← All changes | modules/comments/comments.php +169 -30 13.3.3 → 16.3-a.7 View file →

		@@ -8,8 +8,12 @@
8	8	require __DIR__ . '/base.php';
9	9	use Automattic\Jetpack\Connection\Tokens;
10	10	use Automattic\Jetpack\Status\Host;
11	11
	12	+if ( ! defined( 'ABSPATH' ) ) {
	13	+ exit( 0 );
	14	+}
	15	+
12	16	/**
13	17	* Main Comments class
14	18	*
15	19	* @package automattic/jetpack
		@@ -84,9 +88,9 @@
84	88	*/
85	89	public function set_default_color_theme_based_on_theme_settings() {
86	90	if ( function_exists( 'twentyeleven_get_theme_options' ) ) {
87	91	$theme_options = twentyeleven_get_theme_options();
88		- $theme_color_scheme = isset( $theme_options['color_scheme'] ) ? $theme_options['color_scheme'] : 'transparent';
	92	+ $theme_color_scheme = $theme_options['color_scheme'] ?? 'transparent';
89	93	} else {
90	94	$theme_color_scheme = get_theme_mod( 'color_scheme', 'transparent' );
91	95	}
92	96	// Default for $theme_color_scheme is 'transparent' just so it doesn't match 'light' or 'dark'.
		@@ -120,13 +124,30 @@
120	124	);
121	125	}
122	126
123	127	/**
	128	+ * Whether the rebuilt Jetpack Comments form has taken over from this one.
	129	+ *
	130	+ * Guarded because this file and the jetpack-comments package can land in
	131	+ * either order on a staged deploy.
	132	+ *
	133	+ * @return bool
	134	+ */
	135	+ private static function new_comments_enabled() {
	136	+ return class_exists( '\Automattic\Jetpack\Comments\Comments' )
	137	+ && \Automattic\Jetpack\Comments\Comments::is_enabled();
	138	+ }
	139	+
	140	+ /**
124	141	* Setup actions for methods in this class
125	142	*
126	143	* @since 1.4
127	144	*/
128	145	protected function setup_actions() {
	146	+ if ( self::new_comments_enabled() ) {
	147	+ return;
	148	+ }
	149	+
129	150	parent::setup_actions();
130	151
131	152	// Selfishly remove everything from the existing comment form.
132	153	remove_all_actions( 'comment_form_before' );
		@@ -148,8 +169,12 @@
148	169	*
149	170	* @since 1.6.2
150	171	*/
151	172	protected function setup_filters() {
	173	+ if ( self::new_comments_enabled() ) {
	174	+ return;
	175	+ }
	176	+
152	177	parent::setup_filters();
153	178
154	179	add_filter( 'comment_post_redirect', array( $this, 'capture_comment_post_redirect_to_reload_parent_frame' ), 100 );
155	180	add_filter( 'comment_duplicate_trigger', array( $this, 'capture_comment_duplicate_trigger' ), 100 );
		@@ -161,8 +186,12 @@
161	186	/**
162	187	* In order for comments to work properly for password-protected posts we need to set `wp-postpass` cookie to SameSite none.
163	188	*/
164	189	public function manage_post_cookie() {
	190	+ if ( headers_sent() ) {
	191	+ return;
	192	+ }
	193	+
165	194	$postpass_cookie_key = 'wp-postpass_' . COOKIEHASH;
166	195
167	196	if ( empty( $_COOKIE[ $postpass_cookie_key ] ) ) {
168	197	return;
		@@ -172,9 +201,9 @@
172	201
173	202	if ( empty( $_COOKIE['verbum-wp-postpass'] ) || ( $_COOKIE['verbum-wp-postpass'] !== $postpass_cookie_value ) ) {
174	203	$expire = apply_filters( 'post_password_expires', time() + 10 * DAY_IN_SECONDS );
175	204
176		- jetpack_shim_setcookie(
	205	+ setcookie(
177	206	$postpass_cookie_key,
178	207	$postpass_cookie_value,
179	208	array(
180	209	'expires' => $expire,
		@@ -181,12 +210,13 @@
181	210	'samesite' => 'None',
182	211	'path' => '/',
183	212	'domain' => COOKIE_DOMAIN,
184	213	'secure' => is_ssl(),
	214	+ 'httponly' => false, // phpcs:ignore Jetpack.Functions.SetCookie.FoundNonHTTPOnlyFalse -- @todo Can this be set true?
185	215	)
186	216	);
187	217
188		- jetpack_shim_setcookie(
	218	+ setcookie(
189	219	'verbum-wp-postpass',
190	220	$postpass_cookie_value,
191	221	array(
192	222	'expires' => $expire,
		@@ -193,8 +223,9 @@
193	223	'samesite' => 'None',
194	224	'path' => '/',
195	225	'domain' => COOKIE_DOMAIN,
196	226	'secure' => is_ssl(),
	227	+ 'httponly' => false, // phpcs:ignore Jetpack.Functions.SetCookie.FoundNonHTTPOnlyFalse -- @todo Can this be set true?
197	228	)
198	229	);
199	230	}
200	231	}
		@@ -225,10 +256,18 @@
225	256	! preg_match( '/\.?(graph\.facebook\.com|twimg\.com)$/', $foreign_avatar_hostname ) ) {
226	257	return $avatar;
227	258	}
228	259
229		- // Return the Facebook or Twitter avatar.
230		- return preg_replace( '#src=([\'"])[^\'"]+\\1#', 'src=\\1' . esc_url( set_url_scheme( $this->photon_avatar( $foreign_avatar, $size ), 'https' ) ) . '\\1', $avatar );
	260	+ // Insert the escaped URL through a callback: a preg_replace() replacement string would expand a
	261	+ // `$1` inside it into the captured quote, breaking out of the src attribute (stored-XSS vector).
	262	+ $photon_url = esc_url( set_url_scheme( $this->photon_avatar( $foreign_avatar, $size ), 'https' ) );
	263	+ return preg_replace_callback(
	264	+ '#src=([\'"])[^\'"]+\\1#',
	265	+ static function ( $matches ) use ( $photon_url ) {
	266	+ return 'src=' . $matches[1] . $photon_url . $matches[1];
	267	+ },
	268	+ $avatar
	269	+ );
231	270	}
232	271
233	272	/**
234	273	* Set comment reply link.
		@@ -393,8 +432,9 @@
393	432	),
394	433	'color_scheme' => get_option( 'jetpack_comment_form_color_scheme', $this->default_color_scheme ),
395	434	'lang' => get_locale(),
396	435	'jetpack_version' => JETPACK__VERSION,
	436	+ 'iframe_unique_id' => wp_unique_id(),
397	437	);
398	438
399	439	// Extra parameters for logged in user.
400	440	if ( is_user_logged_in() ) {
		@@ -593,14 +633,32 @@
593	633	// In WP 6.4+, the script is loaded asynchronously, so we need to wait for it to load before we monkey-patch the functions it introduces.
594	634	document.querySelector('#comment-reply-js')?.addEventListener( 'load', watchReply );
595	635
596	636	<?php endif; ?>
	637	+
	638	+ const commentIframes = document.getElementsByClassName('jetpack_remote_comment');
597	639
598		- window.addEventListener( 'message', function ( event ) {
599		- if ( event.origin !== 'https://jetpack.wordpress.com' ) {
	640	+ window.addEventListener('message', function(event) {
	641	+ if (event.origin !== 'https://jetpack.wordpress.com') {
600	642	return;
601	643	}
602		- iframe.style.height = event.data + 'px';
	644	+
	645	+ if (!event?.data?.iframeUniqueId && !event?.data?.height) {
	646	+ return;
	647	+ }
	648	+
	649	+ const eventDataUniqueId = event.data.iframeUniqueId;
	650	+
	651	+ // Change height for the matching comment iframe
	652	+ for (let i = 0; i < commentIframes.length; i++) {
	653	+ const iframe = commentIframes[i];
	654	+ const url = new URL(iframe.src);
	655	+ const iframeUniqueIdParam = url.searchParams.get('iframe_unique_id');
	656	+ if (iframeUniqueIdParam == event.data.iframeUniqueId) {
	657	+ iframe.style.height = event.data.height + 'px';
	658	+ return;
	659	+ }
	660	+ }
603	661	});
604	662	})();
605	663	</script>
606	664	<?php
		@@ -617,19 +675,21 @@
617	675	public function pre_comment_on_post() {
618	676	$post_array = stripslashes_deep( $_POST );
619	677
620	678	// Bail if missing the Jetpack token.
621		- if ( ! isset( $post_array['sig'] ) || ! isset( $post_array['token_key'] ) ) {
	679	+ if ( ! isset( $post_array['sig'] ) || ! isset( $post_array['token_key'] ) || ! is_string( $post_array['sig'] ) || ! is_string( $post_array['token_key'] ) ) {
622	680	unset( $_POST['hc_post_as'] );
623		-
624	681	return;
625	682	}
626	683
627	684	if ( empty( $post_array['jetpack_comments_nonce'] ) || ! wp_verify_nonce( $post_array['jetpack_comments_nonce'], "jetpack_comments_nonce-{$post_array['comment_post_ID']}" ) ) {
628		- wp_die( esc_html__( 'Nonce verification failed.', 'jetpack' ), 400 );
	685	+ if ( ! isset( $_GET['only_once'] ) ) {
	686	+ self::retry_submit_comment_form_locally();
	687	+ }
	688	+ wp_die( esc_html__( 'Nonce verification failed.', 'jetpack' ), 400 );
629	689	}
630	690
631		- if ( str_contains( $post_array['hc_avatar'], '.gravatar.com' ) ) {
	691	+ if ( isset( $post_array['hc_avatar'] ) && is_string( $post_array['hc_avatar'] ) && str_contains( $post_array['hc_avatar'], '.gravatar.com' ) ) {
632	692	$post_array['hc_avatar'] = htmlentities( $post_array['hc_avatar'], ENT_COMPAT );
633	693	}
634	694
635	695	$blog_token = ( new Tokens() )->get_access_token( false, $post_array['token_key'] );
		@@ -654,8 +714,67 @@
654	714	wp_die( esc_html__( 'Comments are not allowed.', 'jetpack' ), 403 );
655	715	}
656	716	}
657	717
	718	+ /**
	719	+ * Handle Jetpack Comments POST requests: process the comment form, then client-side POST the results to the self-hosted blog
	720	+ *
	721	+ * This function exists because when we submit the form via the jetpack.wordpress.com iframe
	722	+ * in Chrome the request comes in to Jetpack but for some reason the request doesn't have access to cookies yet.
	723	+ * By submitting the form again locally with the same data the process works as expected.
	724	+ *
	725	+ * @return never
	726	+ */
	727	+ public function retry_submit_comment_form_locally() {
	728	+ // We are not doing any validation here since all the validation will be done again by pre_comment_on_post().
	729	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing
	730	+ $comment_data = stripslashes_deep( $_POST );
	731	+ ?>
	732	+ <!DOCTYPE html>
	733	+ <html>
	734	+ <head>
	735	+ <meta charset="utf-8">
	736	+ <title><?php echo esc_html__( 'Submitting Comment', 'jetpack' ); ?></title>
	737	+ <style type="text/css">
	738	+ body {
	739	+ display: table;
	740	+ width: 100%;
	741	+ height: 60%;
	742	+ position: absolute;
	743	+ top: 0;
	744	+ left: 0;
	745	+ overflow: hidden;
	746	+ color: #333;
	747	+ }
	748	+ .jetpack-comment-spinner {
	749	+ display: table-cell;
	750	+ vertical-align: middle;
	751	+ text-align: center;
	752	+ }
	753	+ </style>
	754	+ </head>
	755	+ <body>
	756	+ <div class="jetpack-comment-spinner">
	757	+ <?php
	758	+ require_once JETPACK__PLUGIN_DIR . '_inc/lib/class-jetpack-spinner.php';
	759	+ echo Jetpack_Spinner::render( 28 ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- static SVG markup.
	760	+ ?>
	761	+ </div>
	762	+ <form id="jetpack-remote-comment-post-form" action="<?php echo esc_url( get_site_url() ); ?>/wp-comments-post.php?for=jetpack&only_once=true" method="POST">
	763	+ <?php foreach ( $comment_data as $key => $val ) : ?>
	764	+ <input type="hidden" name="<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $val ); ?>" />
	765	+ <?php endforeach; ?>
	766	+ </form>
	767	+
	768	+ <script type="text/javascript">
	769	+ document.getElementById("jetpack-remote-comment-post-form").submit();
	770	+ </script>
	771	+ </body>
	772	+ </html>
	773	+ <?php
	774	+ exit( 0 );
	775	+ }
	776	+
658	777	/** Capabilities **********************************************************/
659	778
660	779	/**
661	780	* Add some additional comment meta after comment is saved about what
		@@ -665,16 +784,36 @@
665	784	*
666	785	* @param int $comment_id The comment ID.
667	786	*/
668	787	public function add_comment_meta( $comment_id ) {
	788	+ // phpcs:disable WordPress.Security.NonceVerification.Missing -- The hc_* fields are authenticated by the HMAC check below.
	789	+ $post_array = stripslashes_deep( $_POST );
	790	+
	791	+ // The hc_* identity fields are only trustworthy on a signed request. pre_comment_on_post() checks
	792	+ // that, but only on wp-comments-post.php, so re-check here for any other producer that reaches
	793	+ // comment_post (e.g. Carousel's unauthenticated post_attachment_comment endpoint).
	794	+ if ( ! isset( $post_array['sig'] ) || ! isset( $post_array['token_key'] ) || ! is_string( $post_array['sig'] ) || ! is_string( $post_array['token_key'] ) ) {
	795	+ return;
	796	+ }
	797	+ if ( isset( $post_array['hc_avatar'] ) && is_string( $post_array['hc_avatar'] ) && str_contains( $post_array['hc_avatar'], '.gravatar.com' ) ) {
	798	+ $post_array['hc_avatar'] = htmlentities( $post_array['hc_avatar'], ENT_COMPAT );
	799	+ }
	800	+ $blog_token = ( new Tokens() )->get_access_token( false, $post_array['token_key'] );
	801	+ if ( ! $blog_token || is_wp_error( $blog_token ) ) {
	802	+ return;
	803	+ }
	804	+ $check = self::sign_remote_comment_parameters( $post_array, $blog_token->secret );
	805	+ if ( is_wp_error( $check ) || ! hash_equals( $check, $post_array['sig'] ) ) {
	806	+ return;
	807	+ }
	808	+
669	809	$comment_meta = array();
670	810
671		- // phpcs:disable WordPress.Security.NonceVerification.Missing
672	811	switch ( $this->is_highlander_comment_post() ) {
673	812	case 'facebook':
674	813	$comment_meta['hc_post_as'] = 'facebook';
675		- $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? filter_var( wp_unslash( $_POST['hc_avatar'] ) ) : null;
676		- $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? filter_var( wp_unslash( $_POST['hc_userid'] ) ) : null;
	814	+ $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? esc_url_raw( wp_unslash( $_POST['hc_avatar'] ) ) : null;
	815	+ $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? sanitize_text_field( wp_unslash( $_POST['hc_userid'] ) ) : null;
677	816	break;
678	817
679	818	// phpcs:ignore WordPress.WP.CapitalPDangit
680	819	case 'wordpress':
		@@ -679,17 +818,17 @@
679	818	// phpcs:ignore WordPress.WP.CapitalPDangit
680	819	case 'wordpress':
681	820	// phpcs:ignore WordPress.WP.CapitalPDangit
682	821	$comment_meta['hc_post_as'] = 'wordpress';
683		- $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? filter_var( wp_unslash( $_POST['hc_avatar'] ) ) : null;
684		- $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? filter_var( wp_unslash( $_POST['hc_userid'] ) ) : null;
685		- $comment_meta['hc_wpcom_id_sig'] = isset( $_POST['hc_wpcom_id_sig'] ) ? filter_var( wp_unslash( $_POST['hc_wpcom_id_sig'] ) ) : null; // since 1.9.
	822	+ $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? esc_url_raw( wp_unslash( $_POST['hc_avatar'] ) ) : null;
	823	+ $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? sanitize_text_field( wp_unslash( $_POST['hc_userid'] ) ) : null;
	824	+ $comment_meta['hc_wpcom_id_sig'] = isset( $_POST['hc_wpcom_id_sig'] ) ? sanitize_text_field( wp_unslash( $_POST['hc_wpcom_id_sig'] ) ) : null; // since 1.9.
686	825	break;
687	826
688	827	case 'jetpack':
689	828	$comment_meta['hc_post_as'] = 'jetpack';
690		- $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? filter_var( wp_unslash( $_POST['hc_avatar'] ) ) : null;
691		- $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? filter_var( wp_unslash( $_POST['hc_userid'] ) ) : null;
	829	+ $comment_meta['hc_avatar'] = isset( $_POST['hc_avatar'] ) ? esc_url_raw( wp_unslash( $_POST['hc_avatar'] ) ) : null;
	830	+ $comment_meta['hc_foreign_user_id'] = isset( $_POST['hc_userid'] ) ? sanitize_text_field( wp_unslash( $_POST['hc_userid'] ) ) : null;
692	831	break;
693	832
694	833	}
695	834	// phpcs:enable WordPress.Security.NonceVerification.Missing
		@@ -717,9 +856,9 @@
717	856	return false;
718	857	}
719	858
720	859	// phpcs:disable WordPress.Security.NonceVerification.Missing
721		- $is_current_user_subscribed = (bool) isset( $_POST['is_current_user_subscribed'] ) ? filter_var( wp_unslash( $_POST['is_current_user_subscribed'] ) ) : null;
	860	+ $is_current_user_subscribed = isset( $_POST['is_current_user_subscribed'] ) ? filter_var( wp_unslash( $_POST['is_current_user_subscribed'] ) ) : null;
722	861
723	862	// Atomic sites with jetpack_verbum_subscription_modal option enabled
724	863	$modal_enabled = ( new Host() )->is_woa_site() && get_option( 'jetpack_verbum_subscription_modal', true );
725	864
		@@ -758,9 +897,9 @@
758	897	$tracking_event = 'hidden_self_hosted';
759	898	}
760	899
761	900	// phpcs:disable WordPress.Security.NonceVerification.Missing
762		- $is_current_user_subscribed = (bool) isset( $_POST['is_current_user_subscribed'] ) ? filter_var( wp_unslash( $_POST['is_current_user_subscribed'] ) ) : null;
	901	+ $is_current_user_subscribed = isset( $_POST['is_current_user_subscribed'] ) ? filter_var( wp_unslash( $_POST['is_current_user_subscribed'] ) ) : null;
763	902
764	903	if ( $is_current_user_subscribed ) {
765	904	$tracking_event = 'hidden_already_subscribed';
766	905	}
		@@ -777,9 +916,9 @@
777	916	* @return never
778	917	*/
779	918	public function capture_comment_duplicate_trigger() {
780	919	if ( ! isset( $_GET['for'] ) || 'jetpack' !== $_GET['for'] ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
781		- exit;
	920	+ exit( 0 );
782	921	}
783	922
784	923	?>
785	924	<!DOCTYPE html>
		@@ -856,9 +995,9 @@
856	995
857	996	</body>
858	997	</html>
859	998	<?php
860		- exit;
	999	+ exit( 0 );
861	1000	}
862	1001
863	1002	/**
864	1003	* POST the submitted comment to the iframe
		@@ -957,13 +1096,13 @@
957	1096	?>
958	1097	</h3>
959	1098	<script type="text/javascript">
960	1099	try {
961		- window.parent.location = <?php echo wp_json_encode( $url ); ?>;
962		- window.parent.location.reload(true);
	1100	+ window.parent.location.href = <?php echo wp_json_encode( $url, JSON_UNESCAPED_SLASHES | JSON_HEX_TAG | JSON_HEX_AMP ); ?>;
	1101	+ window.parent.location.reload( true );
963	1102	} catch (e) {
964		- window.location = <?php echo wp_json_encode( $url ); ?>;
965		- window.location.reload(true);
	1103	+ window.location.href = <?php echo wp_json_encode( $url, JSON_UNESCAPED_SLASHES | JSON_HEX_TAG | JSON_HEX_AMP ); ?>;
	1104	+ window.location.reload( true );
966	1105	}
967	1106	ellipsis = document.getElementById('ellipsis');
968	1107
969	1108	function toggleEllipsis() {
		@@ -985,9 +1124,9 @@
985	1124
986	1125	window.parent.postMessage(
987	1126	{
988	1127	type: 'subscriptionModalShow',
989		- data: <?php echo wp_json_encode( $this->get_subscription_modal_data_to_parent( $url ) ); ?>,
	1128	+ data: <?php echo wp_json_encode( $this->get_subscription_modal_data_to_parent( $url ), JSON_UNESCAPED_SLASHES | JSON_HEX_TAG | JSON_HEX_AMP ); ?>,
990	1129	},
991	1130	window.location.origin
992	1131	);
993	1132	}
		@@ -995,9 +1134,9 @@
995	1134	<?php } ?>
996	1135	</body>
997	1136	</html>
998	1137	<?php
999		- exit;
	1138	+ exit( 0 );
1000	1139	}
1001	1140	}
1002	1141
1003	1142	Jetpack_Comments::init();