|
1
|
|
|
<?php |
|
2
|
|
|
|
|
3
|
|
|
|
|
4
|
|
|
abstract class WPCOM_JSON_API_Comment_Endpoint extends WPCOM_JSON_API_Endpoint { |
|
5
|
|
|
public $comment_object_format = array( |
|
6
|
|
|
// explicitly document and cast all output |
|
7
|
|
|
'ID' => '(int) The comment ID.', |
|
8
|
|
|
'post' => "(object>post_reference) A reference to the comment's post.", |
|
9
|
|
|
'author' => '(object>author) The author of the comment.', |
|
10
|
|
|
'date' => "(ISO 8601 datetime) The comment's creation time.", |
|
11
|
|
|
'URL' => '(URL) The full permalink URL to the comment.', |
|
12
|
|
|
'short_URL' => '(URL) The wp.me short URL.', |
|
13
|
|
|
'content' => '(HTML) <code>context</code> dependent.', |
|
14
|
|
|
'raw_content' => '(string) Raw comment content.', |
|
15
|
|
|
'status' => array( |
|
16
|
|
|
'approved' => 'The comment has been approved.', |
|
17
|
|
|
'unapproved' => 'The comment has been held for review in the moderation queue.', |
|
18
|
|
|
'spam' => 'The comment has been marked as spam.', |
|
19
|
|
|
'trash' => 'The comment is in the trash.', |
|
20
|
|
|
), |
|
21
|
|
|
'parent' => "(object>comment_reference|false) A reference to the comment's parent, if it has one.", |
|
22
|
|
|
'type' => array( |
|
23
|
|
|
'comment' => 'The comment is a regular comment.', |
|
24
|
|
|
'trackback' => 'The comment is a trackback.', |
|
25
|
|
|
'pingback' => 'The comment is a pingback.', |
|
26
|
|
|
), |
|
27
|
|
|
'like_count' => '(int) The number of likes for this comment.', |
|
28
|
|
|
'i_like' => '(bool) Does the current user like this comment?', |
|
29
|
|
|
'meta' => '(object) Meta data', |
|
30
|
|
|
); |
|
31
|
|
|
|
|
32
|
|
|
// public $response_format =& $this->comment_object_format; |
|
33
|
|
|
|
|
34
|
|
|
function __construct( $args ) { |
|
35
|
|
|
if ( !$this->response_format ) { |
|
|
|
|
|
|
36
|
|
|
$this->response_format =& $this->comment_object_format; |
|
37
|
|
|
} |
|
38
|
|
|
parent::__construct( $args ); |
|
39
|
|
|
} |
|
40
|
|
|
|
|
41
|
|
|
function get_comment( $comment_id, $context ) { |
|
42
|
|
|
global $blog_id; |
|
43
|
|
|
|
|
44
|
|
|
$comment = get_comment( $comment_id ); |
|
45
|
|
|
if ( !$comment || is_wp_error( $comment ) ) { |
|
46
|
|
|
return new WP_Error( 'unknown_comment', 'Unknown comment', 404 ); |
|
47
|
|
|
} |
|
48
|
|
|
|
|
49
|
|
|
$types = array( '', 'comment', 'pingback', 'trackback' ); |
|
50
|
|
|
if ( !in_array( $comment->comment_type, $types ) ) { |
|
51
|
|
|
return new WP_Error( 'unknown_comment', 'Unknown comment', 404 ); |
|
52
|
|
|
} |
|
53
|
|
|
|
|
54
|
|
|
$post = get_post( $comment->comment_post_ID ); |
|
55
|
|
|
if ( !$post || is_wp_error( $post ) ) { |
|
56
|
|
|
return new WP_Error( 'unknown_post', 'Unknown post', 404 ); |
|
57
|
|
|
} |
|
58
|
|
|
|
|
59
|
|
|
$status = wp_get_comment_status( $comment->comment_ID ); |
|
60
|
|
|
|
|
61
|
|
|
// Permissions |
|
62
|
|
|
switch ( $context ) { |
|
63
|
|
|
case 'edit' : |
|
64
|
|
|
if ( !current_user_can( 'edit_comment', $comment->comment_ID ) ) { |
|
65
|
|
|
return new WP_Error( 'unauthorized', 'User cannot edit comment', 403 ); |
|
66
|
|
|
} |
|
67
|
|
|
|
|
68
|
|
|
$GLOBALS['post'] = $post; |
|
69
|
|
|
$comment = get_comment_to_edit( $comment->comment_ID ); |
|
70
|
|
|
foreach ( array( 'comment_author', 'comment_author_email', 'comment_author_url' ) as $field ) { |
|
71
|
|
|
$comment->$field = htmlspecialchars_decode( $comment->$field, ENT_QUOTES ); |
|
72
|
|
|
} |
|
73
|
|
|
break; |
|
74
|
|
|
case 'display' : |
|
75
|
|
|
if ( 'approved' !== $status ) { |
|
76
|
|
|
$current_user_id = get_current_user_id(); |
|
77
|
|
|
$user_can_read_coment = false; |
|
|
|
|
|
|
78
|
|
|
if ( $current_user_id && $comment->user_id && $current_user_id == $comment->user_id ) { |
|
79
|
|
|
$user_can_read_coment = true; |
|
80
|
|
|
} elseif ( |
|
81
|
|
|
$comment->comment_author_email && $comment->comment_author |
|
82
|
|
|
&& |
|
83
|
|
|
isset( $this->api->token_details['user'] ) |
|
84
|
|
|
&& |
|
85
|
|
|
isset( $this->api->token_details['user']['user_email'] ) |
|
86
|
|
|
&& |
|
87
|
|
|
$this->api->token_details['user']['user_email'] === $comment->comment_author_email |
|
88
|
|
|
&& |
|
89
|
|
|
$this->api->token_details['user']['display_name'] === $comment->comment_author |
|
90
|
|
|
) { |
|
91
|
|
|
$user_can_read_coment = true; |
|
92
|
|
|
} else { |
|
93
|
|
|
$user_can_read_coment = current_user_can( 'edit_comment', $comment->comment_ID ); |
|
94
|
|
|
} |
|
95
|
|
|
|
|
96
|
|
|
if ( !$user_can_read_coment ) { |
|
97
|
|
|
return new WP_Error( 'unauthorized', 'User cannot read unapproved comment', 403 ); |
|
98
|
|
|
} |
|
99
|
|
|
} |
|
100
|
|
|
|
|
101
|
|
|
$GLOBALS['post'] = $post; |
|
102
|
|
|
setup_postdata( $post ); |
|
103
|
|
|
break; |
|
104
|
|
|
default : |
|
|
|
|
|
|
105
|
|
|
return new WP_Error( 'invalid_context', 'Invalid API CONTEXT', 400 ); |
|
106
|
|
|
} |
|
107
|
|
|
|
|
108
|
|
|
$can_view = $this->user_can_view_post( $post->ID ); |
|
109
|
|
|
if ( !$can_view || is_wp_error( $can_view ) ) { |
|
110
|
|
|
return $can_view; |
|
111
|
|
|
} |
|
112
|
|
|
|
|
113
|
|
|
$GLOBALS['comment'] = $comment; |
|
114
|
|
|
$response = array(); |
|
115
|
|
|
|
|
116
|
|
|
foreach ( array_keys( $this->comment_object_format ) as $key ) { |
|
117
|
|
|
switch ( $key ) { |
|
118
|
|
|
case 'ID' : |
|
119
|
|
|
// explicitly cast all output |
|
120
|
|
|
$response[$key] = (int) $comment->comment_ID; |
|
121
|
|
|
break; |
|
122
|
|
|
case 'post' : |
|
123
|
|
|
$response[$key] = (object) array( |
|
124
|
|
|
'ID' => (int) $post->ID, |
|
125
|
|
|
'title' => (string) get_the_title( $post->ID ), |
|
126
|
|
|
'type' => (string) $post->post_type, |
|
127
|
|
|
'link' => (string) $this->links->get_post_link( $this->api->get_blog_id_for_output(), $post->ID ), |
|
128
|
|
|
); |
|
129
|
|
|
break; |
|
130
|
|
|
case 'author' : |
|
131
|
|
|
$response[$key] = (object) $this->get_author( $comment, current_user_can( 'edit_comment', $comment->comment_ID ) ); |
|
132
|
|
|
break; |
|
133
|
|
|
case 'date' : |
|
134
|
|
|
$response[$key] = (string) $this->format_date( $comment->comment_date_gmt, $comment->comment_date ); |
|
135
|
|
|
break; |
|
136
|
|
|
case 'URL' : |
|
137
|
|
|
$response[$key] = (string) esc_url_raw( get_comment_link( $comment->comment_ID ) ); |
|
138
|
|
|
break; |
|
139
|
|
|
case 'short_URL' : |
|
140
|
|
|
// @todo - pagination |
|
|
|
|
|
|
141
|
|
|
$response[$key] = (string) esc_url_raw( wp_get_shortlink( $post->ID ) . "%23comment-{$comment->comment_ID}" ); |
|
142
|
|
|
break; |
|
143
|
|
|
case 'content' : |
|
144
|
|
|
if ( 'display' === $context ) { |
|
145
|
|
|
ob_start(); |
|
146
|
|
|
comment_text(); |
|
147
|
|
|
$response[$key] = (string) ob_get_clean(); |
|
148
|
|
|
} else { |
|
149
|
|
|
$response[$key] = (string) $comment->comment_content; |
|
150
|
|
|
} |
|
151
|
|
|
break; |
|
152
|
|
|
case 'raw_content': |
|
153
|
|
|
$response[$key] = (string) $comment->comment_content; |
|
154
|
|
|
break; |
|
155
|
|
|
case 'status' : |
|
156
|
|
|
$response[$key] = (string) $status; |
|
157
|
|
|
break; |
|
158
|
|
|
case 'parent' : // (object|false) |
|
159
|
|
|
if ( $comment->comment_parent ) { |
|
160
|
|
|
$parent = get_comment( $comment->comment_parent ); |
|
161
|
|
|
$response[$key] = (object) array( |
|
162
|
|
|
'ID' => (int) $parent->comment_ID, |
|
163
|
|
|
'type' => (string) ( $parent->comment_type ? $parent->comment_type : 'comment' ), |
|
164
|
|
|
'link' => (string) $this->links->get_comment_link( $blog_id, $parent->comment_ID ), |
|
165
|
|
|
); |
|
166
|
|
|
} else { |
|
167
|
|
|
$response[$key] = false; |
|
168
|
|
|
} |
|
169
|
|
|
break; |
|
170
|
|
|
case 'type' : |
|
171
|
|
|
$response[$key] = (string) ( $comment->comment_type ? $comment->comment_type : 'comment' ); |
|
172
|
|
|
break; |
|
173
|
|
|
case 'like_count' : |
|
174
|
|
|
if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) { |
|
175
|
|
|
$response[ $key ] = (int) $this->api->comment_like_count( $blog_id, $post->ID, $comment->comment_ID ); |
|
|
|
|
|
|
176
|
|
|
} |
|
177
|
|
|
break; |
|
178
|
|
|
case 'i_like' : |
|
179
|
|
|
if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) { |
|
180
|
|
|
$response[ $key ] = (bool) Likes::comment_like_current_user_likes( $blog_id, $comment->comment_ID ); |
|
181
|
|
|
} |
|
182
|
|
|
break; |
|
183
|
|
|
case 'meta' : |
|
184
|
|
|
$response[$key] = (object) array( |
|
185
|
|
|
'links' => (object) array( |
|
186
|
|
|
'self' => (string) $this->links->get_comment_link( $this->api->get_blog_id_for_output(), $comment->comment_ID ), |
|
187
|
|
|
'help' => (string) $this->links->get_comment_link( $this->api->get_blog_id_for_output(), $comment->comment_ID, 'help' ), |
|
188
|
|
|
'site' => (string) $this->links->get_site_link( $this->api->get_blog_id_for_output() ), |
|
189
|
|
|
'post' => (string) $this->links->get_post_link( $this->api->get_blog_id_for_output(), $comment->comment_post_ID ), |
|
190
|
|
|
'replies' => (string) $this->links->get_comment_link( $this->api->get_blog_id_for_output(), $comment->comment_ID, 'replies/' ), |
|
191
|
|
|
'likes' => (string) $this->links->get_comment_link( $this->api->get_blog_id_for_output(), $comment->comment_ID, 'likes/' ), |
|
192
|
|
|
), |
|
193
|
|
|
); |
|
194
|
|
|
break; |
|
195
|
|
|
} |
|
196
|
|
|
} |
|
197
|
|
|
|
|
198
|
|
|
unset( $GLOBALS['comment'], $GLOBALS['post'] ); |
|
199
|
|
|
return $response; |
|
200
|
|
|
} |
|
201
|
|
|
} |
|
202
|
|
|
|
|
203
|
|
|
|
This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent.
Consider making the comparison explicit by using
empty(..)or! empty(...)instead.