some themes that add an SVG to the Reply link like twenty-seventeen. */
	292	+ $reply_text = wp_kses(
	293	+ $args['reply_text'],
	294	+ array(
	295	+ 'svg' => array(
	296	+ 'class' => true,
	297	+ 'aria-hidden' => true,
	298	+ 'aria-labelledby' => true,
	299	+ 'role' => true,
	300	+ 'xmlns' => true,
	301	+ 'width' => true,
	302	+ 'height' => true,
	303	+ 'viewbox' => true,
	304	+ ),
	305	+ 'use' => array(
	306	+ 'href' => true,
	307	+ 'xlink:href' => true,
	308	+ ),
	309	+ )
	310	+ );
	311	+ $before_link = wp_kses( $args['before'], wp_kses_allowed_html( 'post' ) );
	312	+ $after_link = wp_kses( $args['after'], wp_kses_allowed_html( 'post' ) );
	313	+
	314	+ $reply_url = esc_url( add_query_arg( 'replytocom', $comment->comment_ID . '#' . $respond_id ) );
	315	+
	316	+ return <<<HTML
	317	+ $before_link
	318	+ <a class="comment-reply-link" href="$reply_url" onclick="return addComment.moveForm( '$add_below-$comment->comment_ID', '$comment->comment_ID', '$respond_id', '$post->ID' )">$reply_text</a>
	319	+ $after_link
	320	+HTML;
	321	+ }
	322	+
	323	+ /**
188	324	* Get the site's blog token.
189	325	* This can be used to bypass Comments entirely if Jetpack is not properly connected.
190	326	*
191	327	* @since 11.2
		@@ -296,8 +432,9 @@
296	432	),
297	433	'color_scheme' => get_option( 'jetpack_comment_form_color_scheme', $this->default_color_scheme ),
298	434	'lang' => get_locale(),
299	435	'jetpack_version' => JETPACK__VERSION,
	436	+ 'iframe_unique_id' => wp_unique_id(),
300	437	);
301	438
302	439	// Extra parameters for logged in user.
303	440	if ( is_user_logged_in() ) {
		@@ -313,8 +450,10 @@
313	450	} else {
314	451	$commenter = wp_get_current_commenter();
315	452	$params['show_cookie_consent'] = (int) has_action( 'set_comment_cookies', 'wp_set_comment_cookies' );
316	453	$params['has_cookie_consent'] = (int) ! empty( $commenter['comment_author_email'] );
	454	+ // Jetpack_Memberships for logged out users only checks for the wp-jp-premium-content-session cookie
	455	+ $params['is_current_user_subscribed'] = class_exists( '\Jetpack_Memberships' ) ? (int) Jetpack_Memberships::is_current_user_subscribed() : 0;
317	456	}
318	457
319	458	list( $token_key ) = explode( '.', $blog_token->secret, 2 );
320	459	// Prophylactic check: anything else should never happen.
		@@ -456,52 +595,72 @@
456	595	return;
457	596	}
458	597	?>
459	598	<script type="text/javascript">
460		- const iframe = document.getElementById( 'jetpack_remote_comment' );
461		- <?php if ( get_option( 'thread_comments' ) && get_option( 'thread_comments_depth' ) ) : ?>
462		- const watchReply = function() {
463		- // Check addComment._Jetpack_moveForm to make sure we don't monkey-patch twice.
464		- if ( 'undefined' !== typeof addComment && ! addComment._Jetpack_moveForm ) {
465		- // Cache the Core function.
466		- addComment._Jetpack_moveForm = addComment.moveForm;
467		- const commentParent = document.getElementById( 'comment_parent' );
468		- const cancel = document.getElementById( 'cancel-comment-reply-link' );
	599	+ (function () {
	600	+ const iframe = document.getElementById( 'jetpack_remote_comment' );
	601	+ <?php if ( get_option( 'thread_comments' ) && get_option( 'thread_comments_depth' ) ) : ?>
	602	+ const watchReply = function() {
	603	+ // Check addComment._Jetpack_moveForm to make sure we don't monkey-patch twice.
	604	+ if ( 'undefined' !== typeof addComment && ! addComment._Jetpack_moveForm ) {
	605	+ // Cache the Core function.
	606	+ addComment._Jetpack_moveForm = addComment.moveForm;
	607	+ const commentParent = document.getElementById( 'comment_parent' );
	608	+ const cancel = document.getElementById( 'cancel-comment-reply-link' );
469	609
470		- function tellFrameNewParent ( commentParentValue ) {
471		- const url = new URL( iframe.src );
472		- if ( commentParentValue ) {
473		- url.searchParams.set( 'replytocom', commentParentValue )
474		- } else {
475		- url.searchParams.delete( 'replytocom' );
476		- }
477		- if( iframe.src !== url.href ) {
478		- iframe.src = url.href;
479		- }
480		- };
	610	+ function tellFrameNewParent ( commentParentValue ) {
	611	+ const url = new URL( iframe.src );
	612	+ if ( commentParentValue ) {
	613	+ url.searchParams.set( 'replytocom', commentParentValue )
	614	+ } else {
	615	+ url.searchParams.delete( 'replytocom' );
	616	+ }
	617	+ if( iframe.src !== url.href ) {
	618	+ iframe.src = url.href;
	619	+ }
	620	+ };
481	621
482		- cancel.addEventListener( 'click', function () {
483		- tellFrameNewParent( false );
484		- } );
	622	+ cancel.addEventListener( 'click', function () {
	623	+ tellFrameNewParent( false );
	624	+ } );
485	625
486		- addComment.moveForm = function ( _, parentId ) {
487		- tellFrameNewParent( parentId );
488		- return addComment._Jetpack_moveForm.apply( null, arguments );
489		- };
	626	+ addComment.moveForm = function ( _, parentId ) {
	627	+ tellFrameNewParent( parentId );
	628	+ return addComment._Jetpack_moveForm.apply( null, arguments );
	629	+ };
	630	+ }
490	631	}
491		- }
492		- document.addEventListener( 'DOMContentLoaded', watchReply );
493		- // In WP 6.4+, the script is loaded asynchronously, so we need to wait for it to load before we monkey-patch the functions it introduces.
494		- document.querySelector('#comment-reply-js')?.addEventListener( 'load', watchReply );
	632	+ document.addEventListener( 'DOMContentLoaded', watchReply );
	633	+ // In WP 6.4+, the script is loaded asynchronously, so we need to wait for it to load before we monkey-patch the functions it introduces.
	634	+ document.querySelector('#comment-reply-js')?.addEventListener( 'load', watchReply );
495	635
496		- <?php endif; ?>
	636	+ <?php endif; ?>
	637	+
	638	+ const commentIframes = document.getElementsByClassName('jetpack_remote_comment');
497	639
498		- window.addEventListener( 'message', function ( event ) {
499		- if ( event.origin !== 'https://jetpack.wordpress.com' ) {
500		- return;
501		- }
502		- iframe.style.height = event.data + 'px';
503		- });
	640	+ window.addEventListener('message', function(event) {
	641	+ if (event.origin !== 'https://jetpack.wordpress.com') {
	642	+ return;
	643	+ }
	644	+
	645	+ if (!event?.data?.iframeUniqueId && !event?.data?.height) {
	646	+ return;
	647	+ }
	648	+
	649	+ const eventDataUniqueId = event.data.iframeUniqueId;
	650	+
	651	+ // Change height for the matching comment iframe
	652	+ for (let i = 0; i < commentIframes.length; i++) {
	653	+ const iframe = commentIframes[i];
	654	+ const url = new URL(iframe.src);
	655	+ const iframeUniqueIdParam = url.searchParams.get('iframe_unique_id');
	656	+ if (iframeUniqueIdParam == event.data.iframeUniqueId) {
	657	+ iframe.style.height = event.data.height + 'px';
	658	+ return;
	659	+ }
	660	+ }
	661	+ });
	662	+ })();
504	663	</script>
505	664	<?php
506	665	}
507	666
		@@ -516,19 +675,21 @@
516	675	public function pre_comment_on_post() {
517	676	$post_array = stripslashes_deep( $_POST );
518	677
519	678	// Bail if missing the Jetpack token.
520		- if ( ! isset( $post_array['sig'] ) || ! isset( $post_array['token_key'] ) ) {
	679	+ if ( ! isset( $post_array['sig'] ) || ! isset( $post_array['token_key'] ) || ! is_string( $post_array['sig'] ) || ! is_string( $post_array['token_key'] ) ) {
521	680	unset( $_POST['hc_post_as'] );
522		-
523	681	return;
524	682	}
525	683
526	684	if ( empty( $post_array['jetpack_comments_nonce'] ) || ! wp_verify_nonce( $post_array['jetpack_comments_nonce'], "jetpack_comments_nonce-{$post_array['comment_post_ID']}" ) ) {
527		- wp_die( esc_html__( 'Nonce verification failed.', 'jetpack' ), 400 );
	685	+ if ( ! isset( $_GET['only_once'] ) ) {
	686	+ self::retry_submit_comment_form_locally();
	687	+ }
	688	+ wp_die( esc_html__( 'Nonce verification failed.', 'jetpack' ), 400 );
528	689	}
529	690
530		- if ( false !== strpos( $post_array['hc_avatar'], '.gravatar.com' ) ) {
	691	+ if ( isset( $post_array['hc_avatar'] ) && is_string( $post_array['hc_avatar'] ) && str_contains( $post_array['hc_avatar'], '.gravatar.com' ) ) {
531	692	$post_array['hc_avatar'] = htmlentities( $post_array['hc_avatar'], ENT_COMPAT );
532	693	}
533	694
534	695	$blog_token = ( new Tokens() )->get_access_token( false, $post_array['token_key'] );
		@@ -553,8 +714,67 @@
553	714	wp_die( esc_html__( 'Comments are not allowed.', 'jetpack' ), 403 );
554	715	}
555	716	}
556	717
	718	+ /**
	719	+ * Handle Jetpack Comments POST requests: process the comment form, then client-side POST the results to the self-hosted blog
	720	+ *
	721	+ * This function exists because when we submit the form via the jetpack.wordpress.com iframe
	722	+ * in Chrome the request comes in to Jetpack but for some reason the request doesn't have access to cookies yet.
	723	+ * By submitting the form again locally with the same data the process works as expected.
	724	+ *
	725	+ * @return never
	726	+ */
	727	+ public function retry_submit_comment_form_locally() {
	728	+ // We are not doing any validation here since all the validation will be done again by pre_comment_on_post().
	729	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing
	730	+ $comment_data = stripslashes_deep( $_POST );
	731	+ ?>
	732	+ <!DOCTYPE html>
	733	+ <html>
	734	+ <head>
	735	+ <meta charset="utf-8">
	736	+ <title><?php echo esc_html__( 'Submitting Comment', 'jetpack' ); ?></title>
	737	+ <style type="text/css">
	738	+ body {
	739	+ display: table;
	740	+ width: 100%;
	741	+ height: 60%;
	742	+ position: absolute;
	743	+ top: 0;
	744	+ left: 0;
	745	+ overflow: hidden;
	746	+ color: #333;
	747	+ }
	748	+ .jetpack-comment-spinner {
	749	+ display: table-cell;
	750	+ vertical-align: middle;
	751	+ text-align: center;
	752	+ }
	753	+ </style>
	754	+ </head>
	755	+ <body>
	756	+ <div class="jetpack-comment-spinner">
	757	+ <?php
	758	+ require_once JETPACK__PLUGIN_DIR . '_inc/lib/class-jetpack-spinner.php';
	759	+ echo Jetpack_Spinner::render( 28 ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- static SVG markup.
	760	+ ?>
	761	+ </div>
	762	+ <form id="jetpack-remote-comment-post-form" action="<?php echo esc_url( get_site_url() ); ?>/wp-comments-post.php?for=jetpack&only_once=true" method="POST">
	763	+ <?php foreach ( $comment_data as $key => $val ) : ?>
	764	+ <input type="hidden" name="<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $val ); ?>" />
	765	+ <?php endforeach; ?>
	766	+ </form>
	767	+
	768	+ <script type="text/javascript">
	769	+ document.getElementById("jetpack-remote-comment-post-form").submit();
	770	+ </script>
	771	+ </body>
	772	+ </html>
	773	+ <?php
	774	+ exit( 0 );
	775	+ }
	776	+
557	777	/** Capabilities **********************************************************/
558	778
559	779	/**
560	780	* Add some additional comment meta after comment is saved about what
		@@ -564,16 +784,36 @@
564	784	*
565	785	* @param int $comment_id The comment ID.
566	786	*/
567	787	public function add_comment_meta( $comment_id ) {
	788	+ // phpcs:disable WordPress.Security.NonceVerification.Missing -- The hc_* fields are authenticated by the HMAC check below.
	789	+ $post_array = stripslashes_deep( $_POST );
	790	+
	791	+ // The hc_* identity fields are only trustworthy on a signed request. pre_comment_on_post() checks
	792	+ // that, but only on wp-comments-post.php, so re-check here for any other producer that reaches
	793	+ // comment_post (e.g. Carousel's unauthenticated post_attachment_comment endpoint).
	794	+ if ( ! isset( $post_array['sig'] ) || ! isset( $post_array['token_key'] ) || ! is_string( $post_array['sig'] ) || ! is_string( $post_array['token_key'] ) ) {
	795	+ return;
	796	+ }
	797	+ if ( isset( $post_array['hc_avatar'] ) && is_string( $post_array['hc_avatar'] ) && str_contains( $post_array['hc_avatar'], '.gravatar.com' ) ) {
	798	+ $post_array['hc_avatar'] = htmlentities( $post_array['hc_avatar'], ENT_COMPAT );
	799	+ }
	800	+ $blog_token = ( new Tokens() )->get_access_token( false, $post_array['token_key'] );
	801	+ if ( ! $blog_token || is_wp_error( $blog_token ) ) {
	802	+ return;
	803	+ }
	804	+ $check = self::sign_remote_comment_parameters( $post_array, $blog_token->secret );
	805	+ if ( is_wp_error( $check ) || ! hash_equals( $check, $post_array['sig'] ) ) {
	806	+ return;
	807	+ }
	808	+
568	809	$comment_meta = array();
569	810
570		- // phpcs:disable WordPress.Security.NonceVerification.Missing
571	811	switch ( $this->is_highlander_comment_post() ) {
572	812	case 'facebook':
573	813	$comment_meta['hc_post_as'] = 'facebook';
574		- $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? filter_var( wp_unslash( $_POST['hc_avatar'] ) ) : null;
575		- $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? filter_var( wp_unslash( $_POST['hc_userid'] ) ) : null;
	814	+ $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? esc_url_raw( wp_unslash( $_POST['hc_avatar'] ) ) : null;
	815	+ $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? sanitize_text_field( wp_unslash( $_POST['hc_userid'] ) ) : null;
576	816	break;
577	817
578	818	// phpcs:ignore WordPress.WP.CapitalPDangit
579	819	case 'wordpress':
		@@ -578,17 +818,17 @@
578	818	// phpcs:ignore WordPress.WP.CapitalPDangit
579	819	case 'wordpress':
580	820	// phpcs:ignore WordPress.WP.CapitalPDangit
581	821	$comment_meta['hc_post_as'] = 'wordpress';
582		- $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? filter_var( wp_unslash( $_POST['hc_avatar'] ) ) : null;
583		- $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? filter_var( wp_unslash( $_POST['hc_userid'] ) ) : null;
584		- $comment_meta['hc_wpcom_id_sig'] = isset( $_POST['hc_wpcom_id_sig'] ) ? filter_var( wp_unslash( $_POST['hc_wpcom_id_sig'] ) ) : null; // since 1.9.
	822	+ $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? esc_url_raw( wp_unslash( $_POST['hc_avatar'] ) ) : null;
	823	+ $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? sanitize_text_field( wp_unslash( $_POST['hc_userid'] ) ) : null;
	824	+ $comment_meta['hc_wpcom_id_sig'] = isset( $_POST['hc_wpcom_id_sig'] ) ? sanitize_text_field( wp_unslash( $_POST['hc_wpcom_id_sig'] ) ) : null; // since 1.9.
585	825	break;
586	826
587	827	case 'jetpack':
588	828	$comment_meta['hc_post_as'] = 'jetpack';
589		- $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? filter_var( wp_unslash( $_POST['hc_avatar'] ) ) : null;
590		- $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? filter_var( wp_unslash( $_POST['hc_userid'] ) ) : null;
	829	+ $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? esc_url_raw( wp_unslash( $_POST['hc_avatar'] ) ) : null;
	830	+ $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? sanitize_text_field( wp_unslash( $_POST['hc_userid'] ) ) : null;
591	831	break;
592	832
593	833	}
594	834	// phpcs:enable WordPress.Security.NonceVerification.Missing
		@@ -604,8 +844,163 @@
604	844	}
605	845	}
606	846
607	847	/**
	848	+ * Should show the subscription modal
	849	+ *
	850	+ * @return boolean
	851	+ */
	852	+ public function should_show_subscription_modal() {
	853	+
	854	+ // Not allow it to run on self-hosted or simple sites
	855	+ if ( ! ( new Host() )->is_wpcom_platform() || ( new Host() )->is_wpcom_simple() ) {
	856	+ return false;
	857	+ }
	858	+
	859	+ // phpcs:disable WordPress.Security.NonceVerification.Missing
	860	+ $is_current_user_subscribed = isset( $_POST['is_current_user_subscribed'] ) ? filter_var( wp_unslash( $_POST['is_current_user_subscribed'] ) ) : null;
	861	+
	862	+ // Atomic sites with jetpack_verbum_subscription_modal option enabled
	863	+ $modal_enabled = ( new Host() )->is_woa_site() && get_option( 'jetpack_verbum_subscription_modal', true );
	864	+
	865	+ return $modal_enabled && ! $is_current_user_subscribed;
	866	+ }
	867	+
	868	+ /**
	869	+ * Get the data to send as an event to the parent window on subscription modal
	870	+ *
	871	+ * @param string $url url to redirect to.
	872	+ *
	873	+ * @return array
	874	+ */
	875	+ public function get_subscription_modal_data_to_parent( $url ) {
	876	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing
	877	+ $current_user_email = isset( $_POST['email'] ) ? filter_var( wp_unslash( $_POST['email'] ) ) : null;
	878	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing
	879	+ $post_id = isset( $_POST['comment_post_ID'] ) ? filter_var( wp_unslash( $_POST['comment_post_ID'] ) ) : null;
	880	+ return array(
	881	+ 'url' => $url,
	882	+ 'email' => $current_user_email,
	883	+ 'blog_id' => esc_attr( \Jetpack_Options::get_option( 'id' ) ),
	884	+ 'post_id' => esc_attr( $post_id ),
	885	+ 'lang' => esc_attr( get_locale() ),
	886	+ 'is_logged_in' => isset( $_POST['hc_userid'] ),
	887	+ );
	888	+ }
	889	+
	890	+ /**
	891	+ * Track the hidden event for the subscription modal
	892	+ */
	893	+ public function subscription_modal_status_track_event() {
	894	+ $tracking_event = 'hidden_disabled';
	895	+ // Not allow it to run on self-hosted or simple sites
	896	+ if ( ! ( new Host() )->is_wpcom_platform() || ( new Host() )->is_wpcom_simple() ) {
	897	+ $tracking_event = 'hidden_self_hosted';
	898	+ }
	899	+
	900	+ // phpcs:disable WordPress.Security.NonceVerification.Missing
	901	+ $is_current_user_subscribed = isset( $_POST['is_current_user_subscribed'] ) ? filter_var( wp_unslash( $_POST['is_current_user_subscribed'] ) ) : null;
	902	+
	903	+ if ( $is_current_user_subscribed ) {
	904	+ $tracking_event = 'hidden_already_subscribed';
	905	+ }
	906	+
	907	+ $jetpack = Jetpack::init();
	908	+ // $jetpack->stat automatically prepends the stat group with 'jetpack-'
	909	+ $jetpack->stat( 'subscribe-modal-comm', $tracking_event );
	910	+ $jetpack->do_stats( 'server_side' );
	911	+ }
	912	+
	913	+ /**
	914	+ * Catch the duplicated comment error and show a custom error page
	915	+ *
	916	+ * @return never
	917	+ */
	918	+ public function capture_comment_duplicate_trigger() {
	919	+ if ( ! isset( $_GET['for'] ) || 'jetpack' !== $_GET['for'] ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
	920	+ exit( 0 );
	921	+ }
	922	+
	923	+ ?>
	924	+ <!DOCTYPE html>
	925	+ <html <?php language_attributes(); ?>>
	926	+ <!--<![endif]-->
	927	+ <head>
	928	+ <meta charset="<?php bloginfo( 'charset' ); ?>" />
	929	+ <title>
	930	+ <?php
	931	+ wp_kses_post(
	932	+ printf(
	933	+ /* translators: %s is replaced by an ellipsis */
	934	+ __( 'Submitting Comment%s', 'jetpack' ), // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
	935	+ '&hellip;'
	936	+ )
	937	+ );
	938	+ ?>
	939	+ </title>
	940	+ <style type="text/css">
	941	+ body {
	942	+ display: table;
	943	+ width: 100%;
	944	+ height: 60%;
	945	+ position: absolute;
	946	+ top: 0;
	947	+ left: 0;
	948	+ overflow: hidden;
	949	+ color: #333;
	950	+ padding-top: 3%;
	951	+ }
	952	+ div {
	953	+ text-align: left;
	954	+ margin: 0;
	955	+ padding: 0;
	956	+ display: table-cell;
	957	+ vertical-align: top;
	958	+ font-family: "HelveticaNeue-Light", "Helvetica Neue Light", "Helvetica Neue", sans-serif;
	959	+ font-weight: normal;
	960	+ }
	961	+
	962	+ h3 {
	963	+ margin: 0;
	964	+ padding-bottom: 3%;
	965	+ font-family: "HelveticaNeue-Light", "Helvetica Neue Light", "Helvetica Neue", sans-serif;
	966	+ font-weight: normal;
	967	+ }
	968	+ a {
	969	+ text-decoration: underline;
	970	+ color: #333 !important;
	971	+ }
	972	+ </style>
	973	+ </head>
	974	+ <body>
	975	+ <div>
	976	+ <h3>
	977	+ <?php
	978	+ esc_html_e( 'Duplicate comment detected; it looks as though you’ve already said that!', 'jetpack' );
	979	+ ?>
	980	+ </h3>
	981	+ <a href="javascript:backToComments()"><?php esc_html_e( '&laquo; Back', 'jetpack' ); ?></a>
	982	+ </div>
	983	+ <script type="text/javascript">
	984	+ function backToComments() {
	985	+ const test = regexp => {
	986	+ return regexp.test(navigator.userAgent);
	987	+ };
	988	+ if (test(/chrome|chromium|crios|safari|edg/i)) {
	989	+ history.go(-2);
	990	+ return;
	991	+ }
	992	+ history.back();
	993	+ }
	994	+ </script>
	995	+
	996	+ </body>
	997	+ </html>
	998	+ <?php
	999	+ exit( 0 );
	1000	+ }
	1001	+
	1002	+ /**
608	1003	* POST the submitted comment to the iframe
609	1004	*
610	1005	* @param string $url The comment URL origin.
611	1006	*/
		@@ -612,8 +1007,15 @@
612	1007	public function capture_comment_post_redirect_to_reload_parent_frame( $url ) {
613	1008	if ( ! isset( $_GET['for'] ) || 'jetpack' !== $_GET['for'] ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
614	1009	return $url;
615	1010	}
	1011	+
	1012	+ $should_show_subscription_modal = $this->should_show_subscription_modal();
	1013	+
	1014	+ // Track event when not showing the subscription modal
	1015	+ if ( ! $should_show_subscription_modal ) {
	1016	+ $this->subscription_modal_status_track_event();
	1017	+ }
616	1018	?>
617	1019	<!DOCTYPE html>
618	1020	<html <?php language_attributes(); ?>>
619	1021	<!--<![endif]-->
		@@ -639,16 +1041,17 @@
639	1041	top: 0;
640	1042	left: 0;
641	1043	overflow: hidden;
642	1044	color: #333;
	1045	+ padding-top: 3%;
643	1046	}
644	1047
645		- h1 {
	1048	+ h3 {
646	1049	text-align: center;
647	1050	margin: 0;
648	1051	padding: 0;
649	1052	display: table-cell;
650		- vertical-align: middle;
	1053	+ vertical-align: top;
651	1054	font-family: "HelveticaNeue-Light", "Helvetica Neue Light", "Helvetica Neue", sans-serif;
652	1055	font-weight: normal;
653	1056	}
654	1057
		@@ -655,9 +1058,9 @@
655	1058	.hidden {
656	1059	opacity: 0;
657	1060	}
658	1061
659		- h1 span {
	1062	+ h3 span {
660	1063	-moz-transition-property: opacity;
661	1064	-moz-transition-duration: 1s;
662	1065	-moz-transition-timing-function: ease-in-out;
663	1066
		@@ -679,9 +1082,10 @@
679	1082	}
680	1083	</style>
681	1084	</head>
682	1085	<body>
683		- <h1>
	1086	+ <?php if ( ! $should_show_subscription_modal ) { ?>
	1087	+ <h3>
684	1088	<?php
685	1089	wp_kses_post(
686	1090	printf(
687	1091	/* translators: %s is replaced by HTML markup to include an ellipsis */
		@@ -689,16 +1093,16 @@
689	1093	'<span id="ellipsis" class="hidden">&hellip;</span>'
690	1094	)
691	1095	);
692	1096	?>
693		- </h1>
	1097	+ </h3>
694	1098	<script type="text/javascript">
695	1099	try {
696		- window.parent.location = <?php echo wp_json_encode( $url ); ?>;
697		- window.parent.location.reload(true);
	1100	+ window.parent.location.href = <?php echo wp_json_encode( $url, JSON_UNESCAPED_SLASHES | JSON_HEX_TAG | JSON_HEX_AMP ); ?>;
	1101	+ window.parent.location.reload( true );
698	1102	} catch (e) {
699		- window.location = <?php echo wp_json_encode( $url ); ?>;
700		- window.location.reload(true);
	1103	+ window.location.href = <?php echo wp_json_encode( $url, JSON_UNESCAPED_SLASHES | JSON_HEX_TAG | JSON_HEX_AMP ); ?>;
	1104	+ window.location.reload( true );
701	1105	}
702	1106	ellipsis = document.getElementById('ellipsis');
703	1107
704	1108	function toggleEllipsis() {
		@@ -706,12 +1110,33 @@
706	1110	}
707	1111
708	1112	setInterval(toggleEllipsis, 1200);
709	1113	</script>
	1114	+ <?php } else { ?>
	1115	+ <h3>
	1116	+ <?php
	1117	+ wp_kses_post(
	1118	+ print __( 'Comment sent', 'jetpack' ) // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
	1119	+ );
	1120	+ ?>
	1121	+ </h3>
	1122	+ <script type="text/javascript">
	1123	+ if ( window.parent && window.parent !== window ) {
	1124	+
	1125	+ window.parent.postMessage(
	1126	+ {
	1127	+ type: 'subscriptionModalShow',
	1128	+ data: <?php echo wp_json_encode( $this->get_subscription_modal_data_to_parent( $url ), JSON_UNESCAPED_SLASHES | JSON_HEX_TAG | JSON_HEX_AMP ); ?>,
	1129	+ },
	1130	+ window.location.origin
	1131	+ );
	1132	+ }
	1133	+ </script>
	1134	+ <?php } ?>
710	1135	</body>
711	1136	</html>
712	1137	<?php
713		- exit;
	1138	+ exit( 0 );
714	1139	}
715	1140	}
716	1141
717	1142	Jetpack_Comments::init();