[Summary view] [Print] [Text view]

   1  <?php
   2  /**
   3   * WordPress Comment Administration API.
   4   *
   5   * @package WordPress
   6   * @subpackage Administration
   7   * @since 2.3.0
   8   */
   9  
  10  /**
  11   * Determines if a comment exists based on author and date.
  12   *
  13   * For best performance, use `$timezone = 'gmt'`, which queries a field that is properly indexed. The default value
  14   * for `$timezone` is 'blog' for legacy reasons.
  15   *
  16   * @since 2.0.0
  17   * @since 4.4.0 Added the `$timezone` parameter.
  18   *
  19   * @global wpdb $wpdb WordPress database abstraction object.
  20   *
  21   * @param string $comment_author Author of the comment.
  22   * @param string $comment_date   Date of the comment.
  23   * @param string $timezone       Timezone. Accepts 'blog' or 'gmt'. Default 'blog'.
  24   * @return string|null Comment post ID on success.
  25   */
  26  function comment_exists( $comment_author, $comment_date, $timezone = 'blog' ) {
  27      global $wpdb;
  28  
  29      $date_field = 'comment_date';
  30      if ( 'gmt' === $timezone ) {
  31          $date_field = 'comment_date_gmt';
  32      }
  33  
  34      return $wpdb->get_var(
  35          $wpdb->prepare(
  36              "SELECT comment_post_ID FROM $wpdb->comments
  37              WHERE comment_author = %s AND $date_field = %s",
  38              stripslashes( $comment_author ),
  39              stripslashes( $comment_date )
  40          )
  41      );
  42  }
  43  
  44  /**
  45   * Updates a comment with values provided in $_POST.
  46   *
  47   * @since 2.0.0
  48   * @since 5.5.0 A return value was added.
  49   * @since 7.1.0 The comment parent can be updated via `$_POST['comment_parent']`.
  50   *
  51   * @return int|WP_Error The value 1 if the comment was updated, 0 if not updated.
  52   *                      A WP_Error object on failure.
  53   */
  54  function edit_comment() {
  55      if ( ! current_user_can( 'edit_comment', (int) $_POST['comment_ID'] ) ) {
  56          wp_die( __( 'Sorry, you are not allowed to edit comments on this post.' ) );
  57      }
  58  
  59      if ( isset( $_POST['newcomment_author'] ) ) {
  60          $_POST['comment_author'] = $_POST['newcomment_author'];
  61      }
  62      if ( isset( $_POST['newcomment_author_email'] ) ) {
  63          $_POST['comment_author_email'] = $_POST['newcomment_author_email'];
  64      }
  65      if ( isset( $_POST['newcomment_author_url'] ) ) {
  66          $_POST['comment_author_url'] = $_POST['newcomment_author_url'];
  67      }
  68      if ( isset( $_POST['comment_status'] ) ) {
  69          $_POST['comment_approved'] = $_POST['comment_status'];
  70      }
  71      if ( isset( $_POST['content'] ) ) {
  72          $_POST['comment_content'] = $_POST['content'];
  73      }
  74      if ( isset( $_POST['comment_ID'] ) ) {
  75          $_POST['comment_ID'] = (int) $_POST['comment_ID'];
  76      }
  77  
  78      if ( isset( $_POST['comment_parent'] ) ) {
  79          $comment_id     = (int) $_POST['comment_ID'];
  80          $comment_parent = (int) $_POST['comment_parent'];
  81  
  82          $_POST['comment_parent'] = $comment_parent;
  83  
  84          $comment = get_comment( $comment_id );
  85  
  86          if ( $comment && $comment_parent && $comment_parent !== (int) $comment->comment_parent ) {
  87              if ( ! get_option( 'thread_comments' ) ) {
  88                  return new WP_Error( 'comment_parent_invalid', __( 'The comment parent cannot be changed because threaded comments are disabled.' ) );
  89              }
  90  
  91              if ( $comment_parent === $comment_id ) {
  92                  return new WP_Error( 'comment_parent_invalid', __( 'A comment cannot be a reply to itself.' ) );
  93              }
  94  
  95              $parent              = get_comment( $comment_parent );
  96              $parent_status       = $parent ? wp_get_comment_status( $parent ) : false;
  97              $comment_status      = $_POST['comment_approved'] ?? $comment->comment_approved;
  98              $comment_is_approved = in_array( $comment_status, array( 1, '1', 'approve' ), true );
  99  
 100              // The parent must be a comment of the same type, on the same post, and publicly visible if the comment is approved.
 101              if (
 102                  ! $parent
 103                  || (int) $parent->comment_post_ID !== (int) $comment->comment_post_ID
 104                  || $parent->comment_type !== $comment->comment_type
 105                  || in_array( $parent_status, array( 'spam', 'trash' ), true )
 106                  || ( $comment_is_approved && 'approved' !== $parent_status )
 107              ) {
 108                  return new WP_Error( 'comment_parent_invalid', __( 'Invalid parent comment.' ) );
 109              }
 110  
 111              // Walk up the new parent's ancestors to prevent creating a threading loop.
 112              $ancestors    = array();
 113              $ancestor     = $parent;
 114              $parent_depth = 1;
 115  
 116              while ( $ancestor && $ancestor->comment_parent && ! isset( $ancestors[ $ancestor->comment_ID ] ) ) {
 117                  if ( (int) $ancestor->comment_parent === $comment_id ) {
 118                      return new WP_Error( 'comment_parent_invalid', __( 'A comment cannot be a reply to one of its own replies.' ) );
 119                  }
 120  
 121                  $ancestors[ $ancestor->comment_ID ] = true;
 122                  ++$parent_depth;
 123  
 124                  $ancestor = get_comment( $ancestor->comment_parent );
 125              }
 126  
 127              $max_thread_depth = (int) get_option( 'thread_comments_depth' );
 128  
 129              if ( $max_thread_depth ) {
 130                  /*
 131                   * The comment's replies move with it, so the whole subtree must stay within
 132                   * the maximum depth. Measure its height one level of replies at a time,
 133                   * stopping as soon as the subtree cannot fit, which also bounds the loop
 134                   * should the stored comment hierarchy contain a cycle.
 135                   */
 136                  $subtree_height = 1;
 137                  $level_ids      = array( $comment_id );
 138  
 139                  while ( $level_ids && $parent_depth + $subtree_height <= $max_thread_depth ) {
 140                      $level_ids = get_comments(
 141                          array(
 142                              'parent__in' => $level_ids,
 143                              'fields'     => 'ids',
 144                              'status'     => 'any',
 145                              'orderby'    => 'none',
 146                          )
 147                      );
 148  
 149                      if ( $level_ids ) {
 150                          ++$subtree_height;
 151                      }
 152                  }
 153  
 154                  if ( $parent_depth + $subtree_height > $max_thread_depth ) {
 155                      return new WP_Error( 'comment_parent_invalid', __( 'The comment cannot be moved there because it or its replies would exceed the maximum threading depth.' ) );
 156                  }
 157              }
 158          }
 159      }
 160  
 161      foreach ( array( 'aa', 'mm', 'jj', 'hh', 'mn' ) as $timeunit ) {
 162          if ( ! empty( $_POST[ 'hidden_' . $timeunit ] ) && $_POST[ 'hidden_' . $timeunit ] !== $_POST[ $timeunit ] ) {
 163              $_POST['edit_date'] = '1';
 164              break;
 165          }
 166      }
 167  
 168      if ( ! empty( $_POST['edit_date'] ) ) {
 169          $aa = $_POST['aa'];
 170          $mm = $_POST['mm'];
 171          $jj = $_POST['jj'];
 172          $hh = $_POST['hh'];
 173          $mn = $_POST['mn'];
 174          $ss = $_POST['ss'];
 175          $jj = ( $jj > 31 ) ? 31 : $jj;
 176          $hh = ( $hh > 23 ) ? $hh - 24 : $hh;
 177          $mn = ( $mn > 59 ) ? $mn - 60 : $mn;
 178          $ss = ( $ss > 59 ) ? $ss - 60 : $ss;
 179  
 180          $_POST['comment_date'] = "$aa-$mm-$jj $hh:$mn:$ss";
 181      }
 182  
 183      return wp_update_comment( $_POST, true );
 184  }
 185  
 186  /**
 187   * Returns a WP_Comment object based on comment ID.
 188   *
 189   * @since 2.0.0
 190   *
 191   * @param int $id ID of comment to retrieve.
 192   * @return WP_Comment|false Comment if found. False on failure.
 193   */
 194  function get_comment_to_edit( $id ) {
 195      $comment = get_comment( $id );
 196      if ( ! $comment ) {
 197          return false;
 198      }
 199  
 200      $comment->comment_ID      = (int) $comment->comment_ID;
 201      $comment->comment_post_ID = (int) $comment->comment_post_ID;
 202  
 203      $comment->comment_content = format_to_edit( $comment->comment_content );
 204      /**
 205       * Filters the comment content before editing.
 206       *
 207       * @since 2.0.0
 208       *
 209       * @param string $comment_content Comment content.
 210       */
 211      $comment->comment_content = apply_filters( 'comment_edit_pre', $comment->comment_content );
 212  
 213      $comment->comment_author       = format_to_edit( $comment->comment_author );
 214      $comment->comment_author_email = format_to_edit( $comment->comment_author_email );
 215      $comment->comment_author_url   = format_to_edit( $comment->comment_author_url );
 216      $comment->comment_author_url   = esc_url( $comment->comment_author_url );
 217  
 218      return $comment;
 219  }
 220  
 221  /**
 222   * Gets the number of pending comments on a post or posts.
 223   *
 224   * @since 2.3.0
 225   * @since 6.9.0 Exclude the 'note' comment type from the count.
 226   * @since 7.2.0 Exclude the 'reaction' comment type from the count.
 227   *
 228   * @global wpdb $wpdb WordPress database abstraction object.
 229   *
 230   * @param int|int[] $post_id Either a single Post ID or an array of Post IDs
 231   * @return int|int[] Either a single Posts pending comments as an int or an array of ints keyed on the Post IDs
 232   */
 233  function get_pending_comments_num( $post_id ) {
 234      global $wpdb;
 235  
 236      $single = false;
 237      if ( ! is_array( $post_id ) ) {
 238          $post_id_array = (array) $post_id;
 239          $single        = true;
 240      } else {
 241          $post_id_array = $post_id;
 242      }
 243      $post_id_array = array_map( 'intval', $post_id_array );
 244      $post_id_in    = "'" . implode( "', '", $post_id_array ) . "'";
 245  
 246      $pending = $wpdb->get_results( "SELECT comment_post_ID, COUNT(comment_ID) as num_comments FROM $wpdb->comments WHERE comment_post_ID IN ( $post_id_in ) AND comment_approved = '0' AND comment_type NOT IN ( 'note', 'reaction' ) GROUP BY comment_post_ID", ARRAY_A );
 247  
 248      if ( $single ) {
 249          if ( empty( $pending ) ) {
 250              return 0;
 251          } else {
 252              return absint( $pending[0]['num_comments'] );
 253          }
 254      }
 255  
 256      $pending_keyed = array();
 257  
 258      // Default to zero pending for all posts in request.
 259      foreach ( $post_id_array as $id ) {
 260          $pending_keyed[ $id ] = 0;
 261      }
 262  
 263      if ( ! empty( $pending ) ) {
 264          foreach ( $pending as $pend ) {
 265              $pending_keyed[ $pend['comment_post_ID'] ] = absint( $pend['num_comments'] );
 266          }
 267      }
 268  
 269      return $pending_keyed;
 270  }
 271  
 272  /**
 273   * Adds avatars to relevant places in admin.
 274   *
 275   * @since 2.5.0
 276   *
 277   * @param string $name User name.
 278   * @return string Avatar with the user name.
 279   */
 280  function floated_admin_avatar( $name ) {
 281      $avatar = get_avatar( get_comment(), 32, 'mystery' );
 282      return "$avatar $name";
 283  }
 284  
 285  /**
 286   * Enqueues comment shortcuts jQuery script.
 287   *
 288   * @since 2.7.0
 289   */
 290  function enqueue_comment_hotkeys_js() {
 291      if ( 'true' === get_user_option( 'comment_shortcuts' ) ) {
 292          wp_enqueue_script( 'jquery-table-hotkeys' );
 293      }
 294  }
 295  
 296  /**
 297   * Displays error message at bottom of comments.
 298   *
 299   * @since 2.5.0
 300   *
 301   * @param string $msg Error Message. Assumed to contain HTML and be sanitized.
 302   * @return never
 303   */
 304  function comment_footer_die( $msg ) {
 305      echo "<div class='wrap'><p>$msg</p></div>";
 306      require_once  ABSPATH . 'wp-admin/admin-footer.php';
 307      die;
 308  }