nucleus/libs/COMMENTS.php

   1 <<<<<<< HEAD
   2 <?php\r
   3 \r
   4 /*\r
   5  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   6  * Copyright (C) 2002-2012 The Nucleus Group\r
   7  *\r
   8  * This program is free software; you can redistribute it and/or\r
   9  * modify it under the terms of the GNU General Public License\r
  10  * as published by the Free Software Foundation; either version 2\r
  11  * of the License, or (at your option) any later version.\r
  12  * (see nucleus/documentation/index.html#license for more info)\r
  13  */\r
  14 /**\r
  15  * A class representing the comments (all of them) for a certain post on a ceratin blog\r
  16  *\r
  17  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  18  * @copyright Copyright (C) 2002-2012 The Nucleus Group\r
  19  * @version $Id: COMMENTS.php 1527 2011-06-21 10:43:44Z sakamocchi $\r
  20  */\r
  21 \r
  22 if ( !function_exists('requestVar') ) exit;\r
  23 require_once dirname(__FILE__) . '/COMMENTACTIONS.php';\r
  24 \r
  25 class Comments\r
  26 {\r
  27         // reference to the itemActions object that is calling the showComments function\r
  28         public $itemActions;\r
  29         \r
  30         // item for which comment are being displayed\r
  31         public $itemid;\r
  32         \r
  33         // total amount of comments displayed\r
  34         public $commentcount;\r
  35         \r
  36         /**\r
  37          * Comments::__construct()\r
  38          * Creates a new Comments object for the given blog and item\r
  39          *\r
  40          * @param       integer $itemid id of the item\r
  41          * @return      void\r
  42          */\r
  43         public function __construct($itemid)\r
  44         {\r
  45                 $this->itemid = (integer) $itemid;\r
  46                 return;\r
  47         }\r
  48         \r
  49         /**\r
  50          * Comments::setItemActions()\r
  51          * Used when parsing comments\r
  52          *\r
  53          * @param       object  $itemActions    itemActions object, that will take care of the parsing\r
  54          * @return      void\r
  55          */\r
  56         public function setItemActions(&$itemActions)\r
  57         {\r
  58                 $this->itemActions =& $itemActions;\r
  59                 return;\r
  60         }\r
  61         \r
  62         /**\r
  63          * Comments::showComments()\r
  64          * Shows maximum $max comments to the given item using the given template\r
  65          * returns the amount of shown comments (if maxToShow = -1, then there is no limit)\r
  66          *\r
  67          * @param       array   template        template to use\r
  68          * @param       integer maxToShow       max. comments to show\r
  69          * @param       integer showNone        indicates if the 'no comments' thingie should be outputted\r
  70          *                                                              when there are no comments (useful for closed items)\r
  71          * @param       string  highlight       Highlight to use (if any)\r
  72          * @return      integer number of comments\r
  73          */\r
  74         public function showComments($template, $maxToShow = -1, $showNone = 1, $highlight = '')\r
  75         {\r
  76                 global $CONF, $manager;\r
  77                 \r
  78                 if ( $maxToShow == 0 )\r
  79                 {\r
  80                         $this->commentcount = $this->amountComments();\r
  81                 }\r
  82                 else\r
  83                 {\r
  84                         $query = 'SELECT citem as itemid, cnumber as commentid, cbody as body, cuser as user, cmail as userid, '\r
  85                                . 'cemail as email, cmember as memberid, ctime, chost as host, cip as ip, cblog as blogid '\r
  86                                . 'FROM %s as c WHERE citem=%d ORDER BY ctime';\r
  87                         \r
  88                         $query = sprintf($query, sql_table('comment'), (integer) $this->itemid);\r
  89                         $comments = DB::getResult($query);\r
  90                         $this->commentcount = $comments->rowCount();\r
  91                 }\r
  92                 \r
  93                 // create parser object & action handler\r
  94                 $handler = new CommentActions($this);\r
  95                 $handler->setTemplate($template);\r
  96                 \r
  97                 $parser = new Parser($handler);\r
  98                 \r
  99                 // if no result was found\r
 100                 if ( $this->commentcount == 0 )\r
 101                 {\r
 102                         // note: when no reactions, COMMENTS_HEADER and COMMENTS_FOOTER are _NOT_ used\r
 103                         if ( $showNone )\r
 104                         {\r
 105                                 $parser->parse($template['COMMENTS_NONE']);\r
 106                         }\r
 107                         return 0;\r
 108                 }\r
 109                 \r
 110                 // if too many comments to show\r
 111                 if ( ($maxToShow != -1) && ($this->commentcount > $maxToShow) )\r
 112                 {\r
 113                         $parser->parse($template['COMMENTS_TOOMUCH']);\r
 114                         return 0;\r
 115                 }\r
 116                 \r
 117                 $parser->parse($template['COMMENTS_HEADER']);\r
 118                 \r
 119                 foreach ( $comments as $comment )\r
 120                 {\r
 121                         $comment['timestamp'] = strtotime($comment['ctime']);\r
 122                         $handler->setCurrentComment($comment);\r
 123                         $handler->setHighlight($highlight);\r
 124                         \r
 125                         $manager->notify('PreComment', array('comment' => &$comment));\r
 126                         $parser->parse($template['COMMENTS_BODY']);\r
 127                         $manager->notify('PostComment', array('comment' => &$comment));\r
 128                 }\r
 129                 \r
 130                 $parser->parse($template['COMMENTS_FOOTER']);\r
 131                 \r
 132                 $comments->closeCursor();\r
 133                 \r
 134                 return $this->commentcount;\r
 135         }\r
 136         \r
 137         /**\r
 138          * Comments::amountComments()\r
 139          * Returns the amount of comments for this itemid\r
 140          * \r
 141          * @param       void\r
 142          * @return      integer number of comments\r
 143          */\r
 144         public function amountComments()\r
 145         {\r
 146                 $query = 'SELECT COUNT(*) FROM %s WHERE citem=%d;';\r
 147                 $query = sprintf($query, sql_table('comment'), (integer) $this->itemid);\r
 148                 $res = DB::getValue($query);\r
 149                 \r
 150                 return $res;\r
 151         }\r
 152         \r
 153         /**\r
 154          * Comments::addComment()\r
 155          * Adds a new comment to the database\r
 156          * \r
 157          * @param string $timestamp\r
 158          * @param array $comment\r
 159          * @return mixed\r
 160          */\r
 161         public function addComment($timestamp, $comment)\r
 162         {\r
 163                 global $CONF, $member, $manager;\r
 164                 \r
 165                 $blogid = getBlogIDFromItemID($this->itemid);\r
 166                 \r
 167                 $settings =& $manager->getBlog($blogid);\r
 168                 $settings->readSettings();\r
 169                 \r
 170                 // begin if: comments disabled\r
 171                 if ( !$settings->commentsEnabled() )\r
 172                 {\r
 173                         return _ERROR_COMMENTS_DISABLED;\r
 174                 }\r
 175                 \r
 176                 // begin if: public cannot comment\r
 177                 if ( !$settings->isPublic() && !$member->isLoggedIn() )\r
 178                 {\r
 179                         return _ERROR_COMMENTS_NONPUBLIC;\r
 180                 }\r
 181                 \r
 182                 // begin if: comment uses a protected member name\r
 183                 if ( $CONF['ProtectMemNames'] && !$member->isLoggedIn() && Member::isNameProtected($comment['user']) )\r
 184                 {\r
 185                         return _ERROR_COMMENTS_MEMBERNICK;\r
 186                 }\r
 187                 \r
 188                 // begin if: email required, but missing (doesn't apply to members)\r
 189                 if ( $settings->emailRequired() && i18n::strlen($comment['email']) == 0 && !$member->isLoggedIn() )\r
 190                 {\r
 191                         return _ERROR_EMAIL_REQUIRED;\r
 192                 }\r
 193                 \r
 194                 // begin if: commenter's name is too long\r
 195                 if ( i18n::strlen($comment['user']) > 40 )\r
 196                 {\r
 197                         return _ERROR_USER_TOO_LONG;\r
 198                 }\r
 199                 \r
 200                 // begin if: commenter's email is too long\r
 201                 if ( i18n::strlen($comment['email']) > 100 )\r
 202                 {\r
 203                         return _ERROR_EMAIL_TOO_LONG;\r
 204                 }\r
 205                 \r
 206                 // begin if: commenter's url is too long\r
 207                 if ( i18n::strlen($comment['userid']) > 100 )\r
 208                 {\r
 209                         return _ERROR_URL_TOO_LONG;\r
 210                 }\r
 211                 \r
 212                 $comment['timestamp'] = $timestamp;\r
 213                 $comment['host'] = gethostbyaddr(serverVar('REMOTE_ADDR') );\r
 214                 $comment['ip'] = serverVar('REMOTE_ADDR');\r
 215                 \r
 216                 // begin if: member is logged in, use that data\r
 217                 if ( $member->isLoggedIn() )\r
 218                 {\r
 219                         $comment['memberid'] = $member->getID();\r
 220                         $comment['user'] = '';\r
 221                         $comment['userid'] = '';\r
 222                         $comment['email'] = '';\r
 223                 }\r
 224                 else\r
 225                 {\r
 226                         $comment['memberid'] = 0;\r
 227                 }\r
 228                 \r
 229                 // spam check\r
 230                 $continue = FALSE;\r
 231                 $plugins = array();\r
 232                 \r
 233                 if ( isset($manager->subscriptions['ValidateForm']) )\r
 234                 {\r
 235                         $plugins = array_merge($plugins, $manager->subscriptions['ValidateForm']);\r
 236                 }\r
 237                 \r
 238                 if ( isset($manager->subscriptions['PreAddComment']) )\r
 239                 {\r
 240                         $plugins = array_merge($plugins, $manager->subscriptions['PreAddComment']);\r
 241                 }\r
 242                 \r
 243                 if ( isset($manager->subscriptions['PostAddComment']) )\r
 244                 {\r
 245                         $plugins = array_merge($plugins, $manager->subscriptions['PostAddComment']);\r
 246                 }\r
 247                 \r
 248                 $plugins = array_unique($plugins);\r
 249                 \r
 250                 while ( list(, $plugin) = each($plugins) )\r
 251                 {\r
 252                         $p = $manager->getPlugin($plugin);\r
 253                         $continue = $continue || $p->supportsFeature('handleSpam');\r
 254                 }\r
 255                 \r
 256                 $spamcheck = array(\r
 257                         'type'          => 'comment',\r
 258                         'body'          => $comment['body'],\r
 259                         'id'            => $comment['itemid'],\r
 260                         'live'          => TRUE,\r
 261                         'return'        => $continue\r
 262                 );\r
 263                 \r
 264                 // begin if: member logged in\r
 265                 if ( $member->isLoggedIn() )\r
 266                 {\r
 267                         $spamcheck['author'] = $member->displayname;\r
 268                         $spamcheck['email'] = $member->email;\r
 269                 }\r
 270                 // else: public\r
 271                 else\r
 272                 {\r
 273                         $spamcheck['author'] = $comment['user'];\r
 274                         $spamcheck['email'] = $comment['email'];\r
 275                         $spamcheck['url'] = $comment['userid'];\r
 276                 }\r
 277                 \r
 278                 $manager->notify('SpamCheck', array('spamcheck' => &$spamcheck) );\r
 279                 \r
 280                 if ( !$continue && isset($spamcheck['result']) && $spamcheck['result'] == TRUE )\r
 281                 {\r
 282                         return _ERROR_COMMENTS_SPAM;\r
 283                 }\r
 284                 \r
 285                 // isValidComment returns either "1" or an error message\r
 286                 $isvalid = $this->isValidComment($comment, $spamcheck);\r
 287                 if ( $isvalid != 1 )\r
 288                 {\r
 289                         return $isvalid;\r
 290                 }\r
 291                 \r
 292                 // begin if: send email to notification address\r
 293                 if ( $settings->getNotifyAddress() && $settings->notifyOnComment() )\r
 294                 {\r
 295                 \r
 296                         $message = _NOTIFY_NC_MSG . ' ' . $this->itemid . "\n";\r
 297                         $temp = parse_url($CONF['Self']);\r
 298                         \r
 299                         if ( $temp['scheme'] )\r
 300                         {\r
 301                                 $message .= Link::create_item_link($this->itemid) . "\n\n";\r
 302                         }\r
 303                         else\r
 304                         {\r
 305                                 $tempurl = $settings->getURL();\r
 306                                 \r
 307                                 if ( i18n::substr($tempurl, -1) == '/' || i18n::substr($tempurl, -4) == '.php' )\r
 308                                 {\r
 309                                         $message .= $tempurl . '?itemid=' . $this->itemid . "\n\n";\r
 310                                 }\r
 311                                 else\r
 312                                 {\r
 313                                         $message .= $tempurl . '/?itemid=' . $this->itemid . "\n\n";\r
 314                                 }\r
 315                         }\r
 316                         \r
 317                         if ( $comment['memberid'] == 0 )\r
 318                         {\r
 319                                 $message .= _NOTIFY_USER . ' ' . $comment['user'] . "\n";\r
 320                                 $message .= _NOTIFY_USERID . ' ' . $comment['userid'] . "\n";\r
 321                         }\r
 322                         else\r
 323                         {\r
 324                                 $message .= _NOTIFY_MEMBER .' ' . $member->getDisplayName() . ' (ID=' . $member->getID() . ")\n";\r
 325                         }\r
 326                         \r
 327                         $message .= _NOTIFY_HOST . ' ' . $comment['host'] . "\n";\r
 328                         $message .= _NOTIFY_COMMENT . "\n " . $comment['body'] . "\n";\r
 329                         $message .= NOTIFICATION::get_mail_footer();\r
 330                         \r
 331                         $item =& $manager->getItem($this->itemid, 0, 0);\r
 332                         $subject = _NOTIFY_NC_TITLE . ' ' . strip_tags($item['title']) . ' (' . $this->itemid . ')';\r
 333                         \r
 334                         $from = $member->getNotifyFromMailAddress($comment['email']);\r
 335                         \r
 336                         NOTIFICATION::mail($settings->getNotifyAddress(), $subject, $message, $from, i18n::get_current_charset());\r
 337                 }\r
 338                 \r
 339                 $comment = Comment::prepare($comment);\r
 340                 \r
 341                 $manager->notify('PreAddComment', array('comment' => &$comment, 'spamcheck' => &$spamcheck) );\r
 342                 \r
 343                 $name           = DB::quoteValue($comment['user']);\r
 344                 $url            = DB::quoteValue($comment['userid']);\r
 345                 $email      = DB::quoteValue($comment['email']);\r
 346                 $body           = DB::quoteValue($comment['body']);\r
 347                 $host           = DB::quoteValue($comment['host']);\r
 348                 $ip                     = DB::quoteValue($comment['ip']);\r
 349                 $memberid       = intval($comment['memberid']);\r
 350                 $timestamp      = DB::formatDateTime($comment['timestamp']);\r
 351                 $itemid         = $this->itemid;\r
 352                 \r
 353                 $qSql = 'SELECT COUNT(*) AS result '\r
 354                       . 'FROM ' . sql_table('comment')\r
 355                       . ' WHERE '\r
 356                       .      'cmail   = ' . $url\r
 357                       . ' AND cmember = ' . $memberid\r
 358                       . ' AND cbody   = ' . $body\r
 359                       . ' AND citem   = ' . $itemid\r
 360                       . ' AND cblog   = ' . $blogid;\r
 361                 $result = (integer) DB::getValue($qSql);\r
 362                 \r
 363                 if ( $result > 0 )\r
 364                 {\r
 365                         return _ERROR_BADACTION;\r
 366                 }\r
 367                 \r
 368                 $query = sprintf('INSERT INTO %s (cuser, cmail, cemail, cmember, cbody, citem, ctime, chost, cip, cblog) '\r
 369                         . 'VALUES (%s, %s, %s, %d, %s, %d, %s, %s, %s, %d)'\r
 370                         , sql_table('comment'), $name, $url, $email, $memberid, $body, $itemid, $timestamp, $host, $ip, $blogid);\r
 371                 \r
 372                 DB::execute($query);\r
 373                 \r
 374                 // post add comment\r
 375                 $commentid = DB::getInsertId();\r
 376                 $manager->notify('PostAddComment', array('comment' => &$comment, 'commentid' => &$commentid, 'spamcheck' => &$spamcheck) );\r
 377                 \r
 378                 // succeeded !\r
 379                 return TRUE;\r
 380         }\r
 381         \r
 382         /**\r
 383          * Comments::isValidComment()\r
 384          * Checks if a comment is valid and call plugins\r
 385          * that can check if the comment is a spam comment        \r
 386          * \r
 387          * @param       array   $comment        array with comment elements\r
 388          * @param       array   $spamcheck      array with spamcheck elements\r
 389          * @return      boolean valid or not\r
 390          */\r
 391         private function isValidComment(&$comment, &$spamcheck)\r
 392         {\r
 393                 global $member, $manager;\r
 394                 \r
 395                 // check if there exists a item for this date\r
 396                 $item =& $manager->getItem($this->itemid, 0, 0);\r
 397                 \r
 398                 if ( !$item )\r
 399                 {\r
 400                         return _ERROR_NOSUCHITEM;\r
 401                 }\r
 402                 \r
 403                 if ( $item['closed'] )\r
 404                 {\r
 405                         return _ERROR_ITEMCLOSED;\r
 406                 }\r
 407                 \r
 408                 // don't allow words that are too long\r
 409                 if ( preg_match('/[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}/', $comment['body']) != 0 )\r
 410                 {\r
 411                         return _ERROR_COMMENT_LONGWORD;\r
 412                 }\r
 413                 \r
 414                 // check lengths of comment\r
 415                 if ( i18n::strlen($comment['body']) < 3 )\r
 416                 {\r
 417                         return _ERROR_COMMENT_NOCOMMENT;\r
 418                 }\r
 419                 \r
 420                 if ( i18n::strlen($comment['body']) > 5000 )\r
 421                 {\r
 422                         return _ERROR_COMMENT_TOOLONG;\r
 423                 }\r
 424                 \r
 425                 // only check username if no member logged in\r
 426                 if ( !$member->isLoggedIn() && (i18n::strlen($comment['user']) < 2) )\r
 427                 {\r
 428                         return _ERROR_COMMENT_NOUSERNAME;\r
 429                 }\r
 430                 \r
 431                 if ( (i18n::strlen($comment['email']) != 0) && !NOTIFICATION::address_validation(trim($comment['email'])) )\r
 432                 {\r
 433                         return _ERROR_BADMAILADDRESS;\r
 434                 }\r
 435                 \r
 436                 // let plugins do verification (any plugin which thinks the comment is invalid\r
 437                 // can change 'error' to something other than '1')\r
 438                 $result = 1;\r
 439                 $manager->notify('ValidateForm', array('type' => 'comment', 'comment' => &$comment, 'error' => &$result, 'spamcheck' => &$spamcheck) );\r
 440                 \r
 441                 return $result;\r
 442         }\r
 443 }\r
 444 =======
 445 <?php
 446
 447 /*
 448  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
 449  * Copyright (C) 2002-2009 The Nucleus Group
 450  *
 451  * This program is free software; you can redistribute it and/or
 452  * modify it under the terms of the GNU General Public License
 453  * as published by the Free Software Foundation; either version 2
 454  * of the License, or (at your option) any later version.
 455  * (see nucleus/documentation/index.html#license for more info)
 456  */
 457 /**
 458  * A class representing the comments (all of them) for a certain post on a ceratin blog
 459  *
 460  * @license http://nucleuscms.org/license.txt GNU General Public License
 461  * @copyright Copyright (C) 2002-2009 The Nucleus Group
 462  * @version $Id: COMMENTS.php 1527 2011-06-21 10:43:44Z sakamocchi $
 463  */
 464
 465 if ( !function_exists('requestVar') ) exit;
 466 require_once dirname(__FILE__) . '/COMMENTACTIONS.php';
 467
 468 class Comments
 469 {
 470         // reference to the itemActions object that is calling the showComments function
 471         public $itemActions;
 472
 473         // item for which comment are being displayed
 474         public $itemid;
 475
 476         // total amount of comments displayed
 477         public $commentcount;
 478
 479         /**
 480          * Comments::__construct()
 481          * Creates a new Comments object for the given blog and item
 482          *
 483          * @param       integer $itemid id of the item
 484          * @return      void
 485          */
 486         public function __construct($itemid)
 487         {
 488                 $this->itemid = (integer) $itemid;
 489                 return;
 490         }
 491
 492         /**
 493          * Comments::setItemActions()
 494          * Used when parsing comments
 495          *
 496          * @param       object  $itemActions    itemActions object, that will take care of the parsing
 497          * @return      void
 498          */
 499         public function setItemActions(&$itemActions)
 500         {
 501                 $this->itemActions =& $itemActions;
 502                 return;
 503         }
 504
 505         /**
 506          * Comments::showComments()
 507          * Shows maximum $max comments to the given item using the given template
 508          * returns the amount of shown comments (if maxToShow = -1, then there is no limit)
 509          *
 510          * @param       array   template        template to use
 511          * @param       integer maxToShow       max. comments to show
 512          * @param       integer showNone        indicates if the 'no comments' thingie should be outputted
 513          *                                                              when there are no comments (useful for closed items)
 514          * @param       string  highlight       Highlight to use (if any)
 515          * @return      integer number of comments
 516          */
 517         public function showComments($template, $maxToShow = -1, $showNone = 1, $highlight = '')
 518         {
 519                 global $CONF, $manager;
 520
 521                 if ( $maxToShow == 0 )
 522                 {
 523                         $this->commentcount = $this->amountComments();
 524                 }
 525                 else
 526                 {
 527                         $query = 'SELECT citem as itemid, cnumber as commentid, cbody as body, cuser as user, cmail as userid, '
 528                                . 'cemail as email, cmember as memberid, ctime, chost as host, cip as ip, cblog as blogid '
 529                                . 'FROM %s as c WHERE citem=%d ORDER BY ctime';
 530
 531                         $query = sprintf($query, sql_table('comment'), (integer) $this->itemid);
 532                         $comments = DB::getResult($query);
 533                         $this->commentcount = $comments->rowCount();
 534                 }
 535
 536                 // create parser object & action handler
 537                 $handler = new CommentActions($this);
 538                 $handler->setTemplate($template);
 539
 540                 $parser = new Parser($handler);
 541
 542                 // if no result was found
 543                 if ( $this->commentcount == 0 )
 544                 {
 545                         // note: when no reactions, COMMENTS_HEADER and COMMENTS_FOOTER are _NOT_ used
 546                         if ( $showNone )
 547                         {
 548                                 $parser->parse($template['COMMENTS_NONE']);
 549                         }
 550                         return 0;
 551                 }
 552
 553                 // if too many comments to show
 554                 if ( ($maxToShow != -1) && ($this->commentcount > $maxToShow) )
 555                 {
 556                         $parser->parse($template['COMMENTS_TOOMUCH']);
 557                         return 0;
 558                 }
 559
 560                 $parser->parse($template['COMMENTS_HEADER']);
 561
 562                 foreach ( $comments as $comment )
 563                 {
 564                         $comment['timestamp'] = strtotime($comment['ctime']);
 565                         $handler->setCurrentComment($comment);
 566                         $handler->setHighlight($highlight);
 567
 568                         $data = array('comment' => &$comment);
 569                         $manager->notify('PreComment', $data);
 570                         $parser->parse($template['COMMENTS_BODY']);
 571                         $manager->notify('PostComment', $data);
 572                 }
 573
 574                 $parser->parse($template['COMMENTS_FOOTER']);
 575
 576                 $comments->closeCursor();
 577
 578                 return $this->commentcount;
 579         }
 580
 581         /**
 582          * Comments::amountComments()
 583          * Returns the amount of comments for this itemid
 584          *
 585          * @param       void
 586          * @return      integer number of comments
 587          */
 588         public function amountComments()
 589         {
 590                 $query = 'SELECT COUNT(*) FROM %s WHERE citem=%d;';
 591                 $query = sprintf($query, sql_table('comment'), (integer) $this->itemid);
 592                 $res = DB::getValue($query);
 593
 594                 return $res;
 595         }
 596
 597         /**
 598          * Comments::addComment()
 599          * Adds a new comment to the database
 600          *
 601          * @param string $timestamp
 602          * @param array $comment
 603          * @return mixed
 604          */
 605         public function addComment($timestamp, $comment)
 606         {
 607                 global $CONF, $member, $manager;
 608
 609                 $blogid = getBlogIDFromItemID($this->itemid);
 610
 611                 $settings =& $manager->getBlog($blogid);
 612                 $settings->readSettings();
 613
 614                 // begin if: comments disabled
 615                 if ( !$settings->commentsEnabled() )
 616                 {
 617                         return _ERROR_COMMENTS_DISABLED;
 618                 }
 619
 620                 // begin if: public cannot comment
 621                 if ( !$settings->isPublic() && !$member->isLoggedIn() )
 622                 {
 623                         return _ERROR_COMMENTS_NONPUBLIC;
 624                 }
 625
 626                 // begin if: comment uses a protected member name
 627                 if ( $CONF['ProtectMemNames'] && !$member->isLoggedIn() && Member::isNameProtected($comment['user']) )
 628                 {
 629                         return _ERROR_COMMENTS_MEMBERNICK;
 630                 }
 631
 632                 // begin if: email required, but missing (doesn't apply to members)
 633                 if ( $settings->emailRequired() && i18n::strlen($comment['email']) == 0 && !$member->isLoggedIn() )
 634                 {
 635                         return _ERROR_EMAIL_REQUIRED;
 636                 }
 637
 638                 // begin if: commenter's name is too long
 639                 if ( i18n::strlen($comment['user']) > 40 )
 640                 {
 641                         return _ERROR_USER_TOO_LONG;
 642                 }
 643
 644                 // begin if: commenter's email is too long
 645                 if ( i18n::strlen($comment['email']) > 100 )
 646                 {
 647                         return _ERROR_EMAIL_TOO_LONG;
 648                 }
 649
 650                 // begin if: commenter's url is too long
 651                 if ( i18n::strlen($comment['userid']) > 100 )
 652                 {
 653                         return _ERROR_URL_TOO_LONG;
 654                 }
 655
 656                 $comment['timestamp'] = $timestamp;
 657                 $comment['host'] = gethostbyaddr(serverVar('REMOTE_ADDR') );
 658                 $comment['ip'] = serverVar('REMOTE_ADDR');
 659
 660                 // begin if: member is logged in, use that data
 661                 if ( $member->isLoggedIn() )
 662                 {
 663                         $comment['memberid'] = $member->getID();
 664                         $comment['user'] = '';
 665                         $comment['userid'] = '';
 666                         $comment['email'] = '';
 667                 }
 668                 else
 669                 {
 670                         $comment['memberid'] = 0;
 671                 }
 672
 673                 // spam check
 674                 $continue = FALSE;
 675                 $plugins = array();
 676
 677                 if ( isset($manager->subscriptions['ValidateForm']) )
 678                 {
 679                         $plugins = array_merge($plugins, $manager->subscriptions['ValidateForm']);
 680                 }
 681
 682                 if ( isset($manager->subscriptions['PreAddComment']) )
 683                 {
 684                         $plugins = array_merge($plugins, $manager->subscriptions['PreAddComment']);
 685                 }
 686
 687                 if ( isset($manager->subscriptions['PostAddComment']) )
 688                 {
 689                         $plugins = array_merge($plugins, $manager->subscriptions['PostAddComment']);
 690                 }
 691
 692                 $plugins = array_unique($plugins);
 693
 694                 while ( list(, $plugin) = each($plugins) )
 695                 {
 696                         $p = $manager->getPlugin($plugin);
 697                         $continue = $continue || $p->supportsFeature('handleSpam');
 698                 }
 699
 700                 $spamcheck = array(
 701                         'type'          => 'comment',
 702                         'body'          => $comment['body'],
 703                         'id'            => $comment['itemid'],
 704                         'live'          => TRUE,
 705                         'return'        => $continue
 706                 );
 707
 708                 // begin if: member logged in
 709                 if ( $member->isLoggedIn() )
 710                 {
 711                         $spamcheck['author'] = $member->displayname;
 712                         $spamcheck['email'] = $member->email;
 713                 }
 714                 // else: public
 715                 else
 716                 {
 717                         $spamcheck['author'] = $comment['user'];
 718                         $spamcheck['email'] = $comment['email'];
 719                         $spamcheck['url'] = $comment['userid'];
 720                 }
 721
 722                 $data = array('spamcheck' => &$spamcheck);
 723                 $manager->notify('SpamCheck', $data);
 724
 725                 if ( !$continue && isset($spamcheck['result']) && $spamcheck['result'] == TRUE )
 726                 {
 727                         return _ERROR_COMMENTS_SPAM;
 728                 }
 729
 730                 // isValidComment returns either "1" or an error message
 731                 $isvalid = $this->isValidComment($comment, $spamcheck);
 732                 if ( $isvalid != 1 )
 733                 {
 734                         return $isvalid;
 735                 }
 736
 737                 // begin if: send email to notification address
 738                 if ( $settings->getNotifyAddress() && $settings->notifyOnComment() )
 739                 {
 740
 741                         $message = _NOTIFY_NC_MSG . ' ' . $this->itemid . "\n";
 742                         $temp = parse_url($CONF['Self']);
 743
 744                         if ( $temp['scheme'] )
 745                         {
 746                                 $message .= Link::create_item_link($this->itemid) . "\n\n";
 747                         }
 748                         else
 749                         {
 750                                 $tempurl = $settings->getURL();
 751
 752                                 if ( i18n::substr($tempurl, -1) == '/' || i18n::substr($tempurl, -4) == '.php' )
 753                                 {
 754                                         $message .= $tempurl . '?itemid=' . $this->itemid . "\n\n";
 755                                 }
 756                                 else
 757                                 {
 758                                         $message .= $tempurl . '/?itemid=' . $this->itemid . "\n\n";
 759                                 }
 760                         }
 761
 762                         if ( $comment['memberid'] == 0 )
 763                         {
 764                                 $message .= _NOTIFY_USER . ' ' . $comment['user'] . "\n";
 765                                 $message .= _NOTIFY_USERID . ' ' . $comment['userid'] . "\n";
 766                         }
 767                         else
 768                         {
 769                                 $message .= _NOTIFY_MEMBER .' ' . $member->getDisplayName() . ' (ID=' . $member->getID() . ")\n";
 770                         }
 771
 772                         $message .= _NOTIFY_HOST . ' ' . $comment['host'] . "\n";
 773                         $message .= _NOTIFY_COMMENT . "\n " . $comment['body'] . "\n";
 774                         $message .= NOTIFICATION::get_mail_footer();
 775
 776                         $item =& $manager->getItem($this->itemid, 0, 0);
 777                         $subject = _NOTIFY_NC_TITLE . ' ' . strip_tags($item['title']) . ' (' . $this->itemid . ')';
 778
 779                         $from = $member->getNotifyFromMailAddress($comment['email']);
 780
 781                         NOTIFICATION::mail($settings->getNotifyAddress(), $subject, $message, $from, i18n::get_current_charset());
 782                 }
 783
 784                 $comment = Comment::prepare($comment);
 785
 786                 $data = array('comment' => &$comment, 'spamcheck' => &$spamcheck);
 787                 $manager->notify('PreAddComment', $data);
 788
 789                 $name           = DB::quoteValue($comment['user']);
 790                 $url            = DB::quoteValue($comment['userid']);
 791                 $email          = DB::quoteValue($comment['email']);
 792                 $body           = DB::quoteValue($comment['body']);
 793                 $host           = DB::quoteValue($comment['host']);
 794                 $ip                     = DB::quoteValue($comment['ip']);
 795                 $memberid       = intval($comment['memberid']);
 796                 $timestamp      = DB::formatDateTime($comment['timestamp']);
 797                 $itemid         = $this->itemid;
 798
 799                 $qSql = 'SELECT COUNT(*) AS result '
 800                       . 'FROM ' . sql_table('comment')
 801                       . ' WHERE '
 802                       .      'cmail   = ' . $url
 803                       . ' AND cmember = ' . $memberid
 804                       . ' AND cbody   = ' . $body
 805                       . ' AND citem   = ' . $itemid
 806                       . ' AND cblog   = ' . $blogid;
 807                 $result = (integer) DB::getValue($qSql);
 808
 809                 if ( $result > 0 )
 810                 {
 811                         return _ERROR_BADACTION;
 812                 }
 813
 814                 $query = sprintf('INSERT INTO %s (cuser, cmail, cemail, cmember, cbody, citem, ctime, chost, cip, cblog) '
 815                         . 'VALUES (%s, %s, %s, %d, %s, %d, %s, %s, %s, %d)'
 816                         , sql_table('comment'), $name, $url, $email, $memberid, $body, $itemid, $timestamp, $host, $ip, $blogid);
 817
 818                 DB::execute($query);
 819
 820                 // post add comment
 821                 $commentid = DB::getInsertId();
 822                 $data = array('comment' => &$comment, 'commentid' => &$commentid, 'spamcheck' => &$spamcheck);
 823                 $manager->notify('PostAddComment', $data);
 824
 825                 // succeeded !
 826                 return TRUE;
 827         }
 828
 829         /**
 830          * Comments::isValidComment()
 831          * Checks if a comment is valid and call plugins
 832          * that can check if the comment is a spam comment
 833          *
 834          * @param       array   $comment        array with comment elements
 835          * @param       array   $spamcheck      array with spamcheck elements
 836          * @return      boolean valid or not
 837          */
 838         private function isValidComment(&$comment, &$spamcheck)
 839         {
 840                 global $member, $manager;
 841
 842                 // check if there exists a item for this date
 843                 $item =& $manager->getItem($this->itemid, 0, 0);
 844
 845                 if ( !$item )
 846                 {
 847                         return _ERROR_NOSUCHITEM;
 848                 }
 849
 850                 if ( $item['closed'] )
 851                 {
 852                         return _ERROR_ITEMCLOSED;
 853                 }
 854
 855                 // don't allow words that are too long
 856                 if ( preg_match('/[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}/', $comment['body']) != 0 )
 857                 {
 858                         return _ERROR_COMMENT_LONGWORD;
 859                 }
 860
 861                 // check lengths of comment
 862                 if ( i18n::strlen($comment['body']) < 3 )
 863                 {
 864                         return _ERROR_COMMENT_NOCOMMENT;
 865                 }
 866
 867                 if ( i18n::strlen($comment['body']) > 5000 )
 868                 {
 869                         return _ERROR_COMMENT_TOOLONG;
 870                 }
 871
 872                 // only check username if no member logged in
 873                 if ( !$member->isLoggedIn() && (i18n::strlen($comment['user']) < 2) )
 874                 {
 875                         return _ERROR_COMMENT_NOUSERNAME;
 876                 }
 877
 878                 if ( (i18n::strlen($comment['email']) != 0) && !NOTIFICATION::address_validation(trim($comment['email'])) )
 879                 {
 880                         return _ERROR_BADMAILADDRESS;
 881                 }
 882
 883                 // let plugins do verification (any plugin which thinks the comment is invalid
 884                 // can change 'error' to something other than '1')
 885                 $result = 1;
 886                 $data = array('type' => 'comment', 'comment' => &$comment, 'error' => &$result, 'spamcheck' => &$spamcheck);
 887                 $manager->notify('ValidateForm', $data);
 888
 889                 return $result;
 890         }
 891 }
 892 >>>>>>> skinnable-master