← All changes | modules/comments/base.php +63 -26 12.0.3 → 16.3-a.1 View file →

		@@ -3,14 +3,30 @@
3	3	* Jetpack comments base file - where the code shared between WP.com Highlander and Jetpack Highlander is defined
4	4	*
5	5	* @package automattic/jetpack
6	6	*/
	7	+
	8	+use Automattic\Jetpack\Image_CDN\Image_CDN_Core;
	9	+
7	10	/**
8	11	* All the code shared between WP.com Highlander and Jetpack Highlander
9	12	*/
10	13	class Highlander_Comments_Base {
	14	+ /**
	15	+ * ID sources.
	16	+ *
	17	+ * @var array
	18	+ */
	19	+ public $id_sources;
11	20
12	21	/**
	22	+ * The default comment scheme, if set.
	23	+ *
	24	+ * @var ?string
	25	+ */
	26	+ public $default_color_scheme;
	27	+
	28	+ /**
13	29	* Constructor
14	30	*/
15	31	public function __construct() {
16	32	$this->setup_globals();
		@@ -20,9 +36,9 @@
20	36
21	37	/**
22	38	* Set any global variables or class variables
23	39	*
24		- * @since JetpackComments (1.4)
	40	+ * @since 1.4
25	41	*/
26	42	protected function setup_globals() {}
27	43
28	44	/**
		@@ -27,9 +43,9 @@
27	43
28	44	/**
29	45	* Setup actions for methods in this class
30	46	*
31		- * @since JetpackComments (1.4)
	47	+ * @since 1.4
32	48	*/
33	49	protected function setup_actions() {
34	50	// Before a comment is posted.
35	51	add_action( 'pre_comment_on_post', array( $this, 'allow_logged_out_user_to_comment_as_external' ) );
		@@ -40,9 +56,9 @@
40	56
41	57	/**
42	58	* Setup filters for methods in this class
43	59	*
44		- * @since JetpackComments (1.4)
	60	+ * @since 1.4
45	61	*/
46	62	protected function setup_filters() {
47	63	add_filter( 'comments_array', array( $this, 'comments_array' ) );
48	64	add_filter( 'preprocess_comment', array( $this, 'allow_logged_in_user_to_comment_as_guest' ), 0 );
		@@ -49,9 +65,9 @@
49	65	}
50	66
51	67	/**
52	68	* Is this a Highlander POST request?
53		- * Optionally restrict to one or more credentials slug (facebook, twitter, ...)
	69	+ * Optionally restrict to one or more credentials slug (facebook, ...)
54	70	*
55	71	* @param mixed ...$args Comments credentials slugs.
56	72	* @return false|string false if it's not a Highlander POST request. The matching credentials slug if it is.
57	73	*/
		@@ -150,25 +166,21 @@
150	166
151	167	/**
152	168	* Comment sort comparator: comment_date_gmt
153	169	*
154		- * @since JetpackComments (1.4)
	170	+ * @since 1.4
155	171	* @param object $a The first comment to compare dates with.
156	172	* @param object $b The second comment to compare dates with.
157	173	* @return int
158	174	*/
159	175	public function sort_comments_by_comment_date_gmt( $a, $b ) {
160		- if ( $a->comment_date_gmt === $b->comment_date_gmt ) {
161		- return 0;
162		- }
163		-
164		- return $a->comment_date_gmt < $b->comment_date_gmt ? -1 : 1;
	176	+ return $a->comment_date_gmt <=> $b->comment_date_gmt;
165	177	}
166	178
167	179	/**
168	180	* Get the current commenter's information from their cookie
169	181	*
170		- * @since JetpackComments (1.4)
	182	+ * @since 1.4
171	183	* @return array Commenters information from cookie
172	184	*/
173	185	protected function get_current_commenter() {
174	186	// Defaults.
		@@ -197,15 +209,16 @@
197	209	return compact( 'comment_author', 'comment_author_email', 'comment_author_url', 'user_id' );
198	210	}
199	211
200	212	/**
201		- * Allows a logged out user to leave a comment as a facebook or twitter credentialed user.
	213	+ * Allows a logged out user to leave a comment as a facebook/wp.com credentialed user.
202	214	* Overrides WordPress' core comment_registration option to treat these commenters as "registered" (verified) users.
203	215	*
204		- * @since JetpackComments (1.4)
	216	+ * @since 1.4
205	217	*/
206	218	public function allow_logged_out_user_to_comment_as_external() {
207		- if ( ! $this->is_highlander_comment_post( 'facebook', 'twitter' ) ) {
	219	+ // phpcs:ignore WordPress.WP.CapitalPDangit.MisspelledInText
	220	+ if ( ! $this->is_highlander_comment_post( 'facebook', 'wordpress' ) ) {
208	221	return;
209	222	}
210	223
211	224	add_filter( 'pre_option_comment_registration', '__return_zero' );
		@@ -212,13 +225,13 @@
212	225	add_filter( 'pre_option_require_name_email', '__return_zero' );
213	226	}
214	227
215	228	/**
216		- * Allow a logged in user to post as a guest, FB, or twitter credentialed request.
	229	+ * Allow a logged in user to post as a guest, or FB credentialed request.
217	230	* Bypasses WordPress' core overrides that force a logged in user to comment as that user.
218	231	* Respects comment_registration option.
219	232	*
220		- * @since JetpackComments (1.4)
	233	+ * @since 1.4
221	234	* @param array $comment_data All data for a specific comment.
222	235	* @return array Modified comment data, or an error if the required fields or a valid email address are not entered.
223	236	*/
224	237	public function allow_logged_in_user_to_comment_as_guest( $comment_data ) {
		@@ -232,9 +245,9 @@
232	245	return $comment_data;
233	246	}
234	247
235	248	// Bail if this is not a guest or external service credentialed request.
236		- if ( ! $this->is_highlander_comment_post( 'guest', 'facebook', 'twitter' ) ) {
	249	+ if ( ! $this->is_highlander_comment_post( 'guest', 'facebook' ) ) {
237	250	return $comment_data;
238	251	}
239	252
240	253	$user = wp_get_current_user();
		@@ -283,9 +296,9 @@
283	296
284	297	/**
285	298	* Set the comment cookies or bail if comment is invalid
286	299	*
287		- * @since JetpackComments (1.4)
	300	+ * @since 1.4
288	301	* @param int $comment_id The comment ID.
289	302	*/
290	303	public function set_comment_cookies( $comment_id ) {
291	304	// Get comment and bail if it's invalid somehow.
		@@ -299,15 +312,39 @@
299	312	return;
300	313	}
301	314
302	315	// Set comment author cookies.
	316	+ // We don't set the cookies if they are logged in with WordPress.com because they already have a cookie set.
303	317	// phpcs:ignore WordPress.WP.CapitalPDangit
304		- if ( ( 'wordpress' !== $id_source ) && is_user_logged_in() ) {
305		- /** This filter is already documented in core/wp-includes/comment-functions.php */
306		- $comment_cookie_lifetime = apply_filters( 'comment_cookie_lifetime', 30000000 );
307		- setcookie( 'comment_author_' . COOKIEHASH, $comment->comment_author, time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN, is_ssl(), true );
308		- setcookie( 'comment_author_email_' . COOKIEHASH, $comment->comment_author_email, time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN, is_ssl(), true );
309		- setcookie( 'comment_author_url_' . COOKIEHASH, esc_url( $comment->comment_author_url ), time() + $comment_cookie_lifetime, COOKIEPATH, COOKIE_DOMAIN, is_ssl(), true );
	318	+ if ( 'wordpress' !== $id_source ) {
	319	+ // phpcs:disable WordPress.Security.NonceVerification -- Nonce verification should happen in Jetpack_Comments::pre_comment_on_post().
	320	+ $is_consenting_to_cookies = ( isset( $_POST['wp-comment-cookies-consent'] ) );
	321	+
	322	+ $cookie_options = array(
	323	+ 'expires' => time() + apply_filters( 'comment_cookie_lifetime', YEAR_IN_SECONDS ),
	324	+ 'path' => COOKIEPATH,
	325	+ 'domain' => COOKIE_DOMAIN,
	326	+ 'secure' => is_ssl(),
	327	+ 'httponly' => true,
	328	+ );
	329	+
	330	+ // If there is no consent, remove any cookies that may have been set.
	331	+ if ( ( 'guest' === $id_source ) && ! $is_consenting_to_cookies ) {
	332	+ $cookie_options['expires'] = time() - YEAR_IN_SECONDS;
	333	+ }
	334	+
	335	+ // Set samesite to None if the request is from Jetpack iframe.
	336	+ // This is needed because it is considered third party.
	337	+ if ( isset( $_REQUEST['for'] ) && 'jetpack' === $_REQUEST['for'] ) {
	338	+ $cookie_options['samesite'] = 'None';
	339	+ }
	340	+ // phpcs:enable WordPress.Security.NonceVerification
	341	+
	342	+ // phpcs:disable Jetpack.Functions.SetCookie.MissingTrueHTTPOnly
	343	+ isset( $comment->comment_author ) ? setcookie( 'comment_author_' . COOKIEHASH, $comment->comment_author, $cookie_options ) : null;
	344	+ isset( $comment->comment_author_email ) ? setcookie( 'comment_author_email_' . COOKIEHASH, $comment->comment_author_email, $cookie_options ) : null;
	345	+ isset( $comment->comment_author_url ) ? setcookie( 'comment_author_url_' . COOKIEHASH, esc_url( $comment->comment_author_url ), $cookie_options ) : null;
	346	+ // phpcs:enable Jetpack.Functions.SetCookie.MissingTrueHTTPOnly
310	347	}
311	348	}
312	349
313	350	/**
		@@ -312,9 +349,9 @@
312	349
313	350	/**
314	351	* Get an avatar from Photon
315	352	*
316		- * @since JetpackComments (1.4)
	353	+ * @since 1.4
317	354	* @param string $url The avatar URL.
318	355	* @param int $size The avatar size.
319	356	* @return string
320	357	*/
		@@ -320,7 +357,7 @@
320	357	*/
321	358	protected function photon_avatar( $url, $size ) {
322	359	$size = (int) $size;
323	360
324		- return jetpack_photon_url( $url, array( 'resize' => "$size,$size" ) );
	361	+ return Image_CDN_Core::cdn_url( $url, array( 'resize' => "$size,$size" ) );
325	362	}
326	363	}