[Summary view] [Print] [Text view]

   1  <?php
   2  
   3  function check_comment($author, $email, $url, $comment, $user_ip, $user_agent, $comment_type) {
   4      global $wpdb;
   5  
   6      if (1 == get_settings('comment_moderation')) return false; // If moderation is set to manual
   7  
   8      if ( (count(explode('http:', $comment)) - 1) >= get_settings('comment_max_links') )
   9          return false; // Check # of external links
  10  
  11      $mod_keys = trim( get_settings('moderation_keys') );
  12      if ( !empty($mod_keys) ) {
  13          $words = explode("\n", $mod_keys );
  14  
  15          foreach ($words as $word) {
  16              $word = trim($word);
  17  
  18              // Skip empty lines
  19              if (empty($word)) { continue; }
  20  
  21              // Do some escaping magic so that '#' chars in the 
  22              // spam words don't break things:
  23              $word = preg_quote($word, '#');
  24  
  25              $pattern = "#$word#i"; 
  26              if ( preg_match($pattern, $author) ) return false;
  27              if ( preg_match($pattern, $email) ) return false;
  28              if ( preg_match($pattern, $url) ) return false;
  29              if ( preg_match($pattern, $comment) ) return false;
  30              if ( preg_match($pattern, $user_ip) ) return false;
  31              if ( preg_match($pattern, $user_agent) ) return false;
  32          }
  33      }
  34  
  35      // Comment whitelisting:
  36      if ( 1 == get_settings('comment_whitelist')) {
  37          if ( 'trackback' == $comment_type || 'pingback' == $comment_type ) { // check if domain is in blogroll
  38              $uri = parse_url($url);
  39              $domain = $uri['host'];
  40              $uri = parse_url( get_option('home') );
  41              $home_domain = $uri['host'];
  42              if ( $wpdb->get_var("SELECT link_id FROM $wpdb->links WHERE link_url LIKE ('%$domain%') LIMIT 1") || $domain == $home_domain )
  43                  return true;
  44              else
  45                  return false;
  46          } elseif( $author != '' && $email != '' ) {
  47              $ok_to_comment = $wpdb->get_var("SELECT comment_approved FROM $wpdb->comments WHERE comment_author = '$author' AND comment_author_email = '$email' and comment_approved = '1' LIMIT 1");
  48              if ( ( 1 == $ok_to_comment ) &&
  49                  ( empty($mod_keys) || false === strpos( $email, $mod_keys) ) )
  50                      return true;
  51              else
  52                  return false;
  53          } else {
  54              return false;
  55          }
  56      }
  57  
  58      return true;
  59  }
  60  
  61  function get_approved_comments($post_id) {
  62      global $wpdb;
  63  
  64      $post_id = (int) $post_id;
  65      return $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = '$post_id' AND comment_approved = '1' ORDER BY comment_date");
  66  }
  67  
  68  // Retrieves comment data given a comment ID or comment object.
  69  // Handles comment caching.
  70  function &get_comment(&$comment, $output = OBJECT) {
  71      global $comment_cache, $wpdb;
  72  
  73      if ( empty($comment) )
  74          return null;
  75  
  76      if ( is_object($comment) ) {
  77          if ( !isset($comment_cache[$comment->comment_ID]) )
  78              $comment_cache[$comment->comment_ID] = &$comment;
  79          $_comment = & $comment_cache[$comment->comment_ID];
  80      } else {
  81          if ( !isset($comment_cache[$comment]) ) {
  82              $_comment = $wpdb->get_row("SELECT * FROM $wpdb->comments WHERE comment_ID = '$comment' LIMIT 1");
  83              $comment_cache[$comment->comment_ID] = & $_comment;
  84          } else {
  85              $_comment = & $comment_cache[$comment];
  86          }
  87      }
  88  
  89      if ( $output == OBJECT ) {
  90          return $_comment;
  91      } elseif ( $output == ARRAY_A ) {
  92          return get_object_vars($_comment);
  93      } elseif ( $output == ARRAY_N ) {
  94          return array_values(get_object_vars($_comment));
  95      } else {
  96          return $_comment;
  97      }
  98  }
  99  
 100  // Deprecate in favor of get_comment()?
 101  function get_commentdata( $comment_ID, $no_cache = 0, $include_unapproved = false ) { // less flexible, but saves DB queries
 102      global $postc, $id, $commentdata, $wpdb;
 103      if ($no_cache) {
 104          $query = "SELECT * FROM $wpdb->comments WHERE comment_ID = '$comment_ID'";
 105          if (false == $include_unapproved) {
 106              $query .= " AND comment_approved = '1'";
 107          }
 108              $myrow = $wpdb->get_row($query, ARRAY_A);
 109      } else {
 110          $myrow['comment_ID'] = $postc->comment_ID;
 111          $myrow['comment_post_ID'] = $postc->comment_post_ID;
 112          $myrow['comment_author'] = $postc->comment_author;
 113          $myrow['comment_author_email'] = $postc->comment_author_email;
 114          $myrow['comment_author_url'] = $postc->comment_author_url;
 115          $myrow['comment_author_IP'] = $postc->comment_author_IP;
 116          $myrow['comment_date'] = $postc->comment_date;
 117          $myrow['comment_content'] = $postc->comment_content;
 118          $myrow['comment_karma'] = $postc->comment_karma;
 119          $myrow['comment_approved'] = $postc->comment_approved;
 120          $myrow['comment_type'] = $postc->comment_type;
 121      }
 122      return $myrow;
 123  }
 124  
 125  function get_lastcommentmodified($timezone = 'server') {
 126      global $cache_lastcommentmodified, $pagenow, $wpdb;
 127      $add_seconds_blog = get_settings('gmt_offset') * 3600;
 128      $add_seconds_server = date('Z');
 129      $now = current_time('mysql', 1);
 130      if ( !isset($cache_lastcommentmodified[$timezone]) ) {
 131          switch(strtolower($timezone)) {
 132              case 'gmt':
 133                  $lastcommentmodified = $wpdb->get_var("SELECT comment_date_gmt FROM $wpdb->comments WHERE comment_date_gmt <= '$now' ORDER BY comment_date_gmt DESC LIMIT 1");
 134                  break;
 135              case 'blog':
 136                  $lastcommentmodified = $wpdb->get_var("SELECT comment_date FROM $wpdb->comments WHERE comment_date_gmt <= '$now' ORDER BY comment_date_gmt DESC LIMIT 1");
 137                  break;
 138              case 'server':
 139                  $lastcommentmodified = $wpdb->get_var("SELECT DATE_ADD(comment_date_gmt, INTERVAL '$add_seconds_server' SECOND) FROM $wpdb->comments WHERE comment_date_gmt <= '$now' ORDER BY comment_date_gmt DESC LIMIT 1");
 140                  break;
 141          }
 142          $cache_lastcommentmodified[$timezone] = $lastcommentmodified;
 143      } else {
 144          $lastcommentmodified = $cache_lastcommentmodified[$timezone];
 145      }
 146      return $lastcommentmodified;
 147  }
 148  
 149  function sanitize_comment_cookies() {
 150      if ( isset($_COOKIE['comment_author_'.COOKIEHASH]) ) {
 151          $comment_author = apply_filters('pre_comment_author_name', $_COOKIE['comment_author_'.COOKIEHASH]);
 152          $comment_author = stripslashes($comment_author);
 153          $comment_author = wp_specialchars($comment_author, true);
 154          $_COOKIE['comment_author_'.COOKIEHASH] = $comment_author;
 155      }
 156  
 157      if ( isset($_COOKIE['comment_author_email_'.COOKIEHASH]) ) {
 158          $comment_author_email = apply_filters('pre_comment_author_email', $_COOKIE['comment_author_email_'.COOKIEHASH]);
 159          $comment_author_email = stripslashes($comment_author_email);
 160          $comment_author_email = wp_specialchars($comment_author_email, true);    
 161          $_COOKIE['comment_author_email_'.COOKIEHASH] = $comment_author_email;
 162      }
 163  
 164      if ( isset($_COOKIE['comment_author_url_'.COOKIEHASH]) ) {
 165          $comment_author_url = apply_filters('pre_comment_author_url', $_COOKIE['comment_author_url_'.COOKIEHASH]);
 166          $comment_author_url = stripslashes($comment_author_url);
 167          $comment_author_url = wp_specialchars($comment_author_url, true);
 168          $_COOKIE['comment_author_url_'.COOKIEHASH] = $comment_author_url;
 169      }
 170  }
 171  
 172  function wp_allow_comment($commentdata) {
 173      global $wpdb;
 174      extract($commentdata);
 175  
 176      $comment_user_domain = apply_filters('pre_comment_user_domain', gethostbyaddr($comment_author_IP) );
 177  
 178      // Simple duplicate check
 179      $dupe = "SELECT comment_ID FROM $wpdb->comments WHERE comment_post_ID = '$comment_post_ID' AND ( comment_author = '$comment_author' ";
 180      if ( $comment_author_email )
 181          $dupe .= "OR comment_author_email = '$comment_author_email' ";
 182      $dupe .= ") AND comment_content = '$comment_content' LIMIT 1";
 183      if ( $wpdb->get_var($dupe) )
 184          wp_die( __('Duplicate comment detected; it looks as though you\'ve already said that!') );
 185  
 186      // Simple flood-protection
 187      if ( $lasttime = $wpdb->get_var("SELECT comment_date_gmt FROM $wpdb->comments WHERE comment_author_IP = '$comment_author_IP' OR comment_author_email = '$comment_author_email' ORDER BY comment_date DESC LIMIT 1") ) {
 188          $time_lastcomment = mysql2date('U', $lasttime);
 189          $time_newcomment  = mysql2date('U', $comment_date_gmt);
 190          if ( ($time_newcomment - $time_lastcomment) < 15 ) {
 191              do_action('comment_flood_trigger', $time_lastcomment, $time_newcomment);
 192              wp_die( __('Sorry, you can only post a new comment once every 15 seconds. Slow down cowboy.') );
 193          }
 194      }
 195  
 196      if ( $user_id ) {
 197          $userdata = get_userdata($user_id);
 198          $user = new WP_User($user_id);
 199          $post_author = $wpdb->get_var("SELECT post_author FROM $wpdb->posts WHERE ID = '$comment_post_ID' LIMIT 1");
 200      }
 201  
 202      // The author and the admins get respect.
 203      if ( $userdata && ( $user_id == $post_author || $user->has_cap('level_9') ) ) {
 204          $approved = 1;
 205      }
 206  
 207      // Everyone else's comments will be checked.
 208      else {
 209          if ( check_comment($comment_author, $comment_author_email, $comment_author_url, $comment_content, $comment_author_IP, $comment_agent, $comment_type) )
 210              $approved = 1;
 211          else
 212              $approved = 0;
 213          if ( wp_blacklist_check($comment_author, $comment_author_email, $comment_author_url, $comment_content, $comment_author_IP, $comment_agent) )
 214              $approved = 'spam';
 215      }
 216  
 217      $approved = apply_filters('pre_comment_approved', $approved);
 218      return $approved;
 219  }
 220  
 221  function wp_blacklist_check($author, $email, $url, $comment, $user_ip, $user_agent) {
 222      global $wpdb;
 223  
 224      do_action('wp_blacklist_check', $author, $email, $url, $comment, $user_ip, $user_agent);
 225  
 226      if ( preg_match_all('/&#(\d+);/', $comment . $author . $url, $chars) ) {
 227          foreach ($chars[1] as $char) {
 228              // If it's an encoded char in the normal ASCII set, reject
 229              if ( 38 == $char )
 230                  continue; // Unless it's &
 231              if ($char < 128)
 232                  return true;
 233          }
 234      }
 235  
 236      $mod_keys = trim( get_settings('blacklist_keys') );
 237      if ('' == $mod_keys )
 238          return false; // If moderation keys are empty
 239      $words = explode("\n", $mod_keys );
 240  
 241      foreach ($words as $word) {
 242          $word = trim($word);
 243  
 244          // Skip empty lines
 245          if ( empty($word) ) { continue; }
 246  
 247          // Do some escaping magic so that '#' chars in the 
 248          // spam words don't break things:
 249          $word = preg_quote($word, '#');
 250  
 251          $pattern = "#$word#i"; 
 252          if ( preg_match($pattern, $author    ) ) return true;
 253          if ( preg_match($pattern, $email     ) ) return true;
 254          if ( preg_match($pattern, $url       ) ) return true;
 255          if ( preg_match($pattern, $comment   ) ) return true;
 256          if ( preg_match($pattern, $user_ip   ) ) return true;
 257          if ( preg_match($pattern, $user_agent) ) return true;
 258      }
 259  
 260      if ( isset($_SERVER['REMOTE_ADDR']) ) {
 261          if ( wp_proxy_check($_SERVER['REMOTE_ADDR']) ) return true;
 262      }
 263  
 264      return false;
 265  }
 266  
 267  function wp_delete_comment($comment_id) {
 268      global $wpdb;
 269      do_action('delete_comment', $comment_id);
 270  
 271      $comment = get_comment($comment_id);
 272  
 273      if ( ! $wpdb->query("DELETE FROM $wpdb->comments WHERE comment_ID='$comment_id' LIMIT 1") )
 274          return false;
 275  
 276      $post_id = $comment->comment_post_ID;
 277      if ( $post_id && $comment->comment_approved == 1 )
 278          wp_update_comment_count($post_id);
 279  
 280      do_action('wp_set_comment_status', $comment_id, 'delete');
 281      return true;
 282  }
 283  
 284  function wp_get_comment_status($comment_id) {
 285      global $wpdb;
 286  
 287      $result = $wpdb->get_var("SELECT comment_approved FROM $wpdb->comments WHERE comment_ID='$comment_id' LIMIT 1");
 288      if ($result == NULL) {
 289          return 'deleted';
 290      } else if ($result == '1') {
 291          return 'approved';
 292      } else if ($result == '0') {
 293          return 'unapproved';
 294      } else if ($result == 'spam') {
 295          return 'spam';
 296      } else {
 297          return false;
 298      }
 299  }
 300  
 301  function wp_get_current_commenter() {
 302      // Cookies should already be sanitized.
 303  
 304      $comment_author = '';
 305      if ( isset($_COOKIE['comment_author_'.COOKIEHASH]) )
 306          $comment_author = $_COOKIE['comment_author_'.COOKIEHASH];
 307  
 308      $comment_author_email = '';
 309      if ( isset($_COOKIE['comment_author_email_'.COOKIEHASH]) )
 310          $comment_author_email = $_COOKIE['comment_author_email_'.COOKIEHASH];
 311  
 312      $comment_author_url = '';
 313      if ( isset($_COOKIE['comment_author_url_'.COOKIEHASH]) )
 314          $comment_author_url = $_COOKIE['comment_author_url_'.COOKIEHASH];
 315  
 316      return compact('comment_author', 'comment_author_email', 'comment_author_url');
 317  }
 318  
 319  function wp_insert_comment($commentdata) {
 320      global $wpdb;
 321      extract($commentdata);
 322  
 323      if ( ! isset($comment_author_IP) )
 324          $comment_author_IP = preg_replace( '/[^0-9., ]/', '',$_SERVER['REMOTE_ADDR'] );
 325      if ( ! isset($comment_date) )
 326          $comment_date = current_time('mysql');
 327      if ( ! isset($comment_date_gmt) )
 328          $comment_date_gmt = gmdate('Y-m-d H:i:s', strtotime($comment_date) );
 329      if ( ! isset($comment_parent) )
 330          $comment_parent = 0;
 331      if ( ! isset($comment_approved) )
 332          $comment_approved = 1;
 333      if ( ! isset($user_id) )
 334          $user_id = 0;
 335  
 336      $result = $wpdb->query("INSERT INTO $wpdb->comments 
 337      (comment_post_ID, comment_author, comment_author_email, comment_author_url, comment_author_IP, comment_date, comment_date_gmt, comment_content, comment_approved, comment_agent, comment_type, comment_parent, user_id)
 338      VALUES 
 339      ('$comment_post_ID', '$comment_author', '$comment_author_email', '$comment_author_url', '$comment_author_IP', '$comment_date', '$comment_date_gmt', '$comment_content', '$comment_approved', '$comment_agent', '$comment_type', '$comment_parent', '$user_id')
 340      ");
 341  
 342      $id = $wpdb->insert_id;
 343  
 344      if ( $comment_approved == 1)
 345          wp_update_comment_count($comment_post_ID);
 346  
 347      return $id;
 348  }
 349  
 350  function wp_filter_comment($commentdata) {
 351      $commentdata['user_id']              = apply_filters('pre_user_id', $commentdata['user_ID']);
 352      $commentdata['comment_agent']        = apply_filters('pre_comment_user_agent', $commentdata['comment_agent']);
 353      $commentdata['comment_author']       = apply_filters('pre_comment_author_name', $commentdata['comment_author']);
 354      $commentdata['comment_content']      = apply_filters('pre_comment_content', $commentdata['comment_content']);
 355      $commentdata['comment_author_IP']    = apply_filters('pre_comment_user_ip', $commentdata['comment_author_IP']);
 356      $commentdata['comment_author_url']   = apply_filters('pre_comment_author_url', $commentdata['comment_author_url']);
 357      $commentdata['comment_author_email'] = apply_filters('pre_comment_author_email', $commentdata['comment_author_email']);
 358      $commentdata['filtered'] = true;
 359      return $commentdata;
 360  }
 361  
 362  function wp_new_comment( $commentdata ) {
 363      $commentdata = apply_filters('preprocess_comment', $commentdata);
 364  
 365      $commentdata['comment_post_ID'] = (int) $commentdata['comment_post_ID'];
 366      $commentdata['user_ID']         = (int) $commentdata['user_ID'];
 367  
 368      $commentdata['comment_author_IP'] = preg_replace( '/[^0-9., ]/', '',$_SERVER['REMOTE_ADDR'] );
 369      $commentdata['comment_agent']     = $_SERVER['HTTP_USER_AGENT'];
 370  
 371      $commentdata['comment_date']     = current_time('mysql');
 372      $commentdata['comment_date_gmt'] = current_time('mysql', 1);
 373  
 374  
 375      $commentdata = wp_filter_comment($commentdata);
 376  
 377      $commentdata['comment_approved'] = wp_allow_comment($commentdata);
 378  
 379      $comment_ID = wp_insert_comment($commentdata);
 380  
 381      do_action('comment_post', $comment_ID, $commentdata['comment_approved']);
 382  
 383      if ( 'spam' !== $commentdata['comment_approved'] ) { // If it's spam save it silently for later crunching
 384          if ( '0' == $commentdata['comment_approved'] )
 385              wp_notify_moderator($comment_ID);
 386  
 387          $post = &get_post($commentdata['comment_post_ID']); // Don't notify if it's your own comment
 388  
 389          if ( get_settings('comments_notify') && $commentdata['comment_approved'] && $post->post_author != $commentdata['user_ID'] )
 390              wp_notify_postauthor($comment_ID, $commentdata['comment_type']);
 391      }
 392  
 393      return