← All changes | modules/comments/comments.php +94 -26 14.2.2 → 16.2 View file →

		@@ -8,8 +8,12 @@
8	8	require __DIR__ . '/base.php';
9	9	use Automattic\Jetpack\Connection\Tokens;
10	10	use Automattic\Jetpack\Status\Host;
11	11
	12	+if ( ! defined( 'ABSPATH' ) ) {
	13	+ exit( 0 );
	14	+}
	15	+
12	16	/**
13	17	* Main Comments class
14	18	*
15	19	* @package automattic/jetpack
		@@ -84,9 +88,9 @@
84	88	*/
85	89	public function set_default_color_theme_based_on_theme_settings() {
86	90	if ( function_exists( 'twentyeleven_get_theme_options' ) ) {
87	91	$theme_options = twentyeleven_get_theme_options();
88		- $theme_color_scheme = isset( $theme_options['color_scheme'] ) ? $theme_options['color_scheme'] : 'transparent';
	92	+ $theme_color_scheme = $theme_options['color_scheme'] ?? 'transparent';
89	93	} else {
90	94	$theme_color_scheme = get_theme_mod( 'color_scheme', 'transparent' );
91	95	}
92	96	// Default for $theme_color_scheme is 'transparent' just so it doesn't match 'light' or 'dark'.
		@@ -120,13 +124,30 @@
120	124	);
121	125	}
122	126
123	127	/**
	128	+ * Whether the rebuilt Jetpack Comments form has taken over from this one.
	129	+ *
	130	+ * Guarded because this file and the jetpack-comments package can land in
	131	+ * either order on a staged deploy.
	132	+ *
	133	+ * @return bool
	134	+ */
	135	+ private static function new_comments_enabled() {
	136	+ return class_exists( '\Automattic\Jetpack\Comments\Comments' )
	137	+ && \Automattic\Jetpack\Comments\Comments::is_enabled();
	138	+ }
	139	+
	140	+ /**
124	141	* Setup actions for methods in this class
125	142	*
126	143	* @since 1.4
127	144	*/
128	145	protected function setup_actions() {
	146	+ if ( self::new_comments_enabled() ) {
	147	+ return;
	148	+ }
	149	+
129	150	parent::setup_actions();
130	151
131	152	// Selfishly remove everything from the existing comment form.
132	153	remove_all_actions( 'comment_form_before' );
		@@ -148,8 +169,12 @@
148	169	*
149	170	* @since 1.6.2
150	171	*/
151	172	protected function setup_filters() {
	173	+ if ( self::new_comments_enabled() ) {
	174	+ return;
	175	+ }
	176	+
152	177	parent::setup_filters();
153	178
154	179	add_filter( 'comment_post_redirect', array( $this, 'capture_comment_post_redirect_to_reload_parent_frame' ), 100 );
155	180	add_filter( 'comment_duplicate_trigger', array( $this, 'capture_comment_duplicate_trigger' ), 100 );
		@@ -161,8 +186,12 @@
161	186	/**
162	187	* In order for comments to work properly for password-protected posts we need to set `wp-postpass` cookie to SameSite none.
163	188	*/
164	189	public function manage_post_cookie() {
	190	+ if ( headers_sent() ) {
	191	+ return;
	192	+ }
	193	+
165	194	$postpass_cookie_key = 'wp-postpass_' . COOKIEHASH;
166	195
167	196	if ( empty( $_COOKIE[ $postpass_cookie_key ] ) ) {
168	197	return;
		@@ -172,9 +201,9 @@
172	201
173	202	if ( empty( $_COOKIE['verbum-wp-postpass'] ) || ( $_COOKIE['verbum-wp-postpass'] !== $postpass_cookie_value ) ) {
174	203	$expire = apply_filters( 'post_password_expires', time() + 10 * DAY_IN_SECONDS );
175	204
176		- jetpack_shim_setcookie(
	205	+ setcookie(
177	206	$postpass_cookie_key,
178	207	$postpass_cookie_value,
179	208	array(
180	209	'expires' => $expire,
		@@ -181,12 +210,13 @@
181	210	'samesite' => 'None',
182	211	'path' => '/',
183	212	'domain' => COOKIE_DOMAIN,
184	213	'secure' => is_ssl(),
	214	+ 'httponly' => false, // phpcs:ignore Jetpack.Functions.SetCookie.FoundNonHTTPOnlyFalse -- @todo Can this be set true?
185	215	)
186	216	);
187	217
188		- jetpack_shim_setcookie(
	218	+ setcookie(
189	219	'verbum-wp-postpass',
190	220	$postpass_cookie_value,
191	221	array(
192	222	'expires' => $expire,
		@@ -193,8 +223,9 @@
193	223	'samesite' => 'None',
194	224	'path' => '/',
195	225	'domain' => COOKIE_DOMAIN,
196	226	'secure' => is_ssl(),
	227	+ 'httponly' => false, // phpcs:ignore Jetpack.Functions.SetCookie.FoundNonHTTPOnlyFalse -- @todo Can this be set true?
197	228	)
198	229	);
199	230	}
200	231	}
		@@ -225,10 +256,18 @@
225	256	! preg_match( '/\.?(graph\.facebook\.com|twimg\.com)$/', $foreign_avatar_hostname ) ) {
226	257	return $avatar;
227	258	}
228	259
229		- // Return the Facebook or Twitter avatar.
230		- return preg_replace( '#src=([\'"])[^\'"]+\\1#', 'src=\\1' . esc_url( set_url_scheme( $this->photon_avatar( $foreign_avatar, $size ), 'https' ) ) . '\\1', $avatar );
	260	+ // Insert the escaped URL through a callback: a preg_replace() replacement string would expand a
	261	+ // `$1` inside it into the captured quote, breaking out of the src attribute (stored-XSS vector).
	262	+ $photon_url = esc_url( set_url_scheme( $this->photon_avatar( $foreign_avatar, $size ), 'https' ) );
	263	+ return preg_replace_callback(
	264	+ '#src=([\'"])[^\'"]+\\1#',
	265	+ static function ( $matches ) use ( $photon_url ) {
	266	+ return 'src=' . $matches[1] . $photon_url . $matches[1];
	267	+ },
	268	+ $avatar
	269	+ );
231	270	}
232	271
233	272	/**
234	273	* Set comment reply link.
		@@ -636,9 +675,9 @@
636	675	public function pre_comment_on_post() {
637	676	$post_array = stripslashes_deep( $_POST );
638	677
639	678	// Bail if missing the Jetpack token.
640		- if ( ! isset( $post_array['sig'] ) || ! isset( $post_array['token_key'] ) ) {
	679	+ if ( ! isset( $post_array['sig'] ) || ! isset( $post_array['token_key'] ) || ! is_string( $post_array['sig'] ) || ! is_string( $post_array['token_key'] ) ) {
641	680	unset( $_POST['hc_post_as'] );
642	681	return;
643	682	}
644	683
		@@ -648,9 +687,9 @@
648	687	}
649	688	wp_die( esc_html__( 'Nonce verification failed.', 'jetpack' ), 400 );
650	689	}
651	690
652		- if ( str_contains( $post_array['hc_avatar'], '.gravatar.com' ) ) {
	691	+ if ( isset( $post_array['hc_avatar'] ) && is_string( $post_array['hc_avatar'] ) && str_contains( $post_array['hc_avatar'], '.gravatar.com' ) ) {
653	692	$post_array['hc_avatar'] = htmlentities( $post_array['hc_avatar'], ENT_COMPAT );
654	693	}
655	694
656	695	$blog_token = ( new Tokens() )->get_access_token( false, $post_array['token_key'] );
		@@ -692,9 +731,8 @@
692	731	?>
693	732	<!DOCTYPE html>
694	733	<html>
695	734	<head>
696		- <link rel="preload" as="image" href="https://jetpack.wordpress.com/wp-admin/images/spinner.gif"> <!-- Preload the spinner image -->
697	735	<meta charset="utf-8">
698	736	<title><?php echo esc_html__( 'Submitting Comment', 'jetpack' ); ?></title>
699	737	<style type="text/css">
700	738	body {
		@@ -706,12 +744,22 @@
706	744	left: 0;
707	745	overflow: hidden;
708	746	color: #333;
709	747	}
	748	+ .jetpack-comment-spinner {
	749	+ display: table-cell;
	750	+ vertical-align: middle;
	751	+ text-align: center;
	752	+ }
710	753	</style>
711	754	</head>
712	755	<body>
713		- <img src="https://jetpack.wordpress.com/wp-admin/images/spinner.gif" >
	756	+ <div class="jetpack-comment-spinner">
	757	+ <?php
	758	+ require_once JETPACK__PLUGIN_DIR . '_inc/lib/class-jetpack-spinner.php';
	759	+ echo Jetpack_Spinner::render( 28 ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- static SVG markup.
	760	+ ?>
	761	+ </div>
714	762	<form id="jetpack-remote-comment-post-form" action="<?php echo esc_url( get_site_url() ); ?>/wp-comments-post.php?for=jetpack&only_once=true" method="POST">
715	763	<?php foreach ( $comment_data as $key => $val ) : ?>
716	764	<input type="hidden" name="<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $val ); ?>" />
717	765	<?php endforeach; ?>
		@@ -722,9 +770,9 @@
722	770	</script>
723	771	</body>
724	772	</html>
725	773	<?php
726		- exit;
	774	+ exit( 0 );
727	775	}
728	776
729	777	/** Capabilities **********************************************************/
730	778
		@@ -736,16 +784,36 @@
736	784	*
737	785	* @param int $comment_id The comment ID.
738	786	*/
739	787	public function add_comment_meta( $comment_id ) {
	788	+ // phpcs:disable WordPress.Security.NonceVerification.Missing -- The hc_* fields are authenticated by the HMAC check below.
	789	+ $post_array = stripslashes_deep( $_POST );
	790	+
	791	+ // The hc_* identity fields are only trustworthy on a signed request. pre_comment_on_post() checks
	792	+ // that, but only on wp-comments-post.php, so re-check here for any other producer that reaches
	793	+ // comment_post (e.g. Carousel's unauthenticated post_attachment_comment endpoint).
	794	+ if ( ! isset( $post_array['sig'] ) || ! isset( $post_array['token_key'] ) || ! is_string( $post_array['sig'] ) || ! is_string( $post_array['token_key'] ) ) {
	795	+ return;
	796	+ }
	797	+ if ( isset( $post_array['hc_avatar'] ) && is_string( $post_array['hc_avatar'] ) && str_contains( $post_array['hc_avatar'], '.gravatar.com' ) ) {
	798	+ $post_array['hc_avatar'] = htmlentities( $post_array['hc_avatar'], ENT_COMPAT );
	799	+ }
	800	+ $blog_token = ( new Tokens() )->get_access_token( false, $post_array['token_key'] );
	801	+ if ( ! $blog_token || is_wp_error( $blog_token ) ) {
	802	+ return;
	803	+ }
	804	+ $check = self::sign_remote_comment_parameters( $post_array, $blog_token->secret );
	805	+ if ( is_wp_error( $check ) || ! hash_equals( $check, $post_array['sig'] ) ) {
	806	+ return;
	807	+ }
	808	+
740	809	$comment_meta = array();
741	810
742		- // phpcs:disable WordPress.Security.NonceVerification.Missing
743	811	switch ( $this->is_highlander_comment_post() ) {
744	812	case 'facebook':
745	813	$comment_meta['hc_post_as'] = 'facebook';
746		- $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? filter_var( wp_unslash( $_POST['hc_avatar'] ) ) : null;
747		- $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? filter_var( wp_unslash( $_POST['hc_userid'] ) ) : null;
	814	+ $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? esc_url_raw( wp_unslash( $_POST['hc_avatar'] ) ) : null;
	815	+ $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? sanitize_text_field( wp_unslash( $_POST['hc_userid'] ) ) : null;
748	816	break;
749	817
750	818	// phpcs:ignore WordPress.WP.CapitalPDangit
751	819	case 'wordpress':
		@@ -750,17 +818,17 @@
750	818	// phpcs:ignore WordPress.WP.CapitalPDangit
751	819	case 'wordpress':
752	820	// phpcs:ignore WordPress.WP.CapitalPDangit
753	821	$comment_meta['hc_post_as'] = 'wordpress';
754		- $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? filter_var( wp_unslash( $_POST['hc_avatar'] ) ) : null;
755		- $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? filter_var( wp_unslash( $_POST['hc_userid'] ) ) : null;
756		- $comment_meta['hc_wpcom_id_sig'] = isset( $_POST['hc_wpcom_id_sig'] ) ? filter_var( wp_unslash( $_POST['hc_wpcom_id_sig'] ) ) : null; // since 1.9.
	822	+ $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? esc_url_raw( wp_unslash( $_POST['hc_avatar'] ) ) : null;
	823	+ $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? sanitize_text_field( wp_unslash( $_POST['hc_userid'] ) ) : null;
	824	+ $comment_meta['hc_wpcom_id_sig'] = isset( $_POST['hc_wpcom_id_sig'] ) ? sanitize_text_field( wp_unslash( $_POST['hc_wpcom_id_sig'] ) ) : null; // since 1.9.
757	825	break;
758	826
759	827	case 'jetpack':
760	828	$comment_meta['hc_post_as'] = 'jetpack';
761		- $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? filter_var( wp_unslash( $_POST['hc_avatar'] ) ) : null;
762		- $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? filter_var( wp_unslash( $_POST['hc_userid'] ) ) : null;
	829	+ $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? esc_url_raw( wp_unslash( $_POST['hc_avatar'] ) ) : null;
	830	+ $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? sanitize_text_field( wp_unslash( $_POST['hc_userid'] ) ) : null;
763	831	break;
764	832
765	833	}
766	834	// phpcs:enable WordPress.Security.NonceVerification.Missing
		@@ -788,9 +856,9 @@
788	856	return false;
789	857	}
790	858
791	859	// phpcs:disable WordPress.Security.NonceVerification.Missing
792		- $is_current_user_subscribed = (bool) isset( $_POST['is_current_user_subscribed'] ) ? filter_var( wp_unslash( $_POST['is_current_user_subscribed'] ) ) : null;
	860	+ $is_current_user_subscribed = isset( $_POST['is_current_user_subscribed'] ) ? filter_var( wp_unslash( $_POST['is_current_user_subscribed'] ) ) : null;
793	861
794	862	// Atomic sites with jetpack_verbum_subscription_modal option enabled
795	863	$modal_enabled = ( new Host() )->is_woa_site() && get_option( 'jetpack_verbum_subscription_modal', true );
796	864
		@@ -829,9 +897,9 @@
829	897	$tracking_event = 'hidden_self_hosted';
830	898	}
831	899
832	900	// phpcs:disable WordPress.Security.NonceVerification.Missing
833		- $is_current_user_subscribed = (bool) isset( $_POST['is_current_user_subscribed'] ) ? filter_var( wp_unslash( $_POST['is_current_user_subscribed'] ) ) : null;
	901	+ $is_current_user_subscribed = isset( $_POST['is_current_user_subscribed'] ) ? filter_var( wp_unslash( $_POST['is_current_user_subscribed'] ) ) : null;
834	902
835	903	if ( $is_current_user_subscribed ) {
836	904	$tracking_event = 'hidden_already_subscribed';
837	905	}
		@@ -848,9 +916,9 @@
848	916	* @return never
849	917	*/
850	918	public function capture_comment_duplicate_trigger() {
851	919	if ( ! isset( $_GET['for'] ) || 'jetpack' !== $_GET['for'] ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
852		- exit;
	920	+ exit( 0 );
853	921	}
854	922
855	923	?>
856	924	<!DOCTYPE html>
		@@ -927,9 +995,9 @@
927	995
928	996	</body>
929	997	</html>
930	998	<?php
931		- exit;
	999	+ exit( 0 );
932	1000	}
933	1001
934	1002	/**
935	1003	* POST the submitted comment to the iframe
		@@ -1028,12 +1096,12 @@
1028	1096	?>
1029	1097	</h3>
1030	1098	<script type="text/javascript">
1031	1099	try {
1032		- window.parent.location.href = <?php echo wp_json_encode( $url ); ?>;
	1100	+ window.parent.location.href = <?php echo wp_json_encode( $url, JSON_UNESCAPED_SLASHES | JSON_HEX_TAG | JSON_HEX_AMP ); ?>;
1033	1101	window.parent.location.reload( true );
1034	1102	} catch (e) {
1035		- window.location.href = <?php echo wp_json_encode( $url ); ?>;
	1103	+ window.location.href = <?php echo wp_json_encode( $url, JSON_UNESCAPED_SLASHES | JSON_HEX_TAG | JSON_HEX_AMP ); ?>;
1036	1104	window.location.reload( true );
1037	1105	}
1038	1106	ellipsis = document.getElementById('ellipsis');
1039	1107
		@@ -1056,9 +1124,9 @@
1056	1124
1057	1125	window.parent.postMessage(
1058	1126	{
1059	1127	type: 'subscriptionModalShow',
1060		- data: <?php echo wp_json_encode( $this->get_subscription_modal_data_to_parent( $url ) ); ?>,
	1128	+ data: <?php echo wp_json_encode( $this->get_subscription_modal_data_to_parent( $url ), JSON_UNESCAPED_SLASHES | JSON_HEX_TAG | JSON_HEX_AMP ); ?>,
1061	1129	},
1062	1130	window.location.origin
1063	1131	);
1064	1132	}
		@@ -1066,9 +1134,9 @@
1066	1134	<?php } ?>
1067	1135	</body>
1068	1136	</html>
1069	1137	<?php
1070		- exit;
	1138	+ exit( 0 );
1071	1139	}
1072	1140	}
1073	1141
1074	1142	Jetpack_Comments::init();