← All changes | modules/comments/comments.php +118 -31 13.7.2 → 16.2 View file →

		@@ -8,8 +8,12 @@
8	8	require __DIR__ . '/base.php';
9	9	use Automattic\Jetpack\Connection\Tokens;
10	10	use Automattic\Jetpack\Status\Host;
11	11
	12	+if ( ! defined( 'ABSPATH' ) ) {
	13	+ exit( 0 );
	14	+}
	15	+
12	16	/**
13	17	* Main Comments class
14	18	*
15	19	* @package automattic/jetpack
		@@ -84,9 +88,9 @@
84	88	*/
85	89	public function set_default_color_theme_based_on_theme_settings() {
86	90	if ( function_exists( 'twentyeleven_get_theme_options' ) ) {
87	91	$theme_options = twentyeleven_get_theme_options();
88		- $theme_color_scheme = isset( $theme_options['color_scheme'] ) ? $theme_options['color_scheme'] : 'transparent';
	92	+ $theme_color_scheme = $theme_options['color_scheme'] ?? 'transparent';
89	93	} else {
90	94	$theme_color_scheme = get_theme_mod( 'color_scheme', 'transparent' );
91	95	}
92	96	// Default for $theme_color_scheme is 'transparent' just so it doesn't match 'light' or 'dark'.
		@@ -120,13 +124,30 @@
120	124	);
121	125	}
122	126
123	127	/**
	128	+ * Whether the rebuilt Jetpack Comments form has taken over from this one.
	129	+ *
	130	+ * Guarded because this file and the jetpack-comments package can land in
	131	+ * either order on a staged deploy.
	132	+ *
	133	+ * @return bool
	134	+ */
	135	+ private static function new_comments_enabled() {
	136	+ return class_exists( '\Automattic\Jetpack\Comments\Comments' )
	137	+ && \Automattic\Jetpack\Comments\Comments::is_enabled();
	138	+ }
	139	+
	140	+ /**
124	141	* Setup actions for methods in this class
125	142	*
126	143	* @since 1.4
127	144	*/
128	145	protected function setup_actions() {
	146	+ if ( self::new_comments_enabled() ) {
	147	+ return;
	148	+ }
	149	+
129	150	parent::setup_actions();
130	151
131	152	// Selfishly remove everything from the existing comment form.
132	153	remove_all_actions( 'comment_form_before' );
		@@ -148,8 +169,12 @@
148	169	*
149	170	* @since 1.6.2
150	171	*/
151	172	protected function setup_filters() {
	173	+ if ( self::new_comments_enabled() ) {
	174	+ return;
	175	+ }
	176	+
152	177	parent::setup_filters();
153	178
154	179	add_filter( 'comment_post_redirect', array( $this, 'capture_comment_post_redirect_to_reload_parent_frame' ), 100 );
155	180	add_filter( 'comment_duplicate_trigger', array( $this, 'capture_comment_duplicate_trigger' ), 100 );
		@@ -161,8 +186,12 @@
161	186	/**
162	187	* In order for comments to work properly for password-protected posts we need to set `wp-postpass` cookie to SameSite none.
163	188	*/
164	189	public function manage_post_cookie() {
	190	+ if ( headers_sent() ) {
	191	+ return;
	192	+ }
	193	+
165	194	$postpass_cookie_key = 'wp-postpass_' . COOKIEHASH;
166	195
167	196	if ( empty( $_COOKIE[ $postpass_cookie_key ] ) ) {
168	197	return;
		@@ -172,9 +201,9 @@
172	201
173	202	if ( empty( $_COOKIE['verbum-wp-postpass'] ) || ( $_COOKIE['verbum-wp-postpass'] !== $postpass_cookie_value ) ) {
174	203	$expire = apply_filters( 'post_password_expires', time() + 10 * DAY_IN_SECONDS );
175	204
176		- jetpack_shim_setcookie(
	205	+ setcookie(
177	206	$postpass_cookie_key,
178	207	$postpass_cookie_value,
179	208	array(
180	209	'expires' => $expire,
		@@ -181,12 +210,13 @@
181	210	'samesite' => 'None',
182	211	'path' => '/',
183	212	'domain' => COOKIE_DOMAIN,
184	213	'secure' => is_ssl(),
	214	+ 'httponly' => false, // phpcs:ignore Jetpack.Functions.SetCookie.FoundNonHTTPOnlyFalse -- @todo Can this be set true?
185	215	)
186	216	);
187	217
188		- jetpack_shim_setcookie(
	218	+ setcookie(
189	219	'verbum-wp-postpass',
190	220	$postpass_cookie_value,
191	221	array(
192	222	'expires' => $expire,
		@@ -193,8 +223,9 @@
193	223	'samesite' => 'None',
194	224	'path' => '/',
195	225	'domain' => COOKIE_DOMAIN,
196	226	'secure' => is_ssl(),
	227	+ 'httponly' => false, // phpcs:ignore Jetpack.Functions.SetCookie.FoundNonHTTPOnlyFalse -- @todo Can this be set true?
197	228	)
198	229	);
199	230	}
200	231	}
		@@ -225,10 +256,18 @@
225	256	! preg_match( '/\.?(graph\.facebook\.com|twimg\.com)$/', $foreign_avatar_hostname ) ) {
226	257	return $avatar;
227	258	}
228	259
229		- // Return the Facebook or Twitter avatar.
230		- return preg_replace( '#src=([\'"])[^\'"]+\\1#', 'src=\\1' . esc_url( set_url_scheme( $this->photon_avatar( $foreign_avatar, $size ), 'https' ) ) . '\\1', $avatar );
	260	+ // Insert the escaped URL through a callback: a preg_replace() replacement string would expand a
	261	+ // `$1` inside it into the captured quote, breaking out of the src attribute (stored-XSS vector).
	262	+ $photon_url = esc_url( set_url_scheme( $this->photon_avatar( $foreign_avatar, $size ), 'https' ) );
	263	+ return preg_replace_callback(
	264	+ '#src=([\'"])[^\'"]+\\1#',
	265	+ static function ( $matches ) use ( $photon_url ) {
	266	+ return 'src=' . $matches[1] . $photon_url . $matches[1];
	267	+ },
	268	+ $avatar
	269	+ );
231	270	}
232	271
233	272	/**
234	273	* Set comment reply link.
		@@ -393,8 +432,9 @@
393	432	),
394	433	'color_scheme' => get_option( 'jetpack_comment_form_color_scheme', $this->default_color_scheme ),
395	434	'lang' => get_locale(),
396	435	'jetpack_version' => JETPACK__VERSION,
	436	+ 'iframe_unique_id' => wp_unique_id(),
397	437	);
398	438
399	439	// Extra parameters for logged in user.
400	440	if ( is_user_logged_in() ) {
		@@ -593,14 +633,32 @@
593	633	// In WP 6.4+, the script is loaded asynchronously, so we need to wait for it to load before we monkey-patch the functions it introduces.
594	634	document.querySelector('#comment-reply-js')?.addEventListener( 'load', watchReply );
595	635
596	636	<?php endif; ?>
	637	+
	638	+ const commentIframes = document.getElementsByClassName('jetpack_remote_comment');
597	639
598		- window.addEventListener( 'message', function ( event ) {
599		- if ( event.origin !== 'https://jetpack.wordpress.com' ) {
	640	+ window.addEventListener('message', function(event) {
	641	+ if (event.origin !== 'https://jetpack.wordpress.com') {
600	642	return;
601	643	}
602		- iframe.style.height = event.data + 'px';
	644	+
	645	+ if (!event?.data?.iframeUniqueId && !event?.data?.height) {
	646	+ return;
	647	+ }
	648	+
	649	+ const eventDataUniqueId = event.data.iframeUniqueId;
	650	+
	651	+ // Change height for the matching comment iframe
	652	+ for (let i = 0; i < commentIframes.length; i++) {
	653	+ const iframe = commentIframes[i];
	654	+ const url = new URL(iframe.src);
	655	+ const iframeUniqueIdParam = url.searchParams.get('iframe_unique_id');
	656	+ if (iframeUniqueIdParam == event.data.iframeUniqueId) {
	657	+ iframe.style.height = event.data.height + 'px';
	658	+ return;
	659	+ }
	660	+ }
603	661	});
604	662	})();
605	663	</script>
606	664	<?php
		@@ -617,9 +675,9 @@
617	675	public function pre_comment_on_post() {
618	676	$post_array = stripslashes_deep( $_POST );
619	677
620	678	// Bail if missing the Jetpack token.
621		- if ( ! isset( $post_array['sig'] ) || ! isset( $post_array['token_key'] ) ) {
	679	+ if ( ! isset( $post_array['sig'] ) || ! isset( $post_array['token_key'] ) || ! is_string( $post_array['sig'] ) || ! is_string( $post_array['token_key'] ) ) {
622	680	unset( $_POST['hc_post_as'] );
623	681	return;
624	682	}
625	683
		@@ -629,9 +687,9 @@
629	687	}
630	688	wp_die( esc_html__( 'Nonce verification failed.', 'jetpack' ), 400 );
631	689	}
632	690
633		- if ( str_contains( $post_array['hc_avatar'], '.gravatar.com' ) ) {
	691	+ if ( isset( $post_array['hc_avatar'] ) && is_string( $post_array['hc_avatar'] ) && str_contains( $post_array['hc_avatar'], '.gravatar.com' ) ) {
634	692	$post_array['hc_avatar'] = htmlentities( $post_array['hc_avatar'], ENT_COMPAT );
635	693	}
636	694
637	695	$blog_token = ( new Tokens() )->get_access_token( false, $post_array['token_key'] );
		@@ -673,9 +731,8 @@
673	731	?>
674	732	<!DOCTYPE html>
675	733	<html>
676	734	<head>
677		- <link rel="preload" as="image" href="https://jetpack.wordpress.com/wp-admin/images/spinner.gif"> <!-- Preload the spinner image -->
678	735	<meta charset="utf-8">
679	736	<title><?php echo esc_html__( 'Submitting Comment', 'jetpack' ); ?></title>
680	737	<style type="text/css">
681	738	body {
		@@ -687,12 +744,22 @@
687	744	left: 0;
688	745	overflow: hidden;
689	746	color: #333;
690	747	}
	748	+ .jetpack-comment-spinner {
	749	+ display: table-cell;
	750	+ vertical-align: middle;
	751	+ text-align: center;
	752	+ }
691	753	</style>
692	754	</head>
693	755	<body>
694		- <img src="https://jetpack.wordpress.com/wp-admin/images/spinner.gif" >
	756	+ <div class="jetpack-comment-spinner">
	757	+ <?php
	758	+ require_once JETPACK__PLUGIN_DIR . '_inc/lib/class-jetpack-spinner.php';
	759	+ echo Jetpack_Spinner::render( 28 ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- static SVG markup.
	760	+ ?>
	761	+ </div>
695	762	<form id="jetpack-remote-comment-post-form" action="<?php echo esc_url( get_site_url() ); ?>/wp-comments-post.php?for=jetpack&only_once=true" method="POST">
696	763	<?php foreach ( $comment_data as $key => $val ) : ?>
697	764	<input type="hidden" name="<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $val ); ?>" />
698	765	<?php endforeach; ?>
		@@ -703,9 +770,9 @@
703	770	</script>
704	771	</body>
705	772	</html>
706	773	<?php
707		- exit;
	774	+ exit( 0 );
708	775	}
709	776
710	777	/** Capabilities **********************************************************/
711	778
		@@ -717,16 +784,36 @@
717	784	*
718	785	* @param int $comment_id The comment ID.
719	786	*/
720	787	public function add_comment_meta( $comment_id ) {
	788	+ // phpcs:disable WordPress.Security.NonceVerification.Missing -- The hc_* fields are authenticated by the HMAC check below.
	789	+ $post_array = stripslashes_deep( $_POST );
	790	+
	791	+ // The hc_* identity fields are only trustworthy on a signed request. pre_comment_on_post() checks
	792	+ // that, but only on wp-comments-post.php, so re-check here for any other producer that reaches
	793	+ // comment_post (e.g. Carousel's unauthenticated post_attachment_comment endpoint).
	794	+ if ( ! isset( $post_array['sig'] ) || ! isset( $post_array['token_key'] ) || ! is_string( $post_array['sig'] ) || ! is_string( $post_array['token_key'] ) ) {
	795	+ return;
	796	+ }
	797	+ if ( isset( $post_array['hc_avatar'] ) && is_string( $post_array['hc_avatar'] ) && str_contains( $post_array['hc_avatar'], '.gravatar.com' ) ) {
	798	+ $post_array['hc_avatar'] = htmlentities( $post_array['hc_avatar'], ENT_COMPAT );
	799	+ }
	800	+ $blog_token = ( new Tokens() )->get_access_token( false, $post_array['token_key'] );
	801	+ if ( ! $blog_token || is_wp_error( $blog_token ) ) {
	802	+ return;
	803	+ }
	804	+ $check = self::sign_remote_comment_parameters( $post_array, $blog_token->secret );
	805	+ if ( is_wp_error( $check ) || ! hash_equals( $check, $post_array['sig'] ) ) {
	806	+ return;
	807	+ }
	808	+
721	809	$comment_meta = array();
722	810
723		- // phpcs:disable WordPress.Security.NonceVerification.Missing
724	811	switch ( $this->is_highlander_comment_post() ) {
725	812	case 'facebook':
726	813	$comment_meta['hc_post_as'] = 'facebook';
727		- $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? filter_var( wp_unslash( $_POST['hc_avatar'] ) ) : null;
728		- $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? filter_var( wp_unslash( $_POST['hc_userid'] ) ) : null;
	814	+ $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? esc_url_raw( wp_unslash( $_POST['hc_avatar'] ) ) : null;
	815	+ $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? sanitize_text_field( wp_unslash( $_POST['hc_userid'] ) ) : null;
729	816	break;
730	817
731	818	// phpcs:ignore WordPress.WP.CapitalPDangit
732	819	case 'wordpress':
		@@ -731,17 +818,17 @@
731	818	// phpcs:ignore WordPress.WP.CapitalPDangit
732	819	case 'wordpress':
733	820	// phpcs:ignore WordPress.WP.CapitalPDangit
734	821	$comment_meta['hc_post_as'] = 'wordpress';
735		- $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? filter_var( wp_unslash( $_POST['hc_avatar'] ) ) : null;
736		- $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? filter_var( wp_unslash( $_POST['hc_userid'] ) ) : null;
737		- $comment_meta['hc_wpcom_id_sig'] = isset( $_POST['hc_wpcom_id_sig'] ) ? filter_var( wp_unslash( $_POST['hc_wpcom_id_sig'] ) ) : null; // since 1.9.
	822	+ $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? esc_url_raw( wp_unslash( $_POST['hc_avatar'] ) ) : null;
	823	+ $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? sanitize_text_field( wp_unslash( $_POST['hc_userid'] ) ) : null;
	824	+ $comment_meta['hc_wpcom_id_sig'] = isset( $_POST['hc_wpcom_id_sig'] ) ? sanitize_text_field( wp_unslash( $_POST['hc_wpcom_id_sig'] ) ) : null; // since 1.9.
738	825	break;
739	826
740	827	case 'jetpack':
741	828	$comment_meta['hc_post_as'] = 'jetpack';
742		- $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? filter_var( wp_unslash( $_POST['hc_avatar'] ) ) : null;
743		- $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? filter_var( wp_unslash( $_POST['hc_userid'] ) ) : null;
	829	+ $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? esc_url_raw( wp_unslash( $_POST['hc_avatar'] ) ) : null;
	830	+ $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? sanitize_text_field( wp_unslash( $_POST['hc_userid'] ) ) : null;
744	831	break;
745	832
746	833	}
747	834	// phpcs:enable WordPress.Security.NonceVerification.Missing
		@@ -769,9 +856,9 @@
769	856	return false;
770	857	}
771	858
772	859	// phpcs:disable WordPress.Security.NonceVerification.Missing
773		- $is_current_user_subscribed = (bool) isset( $_POST['is_current_user_subscribed'] ) ? filter_var( wp_unslash( $_POST['is_current_user_subscribed'] ) ) : null;
	860	+ $is_current_user_subscribed = isset( $_POST['is_current_user_subscribed'] ) ? filter_var( wp_unslash( $_POST['is_current_user_subscribed'] ) ) : null;
774	861
775	862	// Atomic sites with jetpack_verbum_subscription_modal option enabled
776	863	$modal_enabled = ( new Host() )->is_woa_site() && get_option( 'jetpack_verbum_subscription_modal', true );
777	864
		@@ -810,9 +897,9 @@
810	897	$tracking_event = 'hidden_self_hosted';
811	898	}
812	899
813	900	// phpcs:disable WordPress.Security.NonceVerification.Missing
814		- $is_current_user_subscribed = (bool) isset( $_POST['is_current_user_subscribed'] ) ? filter_var( wp_unslash( $_POST['is_current_user_subscribed'] ) ) : null;
	901	+ $is_current_user_subscribed = isset( $_POST['is_current_user_subscribed'] ) ? filter_var( wp_unslash( $_POST['is_current_user_subscribed'] ) ) : null;
815	902
816	903	if ( $is_current_user_subscribed ) {
817	904	$tracking_event = 'hidden_already_subscribed';
818	905	}
		@@ -829,9 +916,9 @@
829	916	* @return never
830	917	*/
831	918	public function capture_comment_duplicate_trigger() {
832	919	if ( ! isset( $_GET['for'] ) || 'jetpack' !== $_GET['for'] ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
833		- exit;
	920	+ exit( 0 );
834	921	}
835	922
836	923	?>
837	924	<!DOCTYPE html>
		@@ -908,9 +995,9 @@
908	995
909	996	</body>
910	997	</html>
911	998	<?php
912		- exit;
	999	+ exit( 0 );
913	1000	}
914	1001
915	1002	/**
916	1003	* POST the submitted comment to the iframe
		@@ -1009,13 +1096,13 @@
1009	1096	?>
1010	1097	</h3>
1011	1098	<script type="text/javascript">
1012	1099	try {
1013		- window.parent.location = <?php echo wp_json_encode( $url ); ?>;
1014		- window.parent.location.reload(true);
	1100	+ window.parent.location.href = <?php echo wp_json_encode( $url, JSON_UNESCAPED_SLASHES | JSON_HEX_TAG | JSON_HEX_AMP ); ?>;
	1101	+ window.parent.location.reload( true );
1015	1102	} catch (e) {
1016		- window.location = <?php echo wp_json_encode( $url ); ?>;
1017		- window.location.reload(true);
	1103	+ window.location.href = <?php echo wp_json_encode( $url, JSON_UNESCAPED_SLASHES | JSON_HEX_TAG | JSON_HEX_AMP ); ?>;
	1104	+ window.location.reload( true );
1018	1105	}
1019	1106	ellipsis = document.getElementById('ellipsis');
1020	1107
1021	1108	function toggleEllipsis() {
		@@ -1037,9 +1124,9 @@
1037	1124
1038	1125	window.parent.postMessage(
1039	1126	{
1040	1127	type: 'subscriptionModalShow',
1041		- data: <?php echo wp_json_encode( $this->get_subscription_modal_data_to_parent( $url ) ); ?>,
	1128	+ data: <?php echo wp_json_encode( $this->get_subscription_modal_data_to_parent( $url ), JSON_UNESCAPED_SLASHES | JSON_HEX_TAG | JSON_HEX_AMP ); ?>,
1042	1129	},
1043	1130	window.location.origin
1044	1131	);
1045	1132	}
		@@ -1047,9 +1134,9 @@
1047	1134	<?php } ?>
1048	1135	</body>
1049	1136	</html>
1050	1137	<?php
1051		- exit;
	1138	+ exit( 0 );
1052	1139	}
1053	1140	}
1054	1141
1055	1142	Jetpack_Comments::init();