Changeset 47916 for branches/5.3

Timestamp:

06/06/2020 09:51:22 AM (6 years ago)

Author:

SergeyBiryukov

Message:

Comments: Ensure that unmoderated comments won't be search indexed.

After a comment is submitted, only allow a brief window where the comment is live on the site.

Props jonkolbert, ayeshrajans, Asif2BD, peterwilsoncc, imath, audrasjb, jonoaldersonwp, whyisjake, SergeyBiryukov.
Merges [47887] and [47889] to the 5.3 branch.
See #49956.

Location:

branches/5.3

Files:

• . (modified) (1 prop)
• src/wp-comments-post.php (modified) (1 diff)
• src/wp-includes/class-walker-comment.php (modified) (10 diffs)
• src/wp-includes/class-wp-comment-query.php (modified) (1 diff)
• src/wp-includes/class-wp.php (modified) (1 diff)
• src/wp-includes/comment-template.php (modified) (1 diff)
• src/wp-includes/comment.php (modified) (1 diff)

branches/5.3/src/wp-comments-post.php

@@ -57 +57 @@
 $location = empty( $_POST['redirect_to'] ) ? get_comment_link( $comment ) : $_POST['redirect_to'] . '#comment-' . $comment->comment_ID;
 
-// Add specific query arguments to display the awaiting moderation message.
-if ( 'unapproved' === wp_get_comment_status( $comment ) && ! empty( $comment->comment_author_email ) ) {
+// If user didn't consent to cookies, add specific query arguments to display the awaiting moderation message.
+if ( ! $cookies_consent && 'unapproved' === wp_get_comment_status( $comment ) && ! empty( $comment->comment_author_email ) ) {
         $location = add_query_arg(
                 array(

branches/5.3/src/wp-includes/class-walker-comment.php

@@ -182 +182 @@
                 }
 
-                if ( ( 'pingback' == $comment->comment_type || 'trackback' == $comment->comment_type ) && $args['short_ping'] ) {
+                if ( 'comment' === $comment->comment_type ) {
+                        add_filter( 'comment_text', array( $this, 'filter_comment_text' ), 40, 2 );
+                }
+
+                if ( ( 'pingback' === $comment->comment_type || 'trackback' === $comment->comment_type ) && $args['short_ping'] ) {
                         ob_start();
                         $this->ping( $comment, $depth, $args );
@@ -195 +199 @@
                         $output .= ob_get_clean();
                 }
+
+                if ( 'comment' === $comment->comment_type ) {
+                        remove_filter( 'comment_text', array( $this, 'filter_comment_text' ), 40, 2 );
+                }
         }
 
@@ -246 +254 @@
 
         /**
+         * Filters the comment text.
+         *
+         * Removes links from the pending comment's text if the commenter did not consent
+         * to the comment cookies.
+         *
+         * @since 5.4.2
+         *
+         * @param string          $comment_text Text of the current comment.
+         * @param WP_Comment|null $comment      The comment object. Null if not found.
+         * @return string Filtered text of the current comment.
+         */
+        public function filter_comment_text( $comment_text, $comment ) {
+                $commenter          = wp_get_current_commenter();
+                $show_pending_links = ! empty( $commenter['comment_author'] );
+
+                if ( $comment && '0' == $comment->comment_approved && ! $show_pending_links ) {
+                        $comment_text = wp_kses( $comment_text, array() );
+                }
+
+                return $comment_text;
+        }
+
+        /**
          * Outputs a single comment.
          *
@@ -265 +296 @@
                 }
 
-                $commenter = wp_get_current_commenter();
+                $commenter          = wp_get_current_commenter();
+                $show_pending_links = isset( $commenter['comment_author'] ) && $commenter['comment_author'];
+
                 if ( $commenter['comment_author_email'] ) {
                         $moderation_note = __( 'Your comment is awaiting moderation.' );
@@ -271 +304 @@
                         $moderation_note = __( 'Your comment is awaiting moderation. This is a preview, your comment will be visible after it has been approved.' );
                 }
-
                 ?>
                 <<?php echo $tag; ?> <?php comment_class( $this->has_children ? 'parent' : '', $comment ); ?> id="comment-<?php comment_ID(); ?>">
@@ -280 +312 @@
                         <?php
                         if ( 0 != $args['avatar_size'] ) {
-                                echo get_avatar( $comment, $args['avatar_size'] );}
+                                echo get_avatar( $comment, $args['avatar_size'] );
+                        }
                         ?>
                         <?php
-                                printf(
-                                        /* translators: %s: Comment author link. */
-                                        __( '%s <span class="says">says:</span>' ),
-                                        sprintf( '<cite class="fn">%s</cite>', get_comment_author_link( $comment ) )
-                                );
+                        $comment_author = get_comment_author_link( $comment );
+
+                        if ( '0' == $comment->comment_approved && ! $show_pending_links ) {
+                                $comment_author = get_comment_author( $comment );
+                        }
+
+                        printf(
+                                /* translators: %s: Comment author link. */
+                                __( '%s <span class="says">says:</span>' ),
+                                sprintf( '<cite class="fn">%s</cite>', $comment_author )
+                        );
                         ?>
                 </div>
@@ -355 +394 @@
                 $tag = ( 'div' === $args['style'] ) ? 'div' : 'li';
 
-                $commenter = wp_get_current_commenter();
+                $commenter          = wp_get_current_commenter();
+                $show_pending_links = ! empty( $commenter['comment_author'] );
+
                 if ( $commenter['comment_author_email'] ) {
                         $moderation_note = __( 'Your comment is awaiting moderation.' );
@@ -361 +402 @@
                         $moderation_note = __( 'Your comment is awaiting moderation. This is a preview, your comment will be visible after it has been approved.' );
                 }
-
                 ?>
                 <<?php echo $tag; ?> id="comment-<?php comment_ID(); ?>" <?php comment_class( $this->has_children ? 'parent' : '', $comment ); ?>>
@@ -373 +413 @@
                                                 ?>
                                                 <?php
-                                                        printf(
-                                                                /* translators: %s: Comment author link. */
-                                                                __( '%s <span class="says">says:</span>' ),
-                                                                sprintf( '<b class="fn">%s</b>', get_comment_author_link( $comment ) )
-                                                        );
+                                                $comment_author = get_comment_author_link( $comment );
+
+                                                if ( '0' == $comment->comment_approved && ! $show_pending_links ) {
+                                                        $comment_author = get_comment_author( $comment );
+                                                }
+
+                                                printf(
+                                                        /* translators: %s: Comment author link. */
+                                                        __( '%s <span class="says">says:</span>' ),
+                                                        sprintf( '<b class="fn">%s</b>', $comment_author )
+                                                );
                                                 ?>
                                         </div><!-- .comment-author -->
@@ -403 +449 @@
 
                                 <?php
-                                comment_reply_link(
-                                        array_merge(
-                                                $args,
-                                                array(
-                                                        'add_below' => 'div-comment',
-                                                        'depth'     => $depth,
-                                                        'max_depth' => $args['max_depth'],
-                                                        'before'    => '<div class="reply">',
-                                                        'after'     => '</div>',
+                                if ( '1' == $comment->comment_approved || $show_pending_links ) {
+                                        comment_reply_link(
+                                                array_merge(
+                                                        $args,
+                                                        array(
+                                                                'add_below' => 'div-comment',
+                                                                'depth'     => $depth,
+                                                                'max_depth' => $args['max_depth'],
+                                                                'before'    => '<div class="reply">',
+                                                                'after'     => '</div>',
+                                                        )
                                                 )
-                                        )
-                                );
+                                        );
+                                }
                                 ?>
                         </article><!-- .comment-body -->

branches/5.3/src/wp-includes/class-wp-comment-query.php

@@ -554 +554 @@
                                 if ( is_numeric( $unapproved_identifier ) ) {
                                         $approved_clauses[] = $wpdb->prepare( "( user_id = %d AND comment_approved = '0' )", $unapproved_identifier );
-
+                                } else {
                                         // Otherwise we match against email addresses.
-                                } else {
-                                        $approved_clauses[] = $wpdb->prepare( "( comment_author_email = %s AND comment_approved = '0' )", $unapproved_identifier );
+                                        if ( ! empty( $_GET['unapproved'] ) && ! empty( $_GET['moderation-hash'] ) ) {
+                                                // Only include requested comment.
+                                                $approved_clauses[] = $wpdb->prepare( "( comment_author_email = %s AND comment_approved = '0' AND comment_ID = %d )", $unapproved_identifier, (int) $_GET['unapproved'] );
+                                        } else {
+                                                // Include all of the author's unapproved comments.
+                                                $approved_clauses[] = $wpdb->prepare( "( comment_author_email = %s AND comment_approved = '0' )", $unapproved_identifier );
+                                        }
                                 }
                         }

branches/5.3/src/wp-includes/class-wp.php

@@ -404 +404 @@
                 if ( is_user_logged_in() ) {
                         $headers = array_merge( $headers, wp_get_nocache_headers() );
+                } elseif ( ! empty( $_GET['unapproved'] ) && ! empty( $_GET['moderation-hash'] ) ) {
+                        // Unmoderated comments are only visible for one minute via the moderation hash.
+                        $headers['Expires']       = gmdate( 'D, d M Y H:i:s', time() + MINUTE_IN_SECONDS );
+                        $headers['Cache-Control'] = 'max-age=60, must-revalidate';
                 }
                 if ( ! empty( $this->query_vars['error'] ) ) {

branches/5.3/src/wp-includes/comment-template.php

@@ -998 +998 @@
          *
          * @param string          $comment_text Text of the current comment.
-         * @param WP_Comment|null $comment      The comment object.
+         * @param WP_Comment|null $comment      The comment object. Null if not found.
          * @param array           $args         An array of arguments.
          */

branches/5.3/src/wp-includes/comment.php

@@ -1832 +1832 @@
 
                 if ( $comment && hash_equals( $_GET['moderation-hash'], wp_hash( $comment->comment_date_gmt ) ) ) {
-                        $commenter_email = $comment->comment_author_email;
+                        // The comment will only be viewable by the comment author for 1 minute.
+                        $comment_preview_expires = strtotime( $comment->comment_date_gmt . '+1 minute' );
+
+                        if ( time() < $comment_preview_expires ) {
+                                $commenter_email = $comment->comment_author_email;
+                        }
                 }
         }