Issues in functions.wp-notify.php - New Issues - Inspection of "Spacing" - Automattic/jetpack - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Push — add/double-encode-message ( 8b6530...2d4e84 )

unknown

created 2019-03-01 17:51 UTC

_inc/lib/functions.wp-notify.php (4 issues)

Labels

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

if ( ! function_exists( 'wp_notify_postauthor' ) && Jetpack::is_active() ) :
	/**
	 * Notify an author (and/or others) of a comment/trackback/pingback on a post.
	 *
	 * @since 1.0.0
	 *
	 * @param int|WP_Comment  $comment_id Comment ID or WP_Comment object.
	 * @param string          $deprecated Not used

	 * @return bool True on completion. False if no email addresses were specified.
	 */
	function wp_notify_postauthor( $comment_id, $deprecated = null ) {
		if ( null !== $deprecated ) {
			_deprecated_argument( __FUNCTION__, '3.8.0' );
		}

		$comment = get_comment( $comment_id );

		if ( empty( $comment ) || empty( $comment->comment_post_ID ) ) {
			return false;
		}

		$post   = get_post( $comment->comment_post_ID );
		$author = get_userdata( $post->post_author );

		// Who to notify? By default, just the post author, but others can be added.
		$emails = array();
		if ( $author ) {
			$emails[] = $author->user_email;
		}

		/** This filter is documented in core/src/wp-includes/pluggable.php */
		$emails = apply_filters( 'comment_notification_recipients', $emails, $comment->comment_ID );
		$emails = array_filter( $emails );

		// If there are no addresses to send the comment to, bail.
		if ( ! count( $emails ) ) {
			return false;
		}

		// Facilitate unsetting below without knowing the keys.
		$emails = array_flip( $emails );

		/** This filter is documented in core/src/wp-includes/pluggable.php */
		$notify_author = apply_filters( 'comment_notification_notify_author', false, $comment->comment_ID );

		// The comment was left by the author
		if ( $author && ! $notify_author && $comment->user_id == $post->post_author ) {
			unset( $emails[ $author->user_email ] );
		}

		// The author moderated a comment on their own post
		if ( $author && ! $notify_author && $post->post_author == get_current_user_id() ) {
			unset( $emails[ $author->user_email ] );
		}

		// The post author is no longer a member of the blog
		if ( $author && ! $notify_author && ! user_can( $post->post_author, 'read_post', $post->ID ) ) {
			unset( $emails[ $author->user_email ] );
		}

		// If there's no email to send the comment to, bail, otherwise flip array back around for use below
		if ( ! count( $emails ) ) {
			return false;
		} else {
			$emails = array_flip( $emails );
		}

		$switched_locale = switch_to_locale( get_locale() );

		$comment_author_domain = @gethostbyaddr( $comment->comment_author_IP );

		// The blogname option is escaped with esc_html on the way into the database in sanitize_option
		// we want to reverse this for the plain text arena of emails.
		$blogname        = wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES );
		$comment_content = wp_specialchars_decode( $comment->comment_content );

		function is_user_connected( $email ) {
			$user = get_user_by( 'email', $email );
			return Jetpack::is_user_connected( $user->ID );
		}

		$moderate_on_wpcom = ! in_array( false, array_map( 'is_user_connected', $emails ) );

		$primary_site_slug = Jetpack::build_raw_urls( get_home_url() );

		switch ( $comment->comment_type ) {
			case 'trackback':
				/* translators: 1: Post title */
				$notify_message = sprintf( __( 'New trackback on your post "%s"' ), $post->post_title ) . "\r\n";
				/* translators: 1: Trackback/pingback website name, 2: website IP address, 3: website hostname */
				$notify_message     .= sprintf( __( 'Website: %1$s (IP address: %2$s, %3$s)' ), $comment->comment_author, $comment->comment_author_IP, $comment_author_domain ) . "\r\n";
				$notify_message     .= sprintf( __( 'URL: %s' ), $comment->comment_author_url ) . "\r\n";
				$notify_message     .= sprintf( __( 'Comment: %s' ), "\r\n" . $comment_content ) . "\r\n\r\n";
					$notify_message .= __( 'You can see all trackbacks on this post here:' ) . "\r\n";
					/* translators: 1: blog name, 2: post title */
					$subject = sprintf( __( '[%1$s] Trackback: "%2$s"' ), $blogname, $post->post_title );
				break;
			case 'pingback':
				/* translators: 1: Post title */
				$notify_message = sprintf( __( 'New pingback on your post "%s"' ), $post->post_title ) . "\r\n";
				/* translators: 1: Trackback/pingback website name, 2: website IP address, 3: website hostname */
				$notify_message .= sprintf( __( 'Website: %1$s (IP address: %2$s, %3$s)' ), $comment->comment_author, $comment->comment_author_IP, $comment_author_domain ) . "\r\n";
				$notify_message .= sprintf( __( 'URL: %s' ), $comment->comment_author_url ) . "\r\n";
				$notify_message .= sprintf( __( 'Comment: %s' ), "\r\n" . $comment_content ) . "\r\n\r\n";
				$notify_message .= __( 'You can see all pingbacks on this post here:' ) . "\r\n";
				/* translators: 1: blog name, 2: post title */
				$subject = sprintf( __( '[%1$s] Pingback: "%2$s"' ), $blogname, $post->post_title );
				break;
			default: // Comments
				$notify_message = sprintf( __( 'New comment on your post "%s"' ), $post->post_title ) . "\r\n";
				/* translators: 1: comment author, 2: comment author's IP address, 3: comment author's hostname */
				$notify_message .= sprintf( __( 'Author: %1$s (IP address: %2$s, %3$s)' ), $comment->comment_author, $comment->comment_author_IP, $comment_author_domain ) . "\r\n";
				$notify_message .= sprintf( __( 'Email: %s' ), $comment->comment_author_email ) . "\r\n";
				$notify_message .= sprintf( __( 'URL: %s' ), $comment->comment_author_url ) . "\r\n";
				$notify_message .= sprintf( __( 'Comment: %s' ), "\r\n" . $comment_content ) . "\r\n\r\n";
				$notify_message .= __( 'You can see all comments on this post here:' ) . "\r\n";
				/* translators: 1: blog name, 2: post title */
				$subject = sprintf( __( '[%1$s] Comment: "%2$s"' ), $blogname, $post->post_title );
				break;
		}

		$notify_message .= $moderate_on_wpcom
			? "https://wordpress.com/comments/all/{$primary_site_slug}/{$comment->comment_post_ID}/\r\n\r\n"
			: get_permalink( $comment->comment_post_ID ) . "#comments\r\n\r\n";

		$notify_message .= sprintf( __( 'Permalink: %s' ), get_comment_link( $comment ) ) . "\r\n";

		if ( user_can( $post->post_author, 'edit_comment', $comment->comment_ID ) ) {
			if ( EMPTY_TRASH_DAYS ) {
				$notify_message .= sprintf(
					__( 'Trash it: %s' ), $moderate_on_wpcom
					? "https://wordpress.com/comment/{$primary_site_slug}/{$comment_id}?action=trash"
					: admin_url( "comment.php?action=trash&c={$comment->comment_ID}#wpbody-content" )
				) . "\r\n";
			} else {
				$notify_message .= sprintf(
					__( 'Delete it: %s' ), $moderate_on_wpcom
					? "https://wordpress.com/comment/{$primary_site_slug}/{$comment_id}?action=delete"
					: admin_url( "comment.php?action=delete&c={$comment->comment_ID}#wpbody-content" )
				) . "\r\n";
			}
			$notify_message .= sprintf(
				__( 'Spam it: %s' ), $moderate_on_wpcom ?
				"https://wordpress.com/comment/{$primary_site_slug}/{$comment_id}?action=spam"
				: admin_url( "comment.php?action=spam&c={$comment->comment_ID}#wpbody-content" )
			) . "\r\n";
		}

		$wp_email = 'wordpress@' . preg_replace( '#^www\.#', '', strtolower( $_SERVER['SERVER_NAME'] ) );

		if ( '' == $comment->comment_author ) {
			$from = "From: \"$blogname\" <$wp_email>";
			if ( '' != $comment->comment_author_email ) {
				$reply_to = "Reply-To: $comment->comment_author_email";
			}
		} else {
			$from = "From: \"$comment->comment_author\" <$wp_email>";
			if ( '' != $comment->comment_author_email ) {
				$reply_to = "Reply-To: \"$comment->comment_author_email\" <$comment->comment_author_email>";
			}
		}

		$message_headers = "$from\n"
			. 'Content-Type: text/plain; charset="' . get_option( 'blog_charset' ) . "\"\n";

		if ( isset( $reply_to ) ) {
			$message_headers .= $reply_to . "\n";
		}

		/** This filter is documented in core/src/wp-includes/pluggable.php */
		$notify_message = apply_filters( 'comment_notification_text', $notify_message, $comment->comment_ID );

		/** This filter is documented in core/src/wp-includes/pluggable.php */
		$subject = apply_filters( 'comment_notification_subject', $subject, $comment->comment_ID );

		/** This filter is documented in core/src/wp-includes/pluggable.php */
		$message_headers = apply_filters( 'comment_notification_headers', $message_headers, $comment->comment_ID );

		foreach ( $emails as $email ) {
			@wp_mail( $email, wp_specialchars_decode( $subject ), $notify_message, $message_headers );
// For example instead of
@mkdir($dir);

// Better use
if (@mkdir($dir) === false) {
    throw new \RuntimeException('The directory '.$dir.' could not be created.');
}
		}

		if ( $switched_locale ) {
			restore_previous_locale();
		}

		return true;
	}
endif;

if ( ! function_exists( 'wp_notify_moderator' ) && Jetpack::is_active() ) :
	/**
	 * Notifies the moderator of the site about a new comment that is awaiting approval.
	 *
	 * @since 1.0.0
	 *
	 * @global wpdb $wpdb WordPress database abstraction object.
	 *
	 * Uses the {@see 'notify_moderator'} filter to determine whether the site moderator
	 * should be notified, overriding the site setting.
	 *
	 * @param int $comment_id Comment ID.
	 * @return true Always returns true.
	 */
	function wp_notify_moderator( $comment_id ) {
		global $wpdb;

		$maybe_notify = get_option( 'moderation_notify' );

		/** This filter is documented in core/src/wp-includes/pluggable.php */
		$maybe_notify = apply_filters( 'notify_moderator', $maybe_notify, $comment_id );

		if ( ! $maybe_notify ) {
			return true;
		}

		$comment = get_comment( $comment_id );
		$post    = get_post( $comment->comment_post_ID );
		$user    = get_userdata( $post->post_author );
		// Send to the administration and to the post author if the author can modify the comment.
		$emails = array( get_option( 'admin_email' ) );
		if ( $user && user_can( $user->ID, 'edit_comment', $comment_id ) && ! empty( $user->user_email ) ) {
			if ( 0 !== strcasecmp( $user->user_email, get_option( 'admin_email' ) ) ) {
				$emails[] = $user->user_email;
			}
		}

		$switched_locale = switch_to_locale( get_locale() );

		$comment_author_domain = @gethostbyaddr( $comment->comment_author_IP );
		$comments_waiting      = $wpdb->get_var( "SELECT count(comment_ID) FROM $wpdb->comments WHERE comment_approved = '0'" );

		// The blogname option is escaped with esc_html on the way into the database in sanitize_option
		// we want to reverse this for the plain text arena of emails.
		$blogname        = wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES );
		$comment_content = wp_specialchars_decode( $comment->comment_content );

		switch ( $comment->comment_type ) {
			case 'trackback':
				/* translators: 1: Post title */
				$notify_message  = sprintf( __( 'A new trackback on the post "%s" is waiting for your approval' ), $post->post_title ) . "\r\n";
				$notify_message .= get_permalink( $comment->comment_post_ID ) . "\r\n\r\n";
				/* translators: 1: Trackback/pingback website name, 2: website IP address, 3: website hostname */
				$notify_message .= sprintf( __( 'Website: %1$s (IP address: %2$s, %3$s)' ), $comment->comment_author, $comment->comment_author_IP, $comment_author_domain ) . "\r\n";
				/* translators: 1: Trackback/pingback/comment author URL */
				$notify_message .= sprintf( __( 'URL: %s' ), $comment->comment_author_url ) . "\r\n";
				$notify_message .= __( 'Trackback excerpt: ' ) . "\r\n" . $comment_content . "\r\n\r\n";
				break;
			case 'pingback':
				/* translators: 1: Post title */
				$notify_message  = sprintf( __( 'A new pingback on the post "%s" is waiting for your approval' ), $post->post_title ) . "\r\n";
				$notify_message .= get_permalink( $comment->comment_post_ID ) . "\r\n\r\n";
				/* translators: 1: Trackback/pingback website name, 2: website IP address, 3: website hostname */
				$notify_message .= sprintf( __( 'Website: %1$s (IP address: %2$s, %3$s)' ), $comment->comment_author, $comment->comment_author_IP, $comment_author_domain ) . "\r\n";
				/* translators: 1: Trackback/pingback/comment author URL */
				$notify_message .= sprintf( __( 'URL: %s' ), $comment->comment_author_url ) . "\r\n";
				$notify_message .= __( 'Pingback excerpt: ' ) . "\r\n" . $comment_content . "\r\n\r\n";
				break;
			default: // Comments
				/* translators: 1: Post title */
				$notify_message  = sprintf( __( 'A new comment on the post "%s" is waiting for your approval' ), $post->post_title ) . "\r\n";
				$notify_message .= get_permalink( $comment->comment_post_ID ) . "\r\n\r\n";
				/* translators: 1: Comment author name, 2: comment author's IP address, 3: comment author's hostname */
				$notify_message .= sprintf( __( 'Author: %1$s (IP address: %2$s, %3$s)' ), $comment->comment_author, $comment->comment_author_IP, $comment_author_domain ) . "\r\n";
				/* translators: 1: Comment author URL */
				$notify_message .= sprintf( __( 'Email: %s' ), $comment->comment_author_email ) . "\r\n";
				/* translators: 1: Trackback/pingback/comment author URL */
				$notify_message .= sprintf( __( 'URL: %s' ), $comment->comment_author_url ) . "\r\n";
				/* translators: 1: Comment text */
				$notify_message .= sprintf( __( 'Comment: %s' ), "\r\n" . $comment_content ) . "\r\n\r\n";
				break;
		}

		/** This filter is documented in core/src/wp-includes/pluggable.php */
		$emails = apply_filters( 'comment_moderation_recipients', $emails, $comment_id );

		function is_user_connected( $email ) {
/**
 * @ignore
 */
function getUser() {

}

function getUser($id, $realm) {

}
			$user = get_user_by( 'email', $email );
			return Jetpack::is_user_connected( $user->ID );
		}

		$moderate_on_wpcom = ! in_array( false, array_map( 'is_user_connected', $emails ) );

		$primary_site_slug = Jetpack::build_raw_urls( get_home_url() );

		/* translators: Comment moderation. 1: Comment action URL */
		$notify_message .= sprintf(
			__( 'Approve it: %s' ), $moderate_on_wpcom
			? "https://wordpress.com/comment/{$primary_site_slug}/{$comment_id}?action=approve"
			: admin_url( "comment.php?action=approve&c={$comment_id}#wpbody-content" )
		) . "\r\n";

		if ( EMPTY_TRASH_DAYS ) {
			/* translators: Comment moderation. 1: Comment action URL */
			$notify_message .= sprintf(
				__( 'Trash it: %s' ), $moderate_on_wpcom
				? "https://wordpress.com/comment/{$primary_site_slug}/{$comment_id}?action=trash"
				: admin_url( "comment.php?action=trash&c={$comment_id}#wpbody-content" )
			) . "\r\n";
		} else {
			/* translators: Comment moderation. 1: Comment action URL */
			$notify_message .= sprintf(
				__( 'Delete it: %s' ), $moderate_on_wpcom
				? "https://wordpress.com/comment/{$primary_site_slug}/{$comment_id}?action=delete"
				: admin_url( "comment.php?action=delete&c={$comment_id}#wpbody-content" )
			) . "\r\n";
		}

		/* translators: Comment moderation. 1: Comment action URL */
		$notify_message .= sprintf(
			__( 'Spam it: %s' ), $moderate_on_wpcom
			? "https://wordpress.com/comment/{$primary_site_slug}/{$comment_id}?action=spam"
			: admin_url( "comment.php?action=spam&c={$comment_id}#wpbody-content" )
		) . "\r\n";

		/* translators: Comment moderation. 1: Number of comments awaiting approval */
		$notify_message .= sprintf(
			_n(
				'Currently %s comment is waiting for approval. Please visit the moderation panel:',
				'Currently %s comments are waiting for approval. Please visit the moderation panel:', $comments_waiting
			), number_format_i18n( $comments_waiting )
		) . "\r\n";

		$notify_message .= $moderate_on_wpcom
			? "https://wordpress.com/comments/pending/{$primary_site_slug}/"
			: admin_url( 'edit-comments.php?comment_status=moderated#wpbody-content' ) . "\r\n";

		/* translators: Comment moderation notification email subject. 1: Site name, 2: Post title */
		$subject         = sprintf( __( '[%1$s] Please moderate: "%2$s"' ), $blogname, $post->post_title );
		$message_headers = '';

		/** This filter is documented in core/src/wp-includes/pluggable.php */
		$notify_message = apply_filters( 'comment_moderation_text', $notify_message, $comment_id );

		/** This filter is documented in core/src/wp-includes/pluggable.php */
		$subject = apply_filters( 'comment_moderation_subject', $subject, $comment_id );

		/** This filter is documented in core/src/wp-includes/pluggable.php */
		$message_headers = apply_filters( 'comment_moderation_headers', $message_headers, $comment_id );

		foreach ( $emails as $email ) {
			@wp_mail( $email, wp_specialchars_decode( $subject ), $notify_message, $message_headers );
// For example instead of
@mkdir($dir);

// Better use
if (@mkdir($dir) === false) {
    throw new \RuntimeException('The directory '.$dir.' could not be created.');
}
		}

		if ( $switched_locale ) {
			restore_previous_locale();
		}

		return true;
	}
endif;


1		<?php
2
3		if ( ! function_exists( 'wp_notify_postauthor' ) && Jetpack::is_active() ) :
4		/**
5		* Notify an author (and/or others) of a comment/trackback/pingback on a post.
6		*
7		* @since 1.0.0
8		*
9		* @param int\|WP_Comment $comment_id Comment ID or WP_Comment object.
10		* @param string $deprecated Not used
		0 ignored issues – show Documentation introduced 2017-11-10 16:03 UTC by Report Bug Copy Issue Report Show Similar Issues like this Should the type for parameter `$deprecated` not be `string\|null`? This check looks for `@param` annotations where the type inferred by our type inference engine differs from the declared type. It makes a suggestion as to what type it considers more descriptive. Most often this is a case of a parameter that can be null in addition to its declared types. Loading history...
11		* @return bool True on completion. False if no email addresses were specified.
12		*/
13		function wp_notify_postauthor( $comment_id, $deprecated = null ) {
14		if ( null !== $deprecated ) {
15		_deprecated_argument( __FUNCTION__, '3.8.0' );
16		}
17
18		$comment = get_comment( $comment_id );
19
20		if ( empty( $comment ) \|\| empty( $comment->comment_post_ID ) ) {
21		return false;
22		}
23
24		$post = get_post( $comment->comment_post_ID );
25		$author = get_userdata( $post->post_author );
26
27		// Who to notify? By default, just the post author, but others can be added.
28		$emails = array();
29		if ( $author ) {
30		$emails[] = $author->user_email;
31		}
32
33		/** This filter is documented in core/src/wp-includes/pluggable.php */
34		$emails = apply_filters( 'comment_notification_recipients', $emails, $comment->comment_ID );
35		$emails = array_filter( $emails );
36
37		// If there are no addresses to send the comment to, bail.
38		if ( ! count( $emails ) ) {
39		return false;
40		}
41
42		// Facilitate unsetting below without knowing the keys.
43		$emails = array_flip( $emails );
44
45		/** This filter is documented in core/src/wp-includes/pluggable.php */
46		$notify_author = apply_filters( 'comment_notification_notify_author', false, $comment->comment_ID );
47
48		// The comment was left by the author
49		if ( $author && ! $notify_author && $comment->user_id == $post->post_author ) {
50		unset( $emails[ $author->user_email ] );
51		}
52
53		// The author moderated a comment on their own post
54		if ( $author && ! $notify_author && $post->post_author == get_current_user_id() ) {
55		unset( $emails[ $author->user_email ] );
56		}
57
58		// The post author is no longer a member of the blog
59		if ( $author && ! $notify_author && ! user_can( $post->post_author, 'read_post', $post->ID ) ) {
60		unset( $emails[ $author->user_email ] );
61		}
62
63		// If there's no email to send the comment to, bail, otherwise flip array back around for use below
64		if ( ! count( $emails ) ) {
65		return false;
66		} else {
67		$emails = array_flip( $emails );
68		}
69
70		$switched_locale = switch_to_locale( get_locale() );
71
72		$comment_author_domain = @gethostbyaddr( $comment->comment_author_IP );
73
74		// The blogname option is escaped with esc_html on the way into the database in sanitize_option
75		// we want to reverse this for the plain text arena of emails.
76		$blogname = wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES );
77		$comment_content = wp_specialchars_decode( $comment->comment_content );
78
79		function is_user_connected( $email ) {
80		$user = get_user_by( 'email', $email );
81		return Jetpack::is_user_connected( $user->ID );
82		}
83
84		$moderate_on_wpcom = ! in_array( false, array_map( 'is_user_connected', $emails ) );
85
86		$primary_site_slug = Jetpack::build_raw_urls( get_home_url() );
87
88		switch ( $comment->comment_type ) {
89	View Code Duplication	case 'trackback':
90		/* translators: 1: Post title */
91		$notify_message = sprintf( __( 'New trackback on your post "%s"' ), $post->post_title ) . "\r\n";
92		/* translators: 1: Trackback/pingback website name, 2: website IP address, 3: website hostname */
93		$notify_message .= sprintf( __( 'Website: %1$s (IP address: %2$s, %3$s)' ), $comment->comment_author, $comment->comment_author_IP, $comment_author_domain ) . "\r\n";
94		$notify_message .= sprintf( __( 'URL: %s' ), $comment->comment_author_url ) . "\r\n";
95		$notify_message .= sprintf( __( 'Comment: %s' ), "\r\n" . $comment_content ) . "\r\n\r\n";
96		$notify_message .= __( 'You can see all trackbacks on this post here:' ) . "\r\n";
97		/* translators: 1: blog name, 2: post title */
98		$subject = sprintf( __( '[%1$s] Trackback: "%2$s"' ), $blogname, $post->post_title );
99		break;
100	View Code Duplication	case 'pingback':
101		/* translators: 1: Post title */
102		$notify_message = sprintf( __( 'New pingback on your post "%s"' ), $post->post_title ) . "\r\n";
103		/* translators: 1: Trackback/pingback website name, 2: website IP address, 3: website hostname */
104		$notify_message .= sprintf( __( 'Website: %1$s (IP address: %2$s, %3$s)' ), $comment->comment_author, $comment->comment_author_IP, $comment_author_domain ) . "\r\n";
105		$notify_message .= sprintf( __( 'URL: %s' ), $comment->comment_author_url ) . "\r\n";
106		$notify_message .= sprintf( __( 'Comment: %s' ), "\r\n" . $comment_content ) . "\r\n\r\n";
107		$notify_message .= __( 'You can see all pingbacks on this post here:' ) . "\r\n";
108		/* translators: 1: blog name, 2: post title */
109		$subject = sprintf( __( '[%1$s] Pingback: "%2$s"' ), $blogname, $post->post_title );
110		break;
111		default: // Comments
112		$notify_message = sprintf( __( 'New comment on your post "%s"' ), $post->post_title ) . "\r\n";
113		/* translators: 1: comment author, 2: comment author's IP address, 3: comment author's hostname */
114		$notify_message .= sprintf( __( 'Author: %1$s (IP address: %2$s, %3$s)' ), $comment->comment_author, $comment->comment_author_IP, $comment_author_domain ) . "\r\n";
115		$notify_message .= sprintf( __( 'Email: %s' ), $comment->comment_author_email ) . "\r\n";
116		$notify_message .= sprintf( __( 'URL: %s' ), $comment->comment_author_url ) . "\r\n";
117		$notify_message .= sprintf( __( 'Comment: %s' ), "\r\n" . $comment_content ) . "\r\n\r\n";
118		$notify_message .= __( 'You can see all comments on this post here:' ) . "\r\n";
119		/* translators: 1: blog name, 2: post title */
120		$subject = sprintf( __( '[%1$s] Comment: "%2$s"' ), $blogname, $post->post_title );
121		break;
122		}
123
124		$notify_message .= $moderate_on_wpcom
125		? "https://wordpress.com/comments/all/{$primary_site_slug}/{$comment->comment_post_ID}/\r\n\r\n"
126		: get_permalink( $comment->comment_post_ID ) . "#comments\r\n\r\n";
127
128		$notify_message .= sprintf( __( 'Permalink: %s' ), get_comment_link( $comment ) ) . "\r\n";
129
130		if ( user_can( $post->post_author, 'edit_comment', $comment->comment_ID ) ) {
131	View Code Duplication	if ( EMPTY_TRASH_DAYS ) {
132		$notify_message .= sprintf(
133		__( 'Trash it: %s' ), $moderate_on_wpcom
134		? "https://wordpress.com/comment/{$primary_site_slug}/{$comment_id}?action=trash"
135		: admin_url( "comment.php?action=trash&c={$comment->comment_ID}#wpbody-content" )
136		) . "\r\n";
137		} else {
138		$notify_message .= sprintf(
139		__( 'Delete it: %s' ), $moderate_on_wpcom
140		? "https://wordpress.com/comment/{$primary_site_slug}/{$comment_id}?action=delete"
141		: admin_url( "comment.php?action=delete&c={$comment->comment_ID}#wpbody-content" )
142		) . "\r\n";
143		}
144		$notify_message .= sprintf(
145		__( 'Spam it: %s' ), $moderate_on_wpcom ?
146		"https://wordpress.com/comment/{$primary_site_slug}/{$comment_id}?action=spam"
147		: admin_url( "comment.php?action=spam&c={$comment->comment_ID}#wpbody-content" )
148		) . "\r\n";
149		}
150
151		$wp_email = 'wordpress@' . preg_replace( '#^www\.#', '', strtolower( $_SERVER['SERVER_NAME'] ) );
152
153		if ( '' == $comment->comment_author ) {
154		$from = "From: \"$blogname\" <$wp_email>";
155		if ( '' != $comment->comment_author_email ) {
156		$reply_to = "Reply-To: $comment->comment_author_email";
157		}
158		} else {
159		$from = "From: \"$comment->comment_author\" <$wp_email>";
160		if ( '' != $comment->comment_author_email ) {
161		$reply_to = "Reply-To: \"$comment->comment_author_email\" <$comment->comment_author_email>";
162		}
163		}
164
165		$message_headers = "$from\n"
166		. 'Content-Type: text/plain; charset="' . get_option( 'blog_charset' ) . "\"\n";
167
168		if ( isset( $reply_to ) ) {
169		$message_headers .= $reply_to . "\n";
170		}
171
172		/** This filter is documented in core/src/wp-includes/pluggable.php */
173		$notify_message = apply_filters( 'comment_notification_text', $notify_message, $comment->comment_ID );
174
175		/** This filter is documented in core/src/wp-includes/pluggable.php */
176		$subject = apply_filters( 'comment_notification_subject', $subject, $comment->comment_ID );
177
178		/** This filter is documented in core/src/wp-includes/pluggable.php */
179		$message_headers = apply_filters( 'comment_notification_headers', $message_headers, $comment->comment_ID );
180
181		foreach ( $emails as $email ) {
182		@wp_mail( $email, wp_specialchars_decode( $subject ), $notify_message, $message_headers );
		0 ignored issues – show Security Best Practice introduced 2018-01-15 12:23 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like you do not handle an error condition here. This can introduce security issues, and is generally not recommended. If you suppress an error, we recommend checking for the error condition explicitly: // For example instead of @mkdir($dir); // Better use if (@mkdir($dir) === false) { throw new \RuntimeException('The directory '.$dir.' could not be created.'); } Loading history...
183		}
184
185		if ( $switched_locale ) {
186		restore_previous_locale();
187		}
188
189		return true;
190		}
191		endif;
192
193		if ( ! function_exists( 'wp_notify_moderator' ) && Jetpack::is_active() ) :
194		/**
195		* Notifies the moderator of the site about a new comment that is awaiting approval.
196		*
197		* @since 1.0.0
198		*
199		* @global wpdb $wpdb WordPress database abstraction object.
200		*
201		* Uses the {@see 'notify_moderator'} filter to determine whether the site moderator
202		* should be notified, overriding the site setting.
203		*
204		* @param int $comment_id Comment ID.
205		* @return true Always returns true.
206		*/
207		function wp_notify_moderator( $comment_id ) {
208		global $wpdb;
209
210		$maybe_notify = get_option( 'moderation_notify' );
211
212		/** This filter is documented in core/src/wp-includes/pluggable.php */
213		$maybe_notify = apply_filters( 'notify_moderator', $maybe_notify, $comment_id );
214
215		if ( ! $maybe_notify ) {
216		return true;
217		}
218
219		$comment = get_comment( $comment_id );
220		$post = get_post( $comment->comment_post_ID );
221		$user = get_userdata( $post->post_author );
222		// Send to the administration and to the post author if the author can modify the comment.
223		$emails = array( get_option( 'admin_email' ) );
224		if ( $user && user_can( $user->ID, 'edit_comment', $comment_id ) && ! empty( $user->user_email ) ) {
225		if ( 0 !== strcasecmp( $user->user_email, get_option( 'admin_email' ) ) ) {
226		$emails[] = $user->user_email;
227		}
228		}
229
230		$switched_locale = switch_to_locale( get_locale() );
231
232		$comment_author_domain = @gethostbyaddr( $comment->comment_author_IP );
233		$comments_waiting = $wpdb->get_var( "SELECT count(comment_ID) FROM $wpdb->comments WHERE comment_approved = '0'" );
234
235		// The blogname option is escaped with esc_html on the way into the database in sanitize_option
236		// we want to reverse this for the plain text arena of emails.
237		$blogname = wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES );
238		$comment_content = wp_specialchars_decode( $comment->comment_content );
239
240		switch ( $comment->comment_type ) {
241	View Code Duplication	case 'trackback':
242		/* translators: 1: Post title */
243		$notify_message = sprintf( __( 'A new trackback on the post "%s" is waiting for your approval' ), $post->post_title ) . "\r\n";
244		$notify_message .= get_permalink( $comment->comment_post_ID ) . "\r\n\r\n";
245		/* translators: 1: Trackback/pingback website name, 2: website IP address, 3: website hostname */
246		$notify_message .= sprintf( __( 'Website: %1$s (IP address: %2$s, %3$s)' ), $comment->comment_author, $comment->comment_author_IP, $comment_author_domain ) . "\r\n";
247		/* translators: 1: Trackback/pingback/comment author URL */
248		$notify_message .= sprintf( __( 'URL: %s' ), $comment->comment_author_url ) . "\r\n";
249		$notify_message .= __( 'Trackback excerpt: ' ) . "\r\n" . $comment_content . "\r\n\r\n";
250		break;
251	View Code Duplication	case 'pingback':
252		/* translators: 1: Post title */
253		$notify_message = sprintf( __( 'A new pingback on the post "%s" is waiting for your approval' ), $post->post_title ) . "\r\n";
254		$notify_message .= get_permalink( $comment->comment_post_ID ) . "\r\n\r\n";
255		/* translators: 1: Trackback/pingback website name, 2: website IP address, 3: website hostname */
256		$notify_message .= sprintf( __( 'Website: %1$s (IP address: %2$s, %3$s)' ), $comment->comment_author, $comment->comment_author_IP, $comment_author_domain ) . "\r\n";
257		/* translators: 1: Trackback/pingback/comment author URL */
258		$notify_message .= sprintf( __( 'URL: %s' ), $comment->comment_author_url ) . "\r\n";
259		$notify_message .= __( 'Pingback excerpt: ' ) . "\r\n" . $comment_content . "\r\n\r\n";
260		break;
261	View Code Duplication	default: // Comments
262		/* translators: 1: Post title */
263		$notify_message = sprintf( __( 'A new comment on the post "%s" is waiting for your approval' ), $post->post_title ) . "\r\n";
264		$notify_message .= get_permalink( $comment->comment_post_ID ) . "\r\n\r\n";
265		/* translators: 1: Comment author name, 2: comment author's IP address, 3: comment author's hostname */
266		$notify_message .= sprintf( __( 'Author: %1$s (IP address: %2$s, %3$s)' ), $comment->comment_author, $comment->comment_author_IP, $comment_author_domain ) . "\r\n";
267		/* translators: 1: Comment author URL */
268		$notify_message .= sprintf( __( 'Email: %s' ), $comment->comment_author_email ) . "\r\n";
269		/* translators: 1: Trackback/pingback/comment author URL */
270		$notify_message .= sprintf( __( 'URL: %s' ), $comment->comment_author_url ) . "\r\n";
271		/* translators: 1: Comment text */
272		$notify_message .= sprintf( __( 'Comment: %s' ), "\r\n" . $comment_content ) . "\r\n\r\n";
273		break;
274		}
275
276		/** This filter is documented in core/src/wp-includes/pluggable.php */
277		$emails = apply_filters( 'comment_moderation_recipients', $emails, $comment_id );
278
279		function is_user_connected( $email ) {
		0 ignored issues – show Best Practice introduced 2017-11-14 16:44 UTC by Report Bug Copy Issue Report Show Similar Issues like this The function `is_user_connected()` has been defined more than once; this definition is ignored, only the first definition in this file (L79-82) is considered. This check looks for functions that have already been defined in the same file. Some Codebases, like WordPress, make a practice of defining functions multiple times. This may lead to problems with the detection of function parameters and types. If you really need to do this, you can mark the duplicate definition with the `@ignore` annotation. /** * @ignore */ function getUser() { } function getUser($id, $realm) { } See also the PhpDoc documentation for @ignore. Loading history...
280		$user = get_user_by( 'email', $email );
281		return Jetpack::is_user_connected( $user->ID );
282		}
283
284		$moderate_on_wpcom = ! in_array( false, array_map( 'is_user_connected', $emails ) );
285
286		$primary_site_slug = Jetpack::build_raw_urls( get_home_url() );
287
288		/* translators: Comment moderation. 1: Comment action URL */
289		$notify_message .= sprintf(
290		__( 'Approve it: %s' ), $moderate_on_wpcom
291		? "https://wordpress.com/comment/{$primary_site_slug}/{$comment_id}?action=approve"
292		: admin_url( "comment.php?action=approve&c={$comment_id}#wpbody-content" )
293		) . "\r\n";
294
295	View Code Duplication	if ( EMPTY_TRASH_DAYS ) {
296		/* translators: Comment moderation. 1: Comment action URL */
297		$notify_message .= sprintf(
298		__( 'Trash it: %s' ), $moderate_on_wpcom
299		? "https://wordpress.com/comment/{$primary_site_slug}/{$comment_id}?action=trash"
300		: admin_url( "comment.php?action=trash&c={$comment_id}#wpbody-content" )
301		) . "\r\n";
302		} else {
303		/* translators: Comment moderation. 1: Comment action URL */
304		$notify_message .= sprintf(
305		__( 'Delete it: %s' ), $moderate_on_wpcom
306		? "https://wordpress.com/comment/{$primary_site_slug}/{$comment_id}?action=delete"
307		: admin_url( "comment.php?action=delete&c={$comment_id}#wpbody-content" )
308		) . "\r\n";
309		}
310
311		/* translators: Comment moderation. 1: Comment action URL */
312		$notify_message .= sprintf(
313		__( 'Spam it: %s' ), $moderate_on_wpcom
314		? "https://wordpress.com/comment/{$primary_site_slug}/{$comment_id}?action=spam"
315		: admin_url( "comment.php?action=spam&c={$comment_id}#wpbody-content" )
316		) . "\r\n";
317
318		/* translators: Comment moderation. 1: Number of comments awaiting approval */
319		$notify_message .= sprintf(
320		_n(
321		'Currently %s comment is waiting for approval. Please visit the moderation panel:',
322		'Currently %s comments are waiting for approval. Please visit the moderation panel:', $comments_waiting
323		), number_format_i18n( $comments_waiting )
324		) . "\r\n";
325
326		$notify_message .= $moderate_on_wpcom
327		? "https://wordpress.com/comments/pending/{$primary_site_slug}/"
328		: admin_url( 'edit-comments.php?comment_status=moderated#wpbody-content' ) . "\r\n";
329
330		/* translators: Comment moderation notification email subject. 1: Site name, 2: Post title */
331		$subject = sprintf( __( '[%1$s] Please moderate: "%2$s"' ), $blogname, $post->post_title );
332		$message_headers = '';
333
334		/** This filter is documented in core/src/wp-includes/pluggable.php */
335		$notify_message = apply_filters( 'comment_moderation_text', $notify_message, $comment_id );
336
337		/** This filter is documented in core/src/wp-includes/pluggable.php */
338		$subject = apply_filters( 'comment_moderation_subject', $subject, $comment_id );
339
340		/** This filter is documented in core/src/wp-includes/pluggable.php */
341		$message_headers = apply_filters( 'comment_moderation_headers', $message_headers, $comment_id );
342
343		foreach ( $emails as $email ) {
344		@wp_mail( $email, wp_specialchars_decode( $subject ), $notify_message, $message_headers );
		0 ignored issues – show Security Best Practice introduced 2018-01-15 12:23 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like you do not handle an error condition here. This can introduce security issues, and is generally not recommended. If you suppress an error, we recommend checking for the error condition explicitly: // For example instead of @mkdir($dir); // Better use if (@mkdir($dir) === false) { throw new \RuntimeException('The directory '.$dir.' could not be created.'); } Loading history...
345		}
346
347		if ( $switched_locale ) {
348		restore_previous_locale();
349		}
350
351		return true;
352		}
353		endif;
354

Automattic / jetpack

Push — add/double-encode-message ( 8b6530...2d4e84 )

_inc/lib/functions.wp-notify.php (4 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like