class-wc-comments.php — WooCommerce 6.2.0-beta.1

woocommerce / includes / class-wc-comments.php

woocommerce / includes Last commit date

class-wc-comments.php

513 lines

1	<?php
2	/**
3	* Comments
4	*
5	* Handle comments (reviews and order notes).
6	*
7	* @package WooCommerce\Classes\Products
8	* @version 2.3.0
9	*/
10
11	defined( 'ABSPATH' ) \|\| exit;
12
13	/**
14	* Comments class.
15	*/
16	class WC_Comments {
17
18	/**
19	* Hook in methods.
20	*/
21	public static function init() {
22	// Rating posts.
23	add_filter( 'comments_open', array( __CLASS__, 'comments_open' ), 10, 2 );
24	add_filter( 'preprocess_comment', array( __CLASS__, 'check_comment_rating' ), 0 );
25	add_action( 'comment_post', array( __CLASS__, 'add_comment_rating' ), 1 );
26	add_action( 'comment_moderation_recipients', array( __CLASS__, 'comment_moderation_recipients' ), 10, 2 );
27
28	// Clear transients.
29	add_action( 'wp_update_comment_count', array( __CLASS__, 'clear_transients' ) );
30
31	// Secure order notes.
32	add_filter( 'comments_clauses', array( __CLASS__, 'exclude_order_comments' ), 10, 1 );
33	add_filter( 'comment_feed_where', array( __CLASS__, 'exclude_order_comments_from_feed_where' ) );
34
35	// Secure webhook comments.
36	add_filter( 'comments_clauses', array( __CLASS__, 'exclude_webhook_comments' ), 10, 1 );
37	add_filter( 'comment_feed_where', array( __CLASS__, 'exclude_webhook_comments_from_feed_where' ) );
38
39	// Count comments.
40	add_filter( 'wp_count_comments', array( __CLASS__, 'wp_count_comments' ), 10, 2 );
41
42	// Delete comments count cache whenever there is a new comment or a comment status changes.
43	add_action( 'wp_insert_comment', array( __CLASS__, 'delete_comments_count_cache' ) );
44	add_action( 'wp_set_comment_status', array( __CLASS__, 'delete_comments_count_cache' ) );
45
46	// Support avatars for `review` comment type.
47	add_filter( 'get_avatar_comment_types', array( __CLASS__, 'add_avatar_for_review_comment_type' ) );
48
49	// Add Product Reviews filter for `review` comment type.
50	add_filter( 'admin_comment_types_dropdown', array( __CLASS__, 'add_review_comment_filter' ) );
51
52	// Review of verified purchase.
53	add_action( 'comment_post', array( __CLASS__, 'add_comment_purchase_verification' ) );
54
55	// Set comment type.
56	add_action( 'preprocess_comment', array( __CLASS__, 'update_comment_type' ), 1 );
57
58	// Validate product reviews if requires verified owners.
59	add_action( 'pre_comment_on_post', array( __CLASS__, 'validate_product_review_verified_owners' ) );
60	}
61
62	/**
63	* See if comments are open.
64	*
65	* @since 3.1.0
66	* @param bool $open Whether the current post is open for comments.
67	* @param int $post_id Post ID.
68	* @return bool
69	*/
70	public static function comments_open( $open, $post_id ) {
71	if ( 'product' === get_post_type( $post_id ) && ! post_type_supports( 'product', 'comments' ) ) {
72	$open = false;
73	}
74	return $open;
75	}
76
77	/**
78	* Exclude order comments from queries and RSS.
79	*
80	* This code should exclude shop_order comments from queries. Some queries (like the recent comments widget on the dashboard) are hardcoded.
81	* and are not filtered, however, the code current_user_can( 'read_post', $comment->comment_post_ID ) should keep them safe since only admin and.
82	* shop managers can view orders anyway.
83	*
84	* The frontend view order pages get around this filter by using remove_filter('comments_clauses', array( 'WC_Comments' ,'exclude_order_comments'), 10, 1 );
85	*
86	* @param array $clauses A compacted array of comment query clauses.
87	* @return array
88	*/
89	public static function exclude_order_comments( $clauses ) {
90	$clauses['where'] .= ( $clauses['where'] ? ' AND ' : '' ) . " comment_type != 'order_note' ";
91	return $clauses;
92	}
93
94	/**
95	* Exclude order comments from feed.
96	*
97	* @deprecated 3.1
98	* @param mixed $join Deprecated.
99	*/
100	public static function exclude_order_comments_from_feed_join( $join ) {
101	wc_deprecated_function( 'WC_Comments::exclude_order_comments_from_feed_join', '3.1' );
102	}
103
104	/**
105	* Exclude order comments from queries and RSS.
106	*
107	* @param string $where The WHERE clause of the query.
108	* @return string
109	*/
110	public static function exclude_order_comments_from_feed_where( $where ) {
111	return $where . ( $where ? ' AND ' : '' ) . " comment_type != 'order_note' ";
112	}
113
114	/**
115	* Exclude webhook comments from queries and RSS.
116	*
117	* @since 2.2
118	* @param array $clauses A compacted array of comment query clauses.
119	* @return array
120	*/
121	public static function exclude_webhook_comments( $clauses ) {
122	$clauses['where'] .= ( $clauses['where'] ? ' AND ' : '' ) . " comment_type != 'webhook_delivery' ";
123	return $clauses;
124	}
125
126	/**
127	* Exclude webhooks comments from feed.
128	*
129	* @deprecated 3.1
130	* @param mixed $join Deprecated.
131	*/
132	public static function exclude_webhook_comments_from_feed_join( $join ) {
133	wc_deprecated_function( 'WC_Comments::exclude_webhook_comments_from_feed_join', '3.1' );
134	}
135
136	/**
137	* Exclude webhook comments from queries and RSS.
138	*
139	* @since 2.1
140	* @param string $where The WHERE clause of the query.
141	* @return string
142	*/
143	public static function exclude_webhook_comments_from_feed_where( $where ) {
144	return $where . ( $where ? ' AND ' : '' ) . " comment_type != 'webhook_delivery' ";
145	}
146
147	/**
148	* Validate the comment ratings.
149	*
150	* @param array $comment_data Comment data.
151	* @return array
152	*/
153	public static function check_comment_rating( $comment_data ) {
154	// If posting a comment (not trackback etc) and not logged in.
155	if ( ! is_admin() && isset( $_POST['comment_post_ID'], $_POST['rating'], $comment_data['comment_type'] ) && 'product' === get_post_type( absint( $_POST['comment_post_ID'] ) ) && empty( $_POST['rating'] ) && self::is_default_comment_type( $comment_data['comment_type'] ) && wc_review_ratings_enabled() && wc_review_ratings_required() ) { // WPCS: input var ok, CSRF ok.
156	wp_die( esc_html__( 'Please rate the product.', 'woocommerce' ) );
157	exit;
158	}
159	return $comment_data;
160	}
161
162	/**
163	* Rating field for comments.
164	*
165	* @param int $comment_id Comment ID.
166	*/
167	public static function add_comment_rating( $comment_id ) {
168	if ( isset( $_POST['rating'], $_POST['comment_post_ID'] ) && 'product' === get_post_type( absint( $_POST['comment_post_ID'] ) ) ) { // WPCS: input var ok, CSRF ok.
169	if ( ! $_POST['rating'] \|\| $_POST['rating'] > 5 \|\| $_POST['rating'] < 0 ) { // WPCS: input var ok, CSRF ok, sanitization ok.
170	return;
171	}
172	add_comment_meta( $comment_id, 'rating', intval( $_POST['rating'] ), true ); // WPCS: input var ok, CSRF ok.
173
174	$post_id = isset( $_POST['comment_post_ID'] ) ? absint( $_POST['comment_post_ID'] ) : 0; // WPCS: input var ok, CSRF ok.
175	if ( $post_id ) {
176	self::clear_transients( $post_id );
177	}
178	}
179	}
180
181	/**
182	* Modify recipient of review email.
183	*
184	* @param array $emails Emails.
185	* @param int $comment_id Comment ID.
186	* @return array
187	*/
188	public static function comment_moderation_recipients( $emails, $comment_id ) {
189	$comment = get_comment( $comment_id );
190
191	if ( $comment && 'product' === get_post_type( $comment->comment_post_ID ) ) {
192	$emails = array( get_option( 'admin_email' ) );
193	}
194
195	return $emails;
196	}
197
198	/**
199	* Ensure product average rating and review count is kept up to date.
200	*
201	* @param int $post_id Post ID.
202	*/
203	public static function clear_transients( $post_id ) {
204	if ( 'product' === get_post_type( $post_id ) ) {
205	$product = wc_get_product( $post_id );
206	$product->set_rating_counts( self::get_rating_counts_for_product( $product ) );
207	$product->set_average_rating( self::get_average_rating_for_product( $product ) );
208	$product->set_review_count( self::get_review_count_for_product( $product ) );
209	$product->save();
210	}
211	}
212
213	/**
214	* Delete comments count cache whenever there is
215	* new comment or the status of a comment changes. Cache
216	* will be regenerated next time WC_Comments::wp_count_comments()
217	* is called.
218	*/
219	public static function delete_comments_count_cache() {
220	delete_transient( 'wc_count_comments' );
221	}
222
223	/**
224	* Remove order notes and webhook delivery logs from wp_count_comments().
225	*
226	* @since 2.2
227	* @param object $stats Comment stats.
228	* @param int $post_id Post ID.
229	* @return object
230	*/
231	public static function wp_count_comments( $stats, $post_id ) {
232	global $wpdb;
233
234	if ( 0 === $post_id ) {
235	$stats = get_transient( 'wc_count_comments' );
236
237	if ( ! $stats ) {
238	$stats = array(
239	'total_comments' => 0,
240	'all' => 0,
241	);
242
243	$count = $wpdb->get_results(
244	"
245	SELECT comment_approved, COUNT(*) AS num_comments
246	FROM {$wpdb->comments}
247	WHERE comment_type NOT IN ('action_log', 'order_note', 'webhook_delivery')
248	GROUP BY comment_approved
249	",
250	ARRAY_A
251	);
252
253	$approved = array(
254	'0' => 'moderated',
255	'1' => 'approved',
256	'spam' => 'spam',
257	'trash' => 'trash',
258	'post-trashed' => 'post-trashed',
259	);
260
261	foreach ( (array) $count as $row ) {
262	// Don't count post-trashed toward totals.
263	if ( ! in_array( $row['comment_approved'], array( 'post-trashed', 'trash', 'spam' ), true ) ) {
264	$stats['all'] += $row['num_comments'];
265	$stats['total_comments'] += $row['num_comments'];
266	} elseif ( ! in_array( $row['comment_approved'], array( 'post-trashed', 'trash' ), true ) ) {
267	$stats['total_comments'] += $row['num_comments'];
268	}
269	if ( isset( $approved[ $row['comment_approved'] ] ) ) {
270	$stats[ $approved[ $row['comment_approved'] ] ] = $row['num_comments'];
271	}
272	}
273
274	foreach ( $approved as $key ) {
275	if ( empty( $stats[ $key ] ) ) {
276	$stats[ $key ] = 0;
277	}
278	}
279
280	$stats = (object) $stats;
281	set_transient( 'wc_count_comments', $stats );
282	}
283	}
284
285	return $stats;
286	}
287
288	/**
289	* Make sure WP displays avatars for comments with the `review` type.
290	*
291	* @since 2.3
292	* @param array $comment_types Comment types.
293	* @return array
294	*/
295	public static function add_avatar_for_review_comment_type( $comment_types ) {
296	return array_merge( $comment_types, array( 'review' ) );
297	}
298
299	/**
300	* Add Product Reviews filter for `review` comment type.
301	*
302	* @since 6.0.0
303	*
304	* @param array $comment_types Array of comment type labels keyed by their name.
305	*
306	* @return array
307	*/
308	public static function add_review_comment_filter( array $comment_types ): array {
309	$comment_types['review'] = __( 'Product Reviews', 'woocommerce' );
310	return $comment_types;
311	}
312
313	/**
314	* Determine if a review is from a verified owner at submission.
315	*
316	* @param int $comment_id Comment ID.
317	* @return bool
318	*/
319	public static function add_comment_purchase_verification( $comment_id ) {
320	$comment = get_comment( $comment_id );
321	$verified = false;
322	if ( 'product' === get_post_type( $comment->comment_post_ID ) ) {
323	$verified = wc_customer_bought_product( $comment->comment_author_email, $comment->user_id, $comment->comment_post_ID );
324	add_comment_meta( $comment_id, 'verified', (int) $verified, true );
325	}
326	return $verified;
327	}
328
329	/**
330	* Get product rating for a product. Please note this is not cached.
331	*
332	* @since 3.0.0
333	* @param WC_Product $product Product instance.
334	* @return float
335	*/
336	public static function get_average_rating_for_product( &$product ) {
337	global $wpdb;
338
339	$count = $product->get_rating_count();
340
341	if ( $count ) {
342	$ratings = $wpdb->get_var(
343	$wpdb->prepare(
344	"
345	SELECT SUM(meta_value) FROM $wpdb->commentmeta
346	LEFT JOIN $wpdb->comments ON $wpdb->commentmeta.comment_id = $wpdb->comments.comment_ID
347	WHERE meta_key = 'rating'
348	AND comment_post_ID = %d
349	AND comment_approved = '1'
350	AND meta_value > 0
351	",
352	$product->get_id()
353	)
354	);
355	$average = number_format( $ratings / $count, 2, '.', '' );
356	} else {
357	$average = 0;
358	}
359
360	return $average;
361	}
362
363	/**
364	* Utility function for getting review counts for multiple products in one query. This is not cached.
365	*
366	* @since 5.0.0
367	*
368	* @param array $product_ids Array of product IDs.
369	*
370	* @return array
371	*/
372	public static function get_review_counts_for_product_ids( $product_ids ) {
373	global $wpdb;
374
375	if ( empty( $product_ids ) ) {
376	return array();
377	}
378
379	$product_id_string_placeholder = substr( str_repeat( ',%s', count( $product_ids ) ), 1 );
380
381	$review_counts = $wpdb->get_results(
382	// phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Ignored for allowing interpolation in IN query.
383	$wpdb->prepare(
384	"
385	SELECT comment_post_ID as product_id, COUNT( comment_post_ID ) as review_count
386	FROM $wpdb->comments
387	WHERE
388	comment_parent = 0
389	AND comment_post_ID IN ( $product_id_string_placeholder )
390	AND comment_approved = '1'
391	AND comment_type in ( 'review', '', 'comment' )
392	GROUP BY product_id
393	",
394	$product_ids
395	),
396	// phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared.
397	ARRAY_A
398	);
399
400	// Convert to key value pairs.
401	$counts = array_replace( array_fill_keys( $product_ids, 0 ), array_column( $review_counts, 'review_count', 'product_id' ) );
402
403	return $counts;
404	}
405
406	/**
407	* Get product review count for a product (not replies). Please note this is not cached.
408	*
409	* @since 3.0.0
410	* @param WC_Product $product Product instance.
411	* @return int
412	*/
413	public static function get_review_count_for_product( &$product ) {
414	$counts = self::get_review_counts_for_product_ids( array( $product->get_id() ) );
415
416	return $counts[ $product->get_id() ];
417	}
418
419	/**
420	* Get product rating count for a product. Please note this is not cached.
421	*
422	* @since 3.0.0
423	* @param WC_Product $product Product instance.
424	* @return int[]
425	*/
426	public static function get_rating_counts_for_product( &$product ) {
427	global $wpdb;
428
429	$counts = array();
430	$raw_counts = $wpdb->get_results(
431	$wpdb->prepare(
432	"
433	SELECT meta_value, COUNT( * ) as meta_value_count FROM $wpdb->commentmeta
434	LEFT JOIN $wpdb->comments ON $wpdb->commentmeta.comment_id = $wpdb->comments.comment_ID
435	WHERE meta_key = 'rating'
436	AND comment_post_ID = %d
437	AND comment_approved = '1'
438	AND meta_value > 0
439	GROUP BY meta_value
440	",
441	$product->get_id()
442	)
443	);
444
445	foreach ( $raw_counts as $count ) {
446	$counts[ $count->meta_value ] = absint( $count->meta_value_count ); // WPCS: slow query ok.
447	}
448
449	return $counts;
450	}
451
452	/**
453	* Update comment type of product reviews.
454	*
455	* @since 3.5.0
456	* @param array $comment_data Comment data.
457	* @return array
458	*/
459	public static function update_comment_type( $comment_data ) {
460	if ( ! is_admin() && isset( $_POST['comment_post_ID'], $comment_data['comment_type'] ) && self::is_default_comment_type( $comment_data['comment_type'] ) && 'product' === get_post_type( absint( $_POST['comment_post_ID'] ) ) ) { // WPCS: input var ok, CSRF ok.
461	$comment_data['comment_type'] = 'review';
462	}
463
464	return $comment_data;
465	}
466
467	/**
468	* Validate product reviews if requires a verified owner.
469	*
470	* @param int $comment_post_id Post ID.
471	*/
472	public static function validate_product_review_verified_owners( $comment_post_id ) {
473	// Only validate if option is enabled.
474	if ( 'yes' !== get_option( 'woocommerce_review_rating_verification_required' ) ) {
475	return;
476	}
477
478	// Validate only products.
479	if ( 'product' !== get_post_type( $comment_post_id ) ) {
480	return;
481	}
482
483	// Skip if is a verified owner.
484	if ( wc_customer_bought_product( '', get_current_user_id(), $comment_post_id ) ) {
485	return;
486	}
487
488	wp_die(
489	esc_html__( 'Only logged in customers who have purchased this product may leave a review.', 'woocommerce' ),
490	esc_html__( 'Reviews can only be left by "verified owners"', 'woocommerce' ),
491	array(
492	'code' => 403,
493	)
494	);
495	}
496
497	/**
498	* Determines if a comment is of the default type.
499	*
500	* Prior to WordPress 5.5, '' was the default comment type.
501	* As of 5.5, the default type is 'comment'.
502	*
503	* @since 4.3.0
504	* @param string $comment_type Comment type.
505	* @return bool
506	*/
507	private static function is_default_comment_type( $comment_type ) {
508	return ( '' === $comment_type \|\| 'comment' === $comment_type );
509	}
510	}
511
512	WC_Comments::init();
513