<?php //phpcs:ignore WordPress.Files.FileName.InvalidClassFileName

[0] Fix | Delete

/**

[1] Fix | Delete

* Jetpack comments base file - where the code shared between WP.com Highlander and Jetpack Highlander is defined

[2] Fix | Delete

*

[3] Fix | Delete

* @package automattic/jetpack

[4] Fix | Delete

*/

[5] Fix | Delete

[6] Fix | Delete

use Automattic\Jetpack\Image_CDN\Image_CDN_Core;

[7] Fix | Delete

[8] Fix | Delete

/**

[9] Fix | Delete

* All the code shared between WP.com Highlander and Jetpack Highlander

[10] Fix | Delete

*/

[11] Fix | Delete

class Highlander_Comments_Base {

[12] Fix | Delete

/**

[13] Fix | Delete

* ID sources.

[14] Fix | Delete

*

[15] Fix | Delete

* @var array

[16] Fix | Delete

*/

[17] Fix | Delete

public $id_sources;

[18] Fix | Delete

[19] Fix | Delete

/**

[20] Fix | Delete

* The default comment scheme, if set.

[21] Fix | Delete

*

[22] Fix | Delete

* @var ?string

[23] Fix | Delete

*/

[24] Fix | Delete

public $default_color_scheme;

[25] Fix | Delete

[26] Fix | Delete

/**

[27] Fix | Delete

* Constructor

[28] Fix | Delete

*/

[29] Fix | Delete

public function __construct() {

[30] Fix | Delete

$this->setup_globals();

[31] Fix | Delete

$this->setup_actions();

[32] Fix | Delete

$this->setup_filters();

[33] Fix | Delete

}

[34] Fix | Delete

[35] Fix | Delete

/**

[36] Fix | Delete

* Set any global variables or class variables

[37] Fix | Delete

*

[38] Fix | Delete

* @since 1.4

[39] Fix | Delete

*/

[40] Fix | Delete

protected function setup_globals() {}

[41] Fix | Delete

[42] Fix | Delete

/**

[43] Fix | Delete

* Setup actions for methods in this class

[44] Fix | Delete

*

[45] Fix | Delete

* @since 1.4

[46] Fix | Delete

*/

[47] Fix | Delete

protected function setup_actions() {

[48] Fix | Delete

// Before a comment is posted.

[49] Fix | Delete

add_action( 'pre_comment_on_post', array( $this, 'allow_logged_out_user_to_comment_as_external' ) );

[50] Fix | Delete

[51] Fix | Delete

// After a comment is posted.

[52] Fix | Delete

add_action( 'comment_post', array( $this, 'set_comment_cookies' ) );

[53] Fix | Delete

}

[54] Fix | Delete

[55] Fix | Delete

/**

[56] Fix | Delete

* Setup filters for methods in this class

[57] Fix | Delete

*

[58] Fix | Delete

* @since 1.4

[59] Fix | Delete

*/

[60] Fix | Delete

protected function setup_filters() {

[61] Fix | Delete

add_filter( 'comments_array', array( $this, 'comments_array' ) );

[62] Fix | Delete

add_filter( 'preprocess_comment', array( $this, 'allow_logged_in_user_to_comment_as_guest' ), 0 );

[63] Fix | Delete

}

[64] Fix | Delete

[65] Fix | Delete

/**

[66] Fix | Delete

* Is this a Highlander POST request?

[67] Fix | Delete

* Optionally restrict to one or more credentials slug (facebook, ...)

[68] Fix | Delete

*

[69] Fix | Delete

* @param mixed ...$args Comments credentials slugs.

[70] Fix | Delete

* @return false|string false if it's not a Highlander POST request. The matching credentials slug if it is.

[71] Fix | Delete

*/

[72] Fix | Delete

public function is_highlander_comment_post( ...$args ) {

[73] Fix | Delete

[74] Fix | Delete

// phpcs:disable WordPress.Security.NonceVerification.Missing -- Nonce verification should happen in Jetpack_Comments::pre_comment_on_post(). Internal ref for details: p1645643468937519/1645189749.180299-slack-C02HQGKMFJ8

[75] Fix | Delete

if ( empty( $_POST['hc_post_as'] ) ) {

[76] Fix | Delete

return false;

[77] Fix | Delete

}

[78] Fix | Delete

$hc_post_as = wp_unslash( $_POST['hc_post_as'] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitized here by comparing against known values.

[79] Fix | Delete

// phpcs:enable WordPress.Security.NonceVerification.Missing

[80] Fix | Delete

[81] Fix | Delete

if ( $args ) {

[82] Fix | Delete

foreach ( $args as $id_source ) {

[83] Fix | Delete

if ( $id_source === $hc_post_as ) {

[84] Fix | Delete

return $id_source;

[85] Fix | Delete

}

[86] Fix | Delete

}

[87] Fix | Delete

return false;

[88] Fix | Delete

}

[89] Fix | Delete

return is_string( $hc_post_as ) && in_array( $hc_post_as, $this->id_sources, true ) ? $hc_post_as : false;

[90] Fix | Delete

}

[91] Fix | Delete

[92] Fix | Delete

/**

[93] Fix | Delete

* Signs an array of scalars with the self-hosted blog's Jetpack Token

[94] Fix | Delete

*

[95] Fix | Delete

* If parameter values are not scalars a WP_Error is returned, otherwise a keyed hash value is returned using the HMAC method.

[96] Fix | Delete

*

[97] Fix | Delete

* @param array $parameters Comment parameters.

[98] Fix | Delete

* @param string $key Key used for generating the HMAC variant of the message digest.

[99] Fix | Delete

* @return string HMAC

[100] Fix | Delete

*/

[101] Fix | Delete

public static function sign_remote_comment_parameters( $parameters, $key ) {

[102] Fix | Delete

unset(

[103] Fix | Delete

$parameters['sig'], // Don't sign the signature.

[104] Fix | Delete

$parameters['replytocom'] // This parameter is unsigned - it changes dynamically as the comment form moves from parent comment to parent comment.

[105] Fix | Delete

);

[106] Fix | Delete

[107] Fix | Delete

ksort( $parameters );

[108] Fix | Delete

[109] Fix | Delete

$signing = array();

[110] Fix | Delete

foreach ( $parameters as $k => $v ) {

[111] Fix | Delete

if ( ! is_scalar( $v ) ) {

[112] Fix | Delete

return new WP_Error( 'invalid_input', __( 'Invalid request', 'jetpack' ), array( 'status' => 400 ) );

[113] Fix | Delete

}

[114] Fix | Delete

[115] Fix | Delete

$signing[] = "{$k}={$v}";

[116] Fix | Delete

}

[117] Fix | Delete

[118] Fix | Delete

return hash_hmac( 'sha1', implode( ':', $signing ), $key );

[119] Fix | Delete

}

[120] Fix | Delete

[121] Fix | Delete

/**

[122] Fix | Delete

* Adds comment author email and whether the comment is approved to the comments array

[123] Fix | Delete

*

[124] Fix | Delete

* After commenting as a guest while logged in, the user needs to see both:

[125] Fix | Delete

* ( user_id = blah AND comment_approved = 0 )

[126] Fix | Delete

* and ( comment_author_email = blah AND comment_approved = 0 )

[127] Fix | Delete

* Core only does the first since the user is logged in, so this adds the second to the comments array.

[128] Fix | Delete

*

[129] Fix | Delete

* @param array $comments All comment data.

[130] Fix | Delete

* @return array A modified array of comment data.

[131] Fix | Delete

*/

[132] Fix | Delete

public function comments_array( $comments ) {

[133] Fix | Delete

global $wpdb, $post;

[134] Fix | Delete

[135] Fix | Delete

$commenter = $this->get_current_commenter();

[136] Fix | Delete

[137] Fix | Delete

if ( ! $commenter['user_id'] ) {

[138] Fix | Delete

return $comments;

[139] Fix | Delete

}

[140] Fix | Delete

[141] Fix | Delete

if ( ! $commenter['comment_author'] ) {

[142] Fix | Delete

return $comments;

[143] Fix | Delete

}

[144] Fix | Delete

[145] Fix | Delete

$in_moderation_comments = $wpdb->get_results(

[146] Fix | Delete

$wpdb->prepare(

[147] Fix | Delete

"SELECT * FROM `$wpdb->comments` WHERE `comment_post_ID` = %d AND `user_id` = 0 AND `comment_author` = %s AND `comment_author_email` = %s AND `comment_approved` = '0' ORDER BY `comment_date_gmt` /* Highlander_Comments_Base::comments_array() */",

[148] Fix | Delete

$post->ID,

[149] Fix | Delete

wp_specialchars_decode( $commenter['comment_author'], ENT_QUOTES ),

[150] Fix | Delete

$commenter['comment_author_email']

[151] Fix | Delete

)

[152] Fix | Delete

);

[153] Fix | Delete

[154] Fix | Delete

if ( ! $in_moderation_comments ) {

[155] Fix | Delete

return $comments;

[156] Fix | Delete

}

[157] Fix | Delete

[158] Fix | Delete

// @todo ZOMG this is a bad idea

[159] Fix | Delete

$comments = array_merge( $comments, $in_moderation_comments );

[160] Fix | Delete

usort( $comments, array( $this, 'sort_comments_by_comment_date_gmt' ) );

[161] Fix | Delete

[162] Fix | Delete

return $comments;

[163] Fix | Delete

}

[164] Fix | Delete

[165] Fix | Delete

/**

[166] Fix | Delete

* Comment sort comparator: comment_date_gmt

[167] Fix | Delete

*

[168] Fix | Delete

* @since 1.4

[169] Fix | Delete

* @param object $a The first comment to compare dates with.

[170] Fix | Delete

* @param object $b The second comment to compare dates with.

[171] Fix | Delete

* @return int

[172] Fix | Delete

*/

[173] Fix | Delete

public function sort_comments_by_comment_date_gmt( $a, $b ) {

[174] Fix | Delete

return $a->comment_date_gmt <=> $b->comment_date_gmt;

[175] Fix | Delete

}

[176] Fix | Delete

[177] Fix | Delete

/**

[178] Fix | Delete

* Get the current commenter's information from their cookie

[179] Fix | Delete

*

[180] Fix | Delete

* @since 1.4

[181] Fix | Delete

* @return array Commenters information from cookie

[182] Fix | Delete

*/

[183] Fix | Delete

protected function get_current_commenter() {

[184] Fix | Delete

// Defaults.

[185] Fix | Delete

$user_id = 0;

[186] Fix | Delete

$comment_author = '';

[187] Fix | Delete

$comment_author_email = '';

[188] Fix | Delete

$comment_author_url = '';

[189] Fix | Delete

[190] Fix | Delete

if ( isset( $_COOKIE[ 'comment_author_' . COOKIEHASH ] ) ) {

[191] Fix | Delete

$comment_author = sanitize_text_field( wp_unslash( $_COOKIE[ 'comment_author_' . COOKIEHASH ] ) );

[192] Fix | Delete

}

[193] Fix | Delete

[194] Fix | Delete

if ( isset( $_COOKIE[ 'comment_author_email_' . COOKIEHASH ] ) ) {

[195] Fix | Delete

$comment_author_email = sanitize_email( wp_unslash( $_COOKIE[ 'comment_author_email_' . COOKIEHASH ] ) );

[196] Fix | Delete

}

[197] Fix | Delete

[198] Fix | Delete

if ( isset( $_COOKIE[ 'comment_author_url_' . COOKIEHASH ] ) ) {

[199] Fix | Delete

$comment_author_url = esc_url_raw( wp_unslash( $_COOKIE[ 'comment_author_url_' . COOKIEHASH ] ) );

[200] Fix | Delete

}

[201] Fix | Delete

[202] Fix | Delete

if ( is_user_logged_in() ) {

[203] Fix | Delete

$user = wp_get_current_user();

[204] Fix | Delete

$user_id = $user->ID;

[205] Fix | Delete

}

[206] Fix | Delete

[207] Fix | Delete

return compact( 'comment_author', 'comment_author_email', 'comment_author_url', 'user_id' );

[208] Fix | Delete

}

[209] Fix | Delete

[210] Fix | Delete

/**

[211] Fix | Delete

* Allows a logged out user to leave a comment as a facebook/wp.com credentialed user.

[212] Fix | Delete

* Overrides WordPress' core comment_registration option to treat these commenters as "registered" (verified) users.

[213] Fix | Delete

*

[214] Fix | Delete

* @since 1.4

[215] Fix | Delete

*/

[216] Fix | Delete

public function allow_logged_out_user_to_comment_as_external() {

[217] Fix | Delete

// phpcs:ignore WordPress.WP.CapitalPDangit.MisspelledInText

[218] Fix | Delete

if ( ! $this->is_highlander_comment_post( 'facebook', 'wordpress' ) ) {

[219] Fix | Delete

return;

[220] Fix | Delete

}

[221] Fix | Delete

[222] Fix | Delete

add_filter( 'pre_option_comment_registration', '__return_zero' );

[223] Fix | Delete

add_filter( 'pre_option_require_name_email', '__return_zero' );

[224] Fix | Delete

}

[225] Fix | Delete

[226] Fix | Delete

/**

[227] Fix | Delete

* Allow a logged in user to post as a guest, or FB credentialed request.

[228] Fix | Delete

* Bypasses WordPress' core overrides that force a logged in user to comment as that user.

[229] Fix | Delete

* Respects comment_registration option.

[230] Fix | Delete

*

[231] Fix | Delete

* @since 1.4

[232] Fix | Delete

* @param array $comment_data All data for a specific comment.

[233] Fix | Delete

* @return array Modified comment data, or an error if the required fields or a valid email address are not entered.

[234] Fix | Delete

*/

[235] Fix | Delete

public function allow_logged_in_user_to_comment_as_guest( $comment_data ) {

[236] Fix | Delete

// Bail if user registration is allowed.

[237] Fix | Delete

if ( get_option( 'comment_registration' ) ) {

[238] Fix | Delete

return $comment_data;

[239] Fix | Delete

}

[240] Fix | Delete

[241] Fix | Delete

// Bail if user is not logged in or not a post request.

[242] Fix | Delete

if ( ! isset( $_SERVER['REQUEST_METHOD'] ) || 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) || ! is_user_logged_in() ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- simple comparison

[243] Fix | Delete

return $comment_data;

[244] Fix | Delete

}

[245] Fix | Delete

[246] Fix | Delete

// Bail if this is not a guest or external service credentialed request.

[247] Fix | Delete

if ( ! $this->is_highlander_comment_post( 'guest', 'facebook' ) ) {

[248] Fix | Delete

return $comment_data;

[249] Fix | Delete

}

[250] Fix | Delete

[251] Fix | Delete

$user = wp_get_current_user();

[252] Fix | Delete

[253] Fix | Delete

foreach ( array(

[254] Fix | Delete

'comment_author' => 'display_name',

[255] Fix | Delete

'comment_author_email' => 'user_email',

[256] Fix | Delete

'comment_author_url' => 'user_url',

[257] Fix | Delete

) as $comment_field => $user_field ) {

[258] Fix | Delete

if ( addslashes( $user->$user_field ) !== $comment_data[ $comment_field ] ) {

[259] Fix | Delete

return $comment_data; // some other plugin already did something funky.

[260] Fix | Delete

}

[261] Fix | Delete

}

[262] Fix | Delete

[263] Fix | Delete

// phpcs:disable WordPress.Security.NonceVerification.Missing -- Nonce verification should happen in Jetpack_Comments::pre_comment_on_post()

[264] Fix | Delete

// phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitization too

[265] Fix | Delete

if ( get_option( 'require_name_email' ) ) {

[266] Fix | Delete

if ( isset( $_POST['email'] ) && 6 > strlen( wp_unslash( $_POST['email'] ) ) || empty( $_POST['author'] ) ) {

[267] Fix | Delete

wp_die( esc_html__( 'Error: please fill the required fields (name, email).', 'jetpack' ), 400 );

[268] Fix | Delete

} elseif ( ! isset( $_POST['email'] ) || ! is_email( wp_unslash( $_POST['email'] ) ) ) {

[269] Fix | Delete

wp_die( esc_html__( 'Error: please enter a valid email address.', 'jetpack' ), 400 );

[270] Fix | Delete

}

[271] Fix | Delete

}

[272] Fix | Delete

[273] Fix | Delete

$author_change = false;

[274] Fix | Delete

foreach ( array(

[275] Fix | Delete

'comment_author' => 'author',

[276] Fix | Delete

'comment_author_email' => 'email',

[277] Fix | Delete

'comment_author_url' => 'url',

[278] Fix | Delete

) as $comment_field => $post_field ) {

[279] Fix | Delete

if ( ( ! isset( $_POST[ $post_field ] ) || $comment_data[ $comment_field ] !== $_POST[ $post_field ] ) && 'url' !== $post_field ) {

[280] Fix | Delete

$author_change = true;

[281] Fix | Delete

}

[282] Fix | Delete

$comment_data[ $comment_field ] = isset( $_POST[ $post_field ] ) ? wp_unslash( $_POST[ $post_field ] ) : null;

[283] Fix | Delete

}

[284] Fix | Delete

// phpcs:enable WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized

[285] Fix | Delete

[286] Fix | Delete

// Mark as guest comment if name or email were changed.

[287] Fix | Delete

if ( $author_change ) {

[288] Fix | Delete

$comment_data['user_ID'] = 0;

[289] Fix | Delete

$comment_data['user_id'] = $comment_data['user_ID'];

[290] Fix | Delete

}

[291] Fix | Delete

[292] Fix | Delete

return $comment_data;

[293] Fix | Delete

}

[294] Fix | Delete

[295] Fix | Delete

/**

[296] Fix | Delete

* Set the comment cookies or bail if comment is invalid

[297] Fix | Delete

*

[298] Fix | Delete

* @since 1.4

[299] Fix | Delete

* @param int $comment_id The comment ID.

[300] Fix | Delete

*/

[301] Fix | Delete

public function set_comment_cookies( $comment_id ) {

[302] Fix | Delete

// Get comment and bail if it's invalid somehow.

[303] Fix | Delete

$comment = get_comment( $comment_id );

[304] Fix | Delete

if ( empty( $comment ) || is_wp_error( $comment ) ) {

[305] Fix | Delete

return;

[306] Fix | Delete

}

[307] Fix | Delete

[308] Fix | Delete

$id_source = $this->is_highlander_comment_post();

[309] Fix | Delete

if ( empty( $id_source ) ) {

[310] Fix | Delete

return;

[311] Fix | Delete

}

[312] Fix | Delete

[313] Fix | Delete

// Set comment author cookies.

[314] Fix | Delete

// We don't set the cookies if they are logged in with WordPress.com because they already have a cookie set.

[315] Fix | Delete

// phpcs:ignore WordPress.WP.CapitalPDangit

[316] Fix | Delete

if ( 'wordpress' !== $id_source ) {

[317] Fix | Delete

// phpcs:disable WordPress.Security.NonceVerification -- Nonce verification should happen in Jetpack_Comments::pre_comment_on_post().

[318] Fix | Delete

$is_consenting_to_cookies = ( isset( $_POST['wp-comment-cookies-consent'] ) );

[319] Fix | Delete

[320] Fix | Delete

$cookie_options = array(

[321] Fix | Delete

'expires' => time() + apply_filters( 'comment_cookie_lifetime', YEAR_IN_SECONDS ),

[322] Fix | Delete

'path' => COOKIEPATH,

[323] Fix | Delete

'domain' => COOKIE_DOMAIN,

[324] Fix | Delete

'secure' => is_ssl(),

[325] Fix | Delete

'httponly' => true,

[326] Fix | Delete

);

[327] Fix | Delete

[328] Fix | Delete

// If there is no consent, remove any cookies that may have been set.

[329] Fix | Delete

if ( ( 'guest' === $id_source ) && ! $is_consenting_to_cookies ) {

[330] Fix | Delete

$cookie_options['expires'] = time() - YEAR_IN_SECONDS;

[331] Fix | Delete

}

[332] Fix | Delete

[333] Fix | Delete

// Set samesite to None if the request is from Jetpack iframe.

[334] Fix | Delete

// This is needed because it is considered third party.

[335] Fix | Delete

if ( isset( $_REQUEST['for'] ) && 'jetpack' === $_REQUEST['for'] ) {

[336] Fix | Delete

$cookie_options['samesite'] = 'None';

[337] Fix | Delete

}

[338] Fix | Delete

// phpcs:enable WordPress.Security.NonceVerification

[339] Fix | Delete

[340] Fix | Delete

// phpcs:disable Jetpack.Functions.SetCookie.MissingTrueHTTPOnly

[341] Fix | Delete

isset( $comment->comment_author ) ? setcookie( 'comment_author_' . COOKIEHASH, $comment->comment_author, $cookie_options ) : null;

[342] Fix | Delete

isset( $comment->comment_author_email ) ? setcookie( 'comment_author_email_' . COOKIEHASH, $comment->comment_author_email, $cookie_options ) : null;

[343] Fix | Delete

isset( $comment->comment_author_url ) ? setcookie( 'comment_author_url_' . COOKIEHASH, esc_url( $comment->comment_author_url ), $cookie_options ) : null;

[344] Fix | Delete

// phpcs:enable Jetpack.Functions.SetCookie.MissingTrueHTTPOnly

[345] Fix | Delete

}

[346] Fix | Delete

}

[347] Fix | Delete

[348] Fix | Delete

/**

[349] Fix | Delete

* Get an avatar from Photon

[350] Fix | Delete

*

[351] Fix | Delete

* @since 1.4

[352] Fix | Delete

* @param string $url The avatar URL.

[353] Fix | Delete

* @param int $size The avatar size.

[354] Fix | Delete

* @return string

[355] Fix | Delete

*/

[356] Fix | Delete

protected function photon_avatar( $url, $size ) {

[357] Fix | Delete

$size = (int) $size;

[358] Fix | Delete

[359] Fix | Delete

return Image_CDN_Core::cdn_url( $url, array( 'resize' => "$size,$size" ) );

[360] Fix | Delete

}

[361] Fix | Delete

}

[362] Fix | Delete

[363] Fix | Delete