Projects : mp-wp : mp-wp_genesis
1 | <?php |
2 | /** |
3 | * Handles Comment Post to WordPress and prevents duplicate comment posting. |
4 | * |
5 | * @package WordPress |
6 | */ |
7 | |
8 | if ( 'POST' != $_SERVER['REQUEST_METHOD'] ) { |
9 | header('Allow: POST'); |
10 | header('HTTP/1.1 405 Method Not Allowed'); |
11 | header('Content-Type: text/plain'); |
12 | exit; |
13 | } |
14 | |
15 | /** Sets up the WordPress Environment. */ |
16 | require( dirname(__FILE__) . '/wp-load.php' ); |
17 | |
18 | nocache_headers(); |
19 | |
20 | $comment_post_ID = (int) $_POST['comment_post_ID']; |
21 | |
22 | $status = $wpdb->get_row( $wpdb->prepare("SELECT post_status, comment_status FROM $wpdb->posts WHERE ID = %d", $comment_post_ID) ); |
23 | |
24 | if ( empty($status->comment_status) ) { |
25 | do_action('comment_id_not_found', $comment_post_ID); |
26 | exit; |
27 | } elseif ( !comments_open($comment_post_ID) ) { |
28 | do_action('comment_closed', $comment_post_ID); |
29 | wp_die( __('Sorry, comments are closed for this item.') ); |
30 | } elseif ( in_array($status->post_status, array('draft', 'pending') ) ) { |
31 | do_action('comment_on_draft', $comment_post_ID); |
32 | exit; |
33 | } |
34 | // These get changed for avoiding spammers. |
35 | |
36 | $suffix = substr(md5(date('Y-m-d').$_SERVER['REMOTE_ADDR']).$_SERVER['HTTP_USER_AGENT'],6,7); |
37 | |
38 | |
39 | $comment_author = ( isset($_POST['author'.$suffix]) ) ? trim(strip_tags($_POST['author'.$suffix])) : null; |
40 | $comment_author_email = ( isset($_POST['email'.$suffix]) ) ? trim($_POST['email'.$suffix]) : null; |
41 | $comment_author_url = ( isset($_POST['url'.$suffix]) ) ? trim($_POST['url'.$suffix]) : null; |
42 | $comment_content = ( isset($_POST['comment']) ) ? trim(strip_tags($_POST['comment'],"<a><em><strong><i><b><blockquote><ul><ol><li>")) : null; |
43 | $comment_checks = ( isset($_POST['comment_post_time']) ) ? trim($_POST['comment_post_time']) : null; |
44 | $comment_check = explode ("-",$comment_checks); |
45 | $comment_time = $comment_check[0]; |
46 | $comment_IP = $comment_check[1]; |
47 | |
48 | // Special handle for idiots. |
49 | /* |
50 | if (($comment_author_email == "icriss78@yahoo.com")||($comment_author_url == "http://blog.matinal.org")) { |
51 | $comment_author_url = ""; |
52 | $comment_content.= "\n\n<em>Eu sunt <a href=http://polimedia.us/trilema/2011/trolul-perfect/>o simpla fictiune</a>. Luati ce-am scris mai sus ca atare.</em>"; |
53 | } |
54 | */ |
55 | |
56 | // GPG catchall. |
57 | |
58 | if (strpos($comment_content,"BEGIN PGP")>0) $comment_content = "<code>".$comment_content."</code>"; |
59 | |
60 | // Don't make it much more than 3 or it'll pester users. |
61 | |
62 | if (((time() - $comment_time) < 3)||(time() - $comment_time > 5000)||($comment_IP <> $_SERVER['REMOTE_ADDR'])) wp_die( __('Looks like you tried to comment off a stale page. Reload the article, count to three and try again.') ); |
63 | |
64 | $myrows = $wpdb->get_var('SELECT comment_ID FROM tril_comments WHERE comment_author_IP = "'.$_SERVER["REMOTE_ADDR"].'" and comment_approved = "spam";'); |
65 | if ($myrows > 0) wp_die( __('Spammers need not apply.') ); |
66 | |
67 | // If the user is logged in |
68 | $user = wp_get_current_user(); |
69 | if ( $user->ID ) { |
70 | if ( empty( $user->display_name ) ) |
71 | $user->display_name=$user->user_login; |
72 | $comment_author = $wpdb->escape($user->display_name); |
73 | $comment_author_email = $wpdb->escape($user->user_email); |
74 | $comment_author_url = $wpdb->escape($user->user_url); |
75 | if ( current_user_can('unfiltered_html') ) { |
76 | if ( wp_create_nonce('unfiltered-html-comment_' . $comment_post_ID) != $_POST['_wp_unfiltered_html_comment'] ) { |
77 | kses_remove_filters(); // start with a clean slate |
78 | kses_init_filters(); // set up the filters |
79 | } |
80 | } |
81 | } else { |
82 | if ( get_option('comment_registration') ) |
83 | wp_die( __('Sorry, you must be logged in to post a comment.') ); |
84 | } |
85 | |
86 | $comment_type = ''; |
87 | |
88 | if ( get_option('require_name_email') && !$user->ID ) { |
89 | if ( 6 > strlen($comment_author_email) || '' == $comment_author ) |
90 | wp_die( __('Error: please fill the required fields (name, email).') ); |
91 | elseif ( !is_email($comment_author_email)) |
92 | wp_die( __('Error: please enter a valid email address.') ); |
93 | } |
94 | |
95 | if ( '' == $comment_content ) |
96 | wp_die( __('Error: please type a comment.') ); |
97 | |
98 | $comment_parent = isset($_POST['comment_parent']) ? absint($_POST['comment_parent']) : 0; |
99 | |
100 | $commentdata = compact('comment_post_ID', 'comment_author', 'comment_author_email', 'comment_author_url', 'comment_content', 'comment_type', 'comment_parent', 'user_ID'); |
101 | |
102 | $comment_id = wp_new_comment( $commentdata ); |
103 | |
104 | $comment = get_comment($comment_id); |
105 | if ( !$user->ID ) { |
106 | setcookie('comment_author_' . COOKIEHASH, $comment->comment_author, time() + 30000000, COOKIEPATH, COOKIE_DOMAIN); |
107 | setcookie('comment_author_email_' . COOKIEHASH, $comment->comment_author_email, time() + 30000000, COOKIEPATH, COOKIE_DOMAIN); |
108 | setcookie('comment_author_url_' . COOKIEHASH, clean_url($comment->comment_author_url), time() + 30000000, COOKIEPATH, COOKIE_DOMAIN); |
109 | } |
110 | |
111 | $location = empty($_POST['redirect_to']) ? get_comment_link($comment_id) : $_POST['redirect_to'] . '#comment-' . $comment_id; |
112 | $location = apply_filters('comment_post_redirect', $location, $comment); |
113 | |
114 | wp_redirect($location); |
115 | |
116 | ?> |