Projects : mp-wp : mp-wp_genesis

mp-wp/wp-comments-post.php

Dir - Raw

1<?php
2/**
3 * Handles Comment Post to WordPress and prevents duplicate comment posting.
4 *
5 * @package WordPress
6 */
7
8if ( 'POST' != $_SERVER['REQUEST_METHOD'] ) {
9 header('Allow: POST');
10 header('HTTP/1.1 405 Method Not Allowed');
11 header('Content-Type: text/plain');
12 exit;
13}
14
15/** Sets up the WordPress Environment. */
16require( dirname(__FILE__) . '/wp-load.php' );
17
18nocache_headers();
19
20$comment_post_ID = (int) $_POST['comment_post_ID'];
21
22$status = $wpdb->get_row( $wpdb->prepare("SELECT post_status, comment_status FROM $wpdb->posts WHERE ID = %d", $comment_post_ID) );
23
24if ( empty($status->comment_status) ) {
25 do_action('comment_id_not_found', $comment_post_ID);
26 exit;
27} elseif ( !comments_open($comment_post_ID) ) {
28 do_action('comment_closed', $comment_post_ID);
29 wp_die( __('Sorry, comments are closed for this item.') );
30} elseif ( in_array($status->post_status, array('draft', 'pending') ) ) {
31 do_action('comment_on_draft', $comment_post_ID);
32 exit;
33}
34// These get changed for avoiding spammers.
35
36$suffix = substr(md5(date('Y-m-d').$_SERVER['REMOTE_ADDR']).$_SERVER['HTTP_USER_AGENT'],6,7);
37
38
39$comment_author = ( isset($_POST['author'.$suffix]) ) ? trim(strip_tags($_POST['author'.$suffix])) : null;
40$comment_author_email = ( isset($_POST['email'.$suffix]) ) ? trim($_POST['email'.$suffix]) : null;
41$comment_author_url = ( isset($_POST['url'.$suffix]) ) ? trim($_POST['url'.$suffix]) : null;
42$comment_content = ( isset($_POST['comment']) ) ? trim(strip_tags($_POST['comment'],"<a><em><strong><i><b><blockquote><ul><ol><li>")) : null;
43$comment_checks = ( isset($_POST['comment_post_time']) ) ? trim($_POST['comment_post_time']) : null;
44$comment_check = explode ("-",$comment_checks);
45$comment_time = $comment_check[0];
46$comment_IP = $comment_check[1];
47
48// Special handle for idiots.
49/*
50if (($comment_author_email == "icriss78@yahoo.com")||($comment_author_url == "http://blog.matinal.org")) {
51 $comment_author_url = "";
52 $comment_content.= "\n\n<em>Eu sunt <a href=http://polimedia.us/trilema/2011/trolul-perfect/>o simpla fictiune</a>. Luati ce-am scris mai sus ca atare.</em>";
53}
54*/
55
56// GPG catchall.
57
58if (strpos($comment_content,"BEGIN PGP")>0) $comment_content = "<code>".$comment_content."</code>";
59
60// Don't make it much more than 3 or it'll pester users.
61
62if (((time() - $comment_time) < 3)||(time() - $comment_time > 5000)||($comment_IP <> $_SERVER['REMOTE_ADDR'])) wp_die( __('Looks like you tried to comment off a stale page. Reload the article, count to three and try again.') );
63
64$myrows = $wpdb->get_var('SELECT comment_ID FROM tril_comments WHERE comment_author_IP = "'.$_SERVER["REMOTE_ADDR"].'" and comment_approved = "spam";');
65if ($myrows > 0) wp_die( __('Spammers need not apply.') );
66
67// If the user is logged in
68$user = wp_get_current_user();
69if ( $user->ID ) {
70 if ( empty( $user->display_name ) )
71 $user->display_name=$user->user_login;
72 $comment_author = $wpdb->escape($user->display_name);
73 $comment_author_email = $wpdb->escape($user->user_email);
74 $comment_author_url = $wpdb->escape($user->user_url);
75 if ( current_user_can('unfiltered_html') ) {
76 if ( wp_create_nonce('unfiltered-html-comment_' . $comment_post_ID) != $_POST['_wp_unfiltered_html_comment'] ) {
77 kses_remove_filters(); // start with a clean slate
78 kses_init_filters(); // set up the filters
79 }
80 }
81} else {
82 if ( get_option('comment_registration') )
83 wp_die( __('Sorry, you must be logged in to post a comment.') );
84}
85
86$comment_type = '';
87
88if ( get_option('require_name_email') && !$user->ID ) {
89 if ( 6 > strlen($comment_author_email) || '' == $comment_author )
90 wp_die( __('Error: please fill the required fields (name, email).') );
91 elseif ( !is_email($comment_author_email))
92 wp_die( __('Error: please enter a valid email address.') );
93}
94
95if ( '' == $comment_content )
96 wp_die( __('Error: please type a comment.') );
97
98$comment_parent = isset($_POST['comment_parent']) ? absint($_POST['comment_parent']) : 0;
99
100$commentdata = compact('comment_post_ID', 'comment_author', 'comment_author_email', 'comment_author_url', 'comment_content', 'comment_type', 'comment_parent', 'user_ID');
101
102$comment_id = wp_new_comment( $commentdata );
103
104$comment = get_comment($comment_id);
105if ( !$user->ID ) {
106 setcookie('comment_author_' . COOKIEHASH, $comment->comment_author, time() + 30000000, COOKIEPATH, COOKIE_DOMAIN);
107 setcookie('comment_author_email_' . COOKIEHASH, $comment->comment_author_email, time() + 30000000, COOKIEPATH, COOKIE_DOMAIN);
108 setcookie('comment_author_url_' . COOKIEHASH, clean_url($comment->comment_author_url), time() + 30000000, COOKIEPATH, COOKIE_DOMAIN);
109}
110
111$location = empty($_POST['redirect_to']) ? get_comment_link($comment_id) : $_POST['redirect_to'] . '#comment-' . $comment_id;
112$location = apply_filters('comment_post_redirect', $location, $comment);
113
114wp_redirect($location);
115
116?>