@@ -243,7 +243,7 @@ discard block |
||
| 243 | 243 | if(!$comment->getSecurityToken()->checkRequest($this->request)) return $this->httpError(400); |
| 244 | 244 | |
| 245 | 245 | $comment->markSpam(); |
| 246 | - return $this->renderChangedCommentState($comment); |
|
| 246 | + return $this->renderChangedCommentState($comment); |
|
| 247 | 247 | } |
| 248 | 248 | |
| 249 | 249 | /** |
@@ -258,7 +258,7 @@ discard block |
||
| 258 | 258 | if(!$comment->getSecurityToken()->checkRequest($this->request)) return $this->httpError(400); |
| 259 | 259 | |
| 260 | 260 | $comment->markApproved(); |
| 261 | - return $this->renderChangedCommentState($comment); |
|
| 261 | + return $this->renderChangedCommentState($comment); |
|
| 262 | 262 | } |
| 263 | 263 | |
| 264 | 264 | /** |
@@ -273,36 +273,36 @@ discard block |
||
| 273 | 273 | if(!$comment->getSecurityToken()->checkRequest($this->request)) return $this->httpError(400); |
| 274 | 274 | |
| 275 | 275 | $comment->markApproved(); |
| 276 | - return $this->renderChangedCommentState($comment); |
|
| 276 | + return $this->renderChangedCommentState($comment); |
|
| 277 | 277 | } |
| 278 | 278 | |
| 279 | - /** |
|
| 280 | - * Redirect back to referer if available, ensuring that only site URLs |
|
| 281 | - * are allowed to avoid phishing. If it's an AJAX request render the |
|
| 282 | - * comment in it's new state |
|
| 283 | - */ |
|
| 284 | - private function renderChangedCommentState($comment) { |
|
| 285 | - $referer = $this->request->getHeader('Referer'); |
|
| 286 | - |
|
| 287 | - // Render comment using AJAX |
|
| 288 | - if ($this->request->isAjax()) { |
|
| 289 | - return $comment->renderWith('CommentsInterface_singlecomment'); |
|
| 290 | - } else { |
|
| 291 | - // Redirect to either the comment or start of the page |
|
| 292 | - if (empty($referer)) { |
|
| 293 | - return $this->redirectBack(); |
|
| 294 | - } else { |
|
| 295 | - // Redirect to the comment, but check for phishing |
|
| 296 | - $url = $referer . '#comment-' . $comment->ID; |
|
| 297 | - // absolute redirection URLs not located on this site may cause phishing |
|
| 298 | - if(Director::is_site_url($url)) { |
|
| 299 | - return $this->redirect($url); |
|
| 300 | - } else { |
|
| 301 | - return false; |
|
| 302 | - } |
|
| 303 | - } |
|
| 304 | - } |
|
| 305 | - } |
|
| 279 | + /** |
|
| 280 | + * Redirect back to referer if available, ensuring that only site URLs |
|
| 281 | + * are allowed to avoid phishing. If it's an AJAX request render the |
|
| 282 | + * comment in it's new state |
|
| 283 | + */ |
|
| 284 | + private function renderChangedCommentState($comment) { |
|
| 285 | + $referer = $this->request->getHeader('Referer'); |
|
| 286 | + |
|
| 287 | + // Render comment using AJAX |
|
| 288 | + if ($this->request->isAjax()) { |
|
| 289 | + return $comment->renderWith('CommentsInterface_singlecomment'); |
|
| 290 | + } else { |
|
| 291 | + // Redirect to either the comment or start of the page |
|
| 292 | + if (empty($referer)) { |
|
| 293 | + return $this->redirectBack(); |
|
| 294 | + } else { |
|
| 295 | + // Redirect to the comment, but check for phishing |
|
| 296 | + $url = $referer . '#comment-' . $comment->ID; |
|
| 297 | + // absolute redirection URLs not located on this site may cause phishing |
|
| 298 | + if(Director::is_site_url($url)) { |
|
| 299 | + return $this->redirect($url); |
|
| 300 | + } else { |
|
| 301 | + return false; |
|
| 302 | + } |
|
| 303 | + } |
|
| 304 | + } |
|
| 305 | + } |
|
| 306 | 306 | |
| 307 | 307 | /** |
| 308 | 308 | * Returns the comment referenced in the URL (by ID). Permission checking |