nucleus/libs/COMMENTS.php

   1 <?php\r
   2 \r
   3 /*\r
   4  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   5  * Copyright (C) 2002-2012 The Nucleus Group\r
   6  *\r
   7  * This program is free software; you can redistribute it and/or\r
   8  * modify it under the terms of the GNU General Public License\r
   9  * as published by the Free Software Foundation; either version 2\r
  10  * of the License, or (at your option) any later version.\r
  11  * (see nucleus/documentation/index.html#license for more info)\r
  12  */\r
  13 /**\r
  14  * A class representing the comments (all of them) for a certain post on a ceratin blog\r
  15  *\r
  16  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  17  * @copyright Copyright (C) 2002-2012 The Nucleus Group\r
  18  * @version $Id: COMMENTS.php 1527 2011-06-21 10:43:44Z sakamocchi $\r
  19  */\r
  20 \r
  21 if ( !function_exists('requestVar') ) exit;\r
  22 require_once dirname(__FILE__) . '/COMMENTACTIONS.php';\r
  23 \r
  24 class Comments\r
  25 {\r
  26 \r
  27         // item for which comment are being displayed\r
  28         var $itemid;\r
  29 \r
  30         // reference to the itemActions object that is calling the showComments function\r
  31         var $itemActions;\r
  32 \r
  33         // total amount of comments displayed\r
  34         var $commentcount;\r
  35 \r
  36         /**\r
  37          * Creates a new Comments object for the given blog and item\r
  38          *\r
  39          * @param $itemid\r
  40          *              id of the item\r
  41          */\r
  42         function COMMENTS($itemid) {\r
  43                 $this->itemid = intval($itemid);\r
  44         }\r
  45         \r
  46         /**\r
  47          * Used when parsing comments\r
  48          *\r
  49          * @param $itemActions\r
  50          *              itemActions object, that will take care of the parsing\r
  51          */\r
  52         function setItemActions(&$itemActions) {\r
  53                 $this->itemActions =& $itemActions;\r
  54         }\r
  55 \r
  56         /**\r
  57          * Shows maximum $max comments to the given item using the given template\r
  58          * returns the amount of shown comments (if maxToShow = -1, then there is no limit)\r
  59          *\r
  60          * @param template\r
  61          *              template to use\r
  62          * @param maxToShow\r
  63          *              max. comments to show\r
  64          * @param showNone\r
  65          *              indicates if the 'no comments' thingie should be outputted when there are no comments\r
  66          *              (useful for closed items)\r
  67          * @param highlight\r
  68          *              Highlight to use (if any)\r
  69          */\r
  70         function showComments($template, $maxToShow = -1, $showNone = 1, $highlight = '') {\r
  71                 global $CONF, $manager;\r
  72 \r
  73                 // create parser object & action handler\r
  74                 $handler = new CommentActions($this);\r
  75                 $handler->setTemplate($template);\r
  76                 \r
  77                 $parser = new Parser($handler);\r
  78                 \r
  79                 if ($maxToShow == 0) {\r
  80                         $this->commentcount = $this->amountComments();\r
  81                 } else {\r
  82                         $query =  'SELECT c.citem as itemid, c.cnumber as commentid, c.cbody as body, c.cuser as user, c.cmail as userid, c.cemail as email, c.cmember as memberid, c.ctime, c.chost as host, c.cip as ip, c.cblog as blogid'\r
  83                                    . ' FROM '.sql_table('comment').' as c'\r
  84                                    . ' WHERE c.citem=' . $this->itemid\r
  85                                    . ' ORDER BY c.ctime';\r
  86 \r
  87                         $comments = DB::getResult($query);\r
  88                         $this->commentcount = $comments->rowCount();\r
  89                 }\r
  90 \r
  91                 // if no result was found\r
  92                 if ($this->commentcount == 0) {\r
  93                         // note: when no reactions, COMMENTS_HEADER and COMMENTS_FOOTER are _NOT_ used\r
  94                         if ($showNone) $parser->parse($template['COMMENTS_NONE']);\r
  95                         return 0;\r
  96                 }\r
  97 \r
  98                 // if too many comments to show\r
  99                 if (($maxToShow != -1) && ($this->commentcount > $maxToShow)) {\r
 100                         $parser->parse($template['COMMENTS_TOOMUCH']);\r
 101                         return 0;\r
 102                 }\r
 103 \r
 104                 $parser->parse($template['COMMENTS_HEADER']);\r
 105 \r
 106                 foreach ( $comments as $comment ) {\r
 107                         $comment['timestamp'] = strtotime($comment['ctime']);\r
 108                         $handler->setCurrentComment($comment);\r
 109                         $handler->setHighlight($highlight);\r
 110                         $manager->notify('PreComment', array('comment' => &$comment));\r
 111                         $parser->parse($template['COMMENTS_BODY']);\r
 112                         $manager->notify('PostComment', array('comment' => &$comment));\r
 113                 }\r
 114 \r
 115                 $parser->parse($template['COMMENTS_FOOTER']);\r
 116 \r
 117                 $comments->closeCursor();\r
 118 \r
 119                 return $this->commentcount;\r
 120         }\r
 121 \r
 122         /**\r
 123          * Returns the amount of comments for this itemid\r
 124          */\r
 125         function amountComments() {\r
 126                 $query =  'SELECT COUNT(*)'\r
 127                            . ' FROM '.sql_table('comment').' as c'\r
 128                            . ' WHERE c.citem='. $this->itemid;\r
 129                 $res = DB::getValue($query);\r
 130 \r
 131                 return $res;\r
 132         }\r
 133 \r
 134         /**\r
 135          * Comments::addComment()\r
 136          * Adds a new comment to the database\r
 137          * \r
 138          * @param string $timestamp\r
 139          * @param array $comment\r
 140          * @return mixed\r
 141          */\r
 142         function addComment($timestamp, $comment)\r
 143         {\r
 144                 global $CONF, $member, $manager;\r
 145                 \r
 146                 $blogid = getBlogIDFromItemID($this->itemid);\r
 147                 \r
 148                 $settings =& $manager->getBlog($blogid);\r
 149                 $settings->readSettings();\r
 150                 \r
 151                 // begin if: comments disabled\r
 152                 if ( !$settings->commentsEnabled() )\r
 153                 {\r
 154                         return _ERROR_COMMENTS_DISABLED;\r
 155                 }\r
 156                 \r
 157                 // begin if: public cannot comment\r
 158                 if ( !$settings->isPublic() && !$member->isLoggedIn() )\r
 159                 {\r
 160                         return _ERROR_COMMENTS_NONPUBLIC;\r
 161                 }\r
 162                 \r
 163                 // begin if: comment uses a protected member name\r
 164                 if ( $CONF['ProtectMemNames'] && !$member->isLoggedIn() && Member::isNameProtected($comment['user']) )\r
 165                 {\r
 166                         return _ERROR_COMMENTS_MEMBERNICK;\r
 167                 }\r
 168                 \r
 169                 // begin if: email required, but missing (doesn't apply to members)\r
 170                 if ( $settings->emailRequired() && i18n::strlen($comment['email']) == 0 && !$member->isLoggedIn() )\r
 171                 {\r
 172                         return _ERROR_EMAIL_REQUIRED;\r
 173                 }\r
 174                 \r
 175                 // begin if: commenter's name is too long\r
 176                 if ( i18n::strlen($comment['user']) > 40 )\r
 177                 {\r
 178                         return _ERROR_USER_TOO_LONG;\r
 179                 }\r
 180                 \r
 181                 // begin if: commenter's email is too long\r
 182                 if ( i18n::strlen($comment['email']) > 100 )\r
 183                 {\r
 184                         return _ERROR_EMAIL_TOO_LONG;\r
 185                 }\r
 186                 \r
 187                 // begin if: commenter's url is too long\r
 188                 if ( i18n::strlen($comment['userid']) > 100 )\r
 189                 {\r
 190                         return _ERROR_URL_TOO_LONG;\r
 191                 }\r
 192                 \r
 193                 $comment['timestamp'] = $timestamp;\r
 194                 $comment['host'] = gethostbyaddr(serverVar('REMOTE_ADDR') );\r
 195                 $comment['ip'] = serverVar('REMOTE_ADDR');\r
 196                 \r
 197                 // begin if: member is logged in, use that data\r
 198                 if ( $member->isLoggedIn() )\r
 199                 {\r
 200                         $comment['memberid'] = $member->getID();\r
 201                         $comment['user'] = '';\r
 202                         $comment['userid'] = '';\r
 203                         $comment['email'] = '';\r
 204                 }\r
 205                 else\r
 206                 {\r
 207                         $comment['memberid'] = 0;\r
 208                 }\r
 209                 \r
 210                 // spam check\r
 211                 $continue = FALSE;\r
 212                 $plugins = array();\r
 213                 \r
 214                 if ( isset($manager->subscriptions['ValidateForm']) )\r
 215                 {\r
 216                         $plugins = array_merge($plugins, $manager->subscriptions['ValidateForm']);\r
 217                 }\r
 218                 \r
 219                 if ( isset($manager->subscriptions['PreAddComment']) )\r
 220                 {\r
 221                         $plugins = array_merge($plugins, $manager->subscriptions['PreAddComment']);\r
 222                 }\r
 223                 \r
 224                 if ( isset($manager->subscriptions['PostAddComment']) )\r
 225                 {\r
 226                         $plugins = array_merge($plugins, $manager->subscriptions['PostAddComment']);\r
 227                 }\r
 228                 \r
 229                 $plugins = array_unique($plugins);\r
 230                 \r
 231                 while ( list(, $plugin) = each($plugins) )\r
 232                 {\r
 233                         $p = $manager->getPlugin($plugin);\r
 234                         $continue = $continue || $p->supportsFeature('handleSpam');\r
 235                 }\r
 236 \r
 237                 $spamcheck = array(\r
 238                         'type'          => 'comment',\r
 239                         'body'          => $comment['body'],\r
 240                         'id'        => $comment['itemid'],\r
 241                         'live'          => TRUE,\r
 242                         'return'        => $continue\r
 243                 );\r
 244                 \r
 245                 // begin if: member logged in\r
 246                 if ( $member->isLoggedIn() )\r
 247                 {\r
 248                         $spamcheck['author'] = $member->displayname;\r
 249                         $spamcheck['email'] = $member->email;\r
 250                 }\r
 251                 // else: public\r
 252                 else\r
 253                 {\r
 254                         $spamcheck['author'] = $comment['user'];\r
 255                         $spamcheck['email'] = $comment['email'];\r
 256                         $spamcheck['url'] = $comment['userid'];\r
 257                 }\r
 258                 \r
 259                 $manager->notify('SpamCheck', array('spamcheck' => &$spamcheck) );\r
 260                 \r
 261                 if ( !$continue && isset($spamcheck['result']) && $spamcheck['result'] == TRUE )\r
 262                 {\r
 263                         return _ERROR_COMMENTS_SPAM;\r
 264                 }\r
 265                 \r
 266                 // isValidComment returns either "1" or an error message\r
 267                 $isvalid = $this->isValidComment($comment, $spamcheck);\r
 268                 \r
 269                 if ( $isvalid != 1 )\r
 270                 {\r
 271                         return $isvalid;\r
 272                 }\r
 273                 \r
 274                 // begin if: send email to notification address\r
 275                 if ( $settings->getNotifyAddress() && $settings->notifyOnComment() )\r
 276                 {\r
 277                 \r
 278                         $message = _NOTIFY_NC_MSG . ' ' . $this->itemid . "\n";\r
 279                         $temp = parse_url($CONF['Self']);\r
 280                         \r
 281                         if ( $temp['scheme'] )\r
 282                         {\r
 283                                 $message .= Link::create_item_link($this->itemid) . "\n\n";\r
 284                         }\r
 285                         else\r
 286                         {\r
 287                                 $tempurl = $settings->getURL();\r
 288                                 \r
 289                                 if ( i18n::substr($tempurl, -1) == '/' || i18n::substr($tempurl, -4) == '.php' )\r
 290                                 {\r
 291                                         $message .= $tempurl . '?itemid=' . $this->itemid . "\n\n";\r
 292                                 }\r
 293                                 else\r
 294                                 {\r
 295                                         $message .= $tempurl . '/?itemid=' . $this->itemid . "\n\n";\r
 296                                 }\r
 297                         }\r
 298                         \r
 299                         if ( $comment['memberid'] == 0 )\r
 300                         {\r
 301                                 $message .= _NOTIFY_USER . ' ' . $comment['user'] . "\n";\r
 302                                 $message .= _NOTIFY_USERID . ' ' . $comment['userid'] . "\n";\r
 303                         }\r
 304                         else\r
 305                         {\r
 306                                 $message .= _NOTIFY_MEMBER .' ' . $member->getDisplayName() . ' (ID=' . $member->getID() . ")\n";\r
 307                         }\r
 308                         \r
 309                         $message .= _NOTIFY_HOST . ' ' . $comment['host'] . "\n";\r
 310                         $message .= _NOTIFY_COMMENT . "\n " . $comment['body'] . "\n";\r
 311                         $message .= NOTIFICATION::get_mail_footer();\r
 312                         \r
 313                         $item =& $manager->getItem($this->itemid, 0, 0);\r
 314                         $subject = _NOTIFY_NC_TITLE . ' ' . strip_tags($item['title']) . ' (' . $this->itemid . ')';\r
 315                         \r
 316                         $from = $member->getNotifyFromMailAddress($comment['email']);\r
 317                         \r
 318                         NOTIFICATION::mail($settings->getNotifyAddress(), $subject, $message, $from, i18n::get_current_charset());\r
 319                 }\r
 320                 \r
 321                 $comment = Comment::prepare($comment);\r
 322                 \r
 323                 $manager->notify('PreAddComment', array('comment' => &$comment, 'spamcheck' => &$spamcheck) );\r
 324                 \r
 325                 $name           = DB::quoteValue($comment['user']);\r
 326                 $url            = DB::quoteValue($comment['userid']);\r
 327                 $email      = DB::quoteValue($comment['email']);\r
 328                 $body           = DB::quoteValue($comment['body']);\r
 329                 $host           = DB::quoteValue($comment['host']);\r
 330                 $ip                     = DB::quoteValue($comment['ip']);\r
 331                 $memberid       = intval($comment['memberid']);\r
 332                 $timestamp      = DB::formatDateTime($comment['timestamp']);\r
 333                 $itemid         = $this->itemid;\r
 334                 \r
 335                 $qSql       = 'SELECT COUNT(*) AS result '\r
 336                                         . 'FROM ' . sql_table('comment')\r
 337                                         . ' WHERE '\r
 338                                         .      'cmail   = ' . $url\r
 339                                         . ' AND cmember = ' . $memberid\r
 340                                         . ' AND cbody   = ' . $body\r
 341                                         . ' AND citem   = ' . $itemid\r
 342                                         . ' AND cblog   = ' . $blogid;\r
 343                 $result     = (integer) DB::getValue($qSql);\r
 344                 \r
 345                 if ( $result > 0 )\r
 346                 {\r
 347                         return _ERROR_BADACTION;\r
 348                 }\r
 349                 \r
 350                 $query = sprintf('INSERT INTO %s (cuser, cmail, cemail, cmember, cbody, citem, ctime, chost, cip, cblog) '\r
 351                         . 'VALUES (%s, %s, %s, %d, %s, %d, %s, %s, %s, %d)'\r
 352                         , sql_table('comment'), $name, $url, $email, $memberid, $body, $itemid, $timestamp, $host, $ip, $blogid);\r
 353                 \r
 354                 DB::execute($query);\r
 355                 \r
 356                 // post add comment\r
 357                 $commentid = DB::getInsertId();\r
 358                 $manager->notify('PostAddComment', array('comment' => &$comment, 'commentid' => &$commentid, 'spamcheck' => &$spamcheck) );\r
 359                 \r
 360                 // succeeded !\r
 361                 return TRUE;\r
 362         }\r
 363 \r
 364 \r
 365         /**\r
 366          * Comments::isValidComment()\r
 367          * Checks if a comment is valid and call plugins\r
 368          * that can check if the comment is a spam comment        \r
 369          * \r
 370          * @param       Array   $comment        array with comment elements\r
 371          * @param       Array   $spamcheck      array with spamcheck elements\r
 372          */\r
 373         function isValidComment(&$comment, &$spamcheck)\r
 374         {\r
 375                 global $member, $manager;\r
 376                 \r
 377                 // check if there exists a item for this date\r
 378                 $item =& $manager->getItem($this->itemid, 0, 0);\r
 379                 \r
 380                 if ( !$item )\r
 381                 {\r
 382                         return _ERROR_NOSUCHITEM;\r
 383                 }\r
 384                 \r
 385                 if ( $item['closed'] )\r
 386                 {\r
 387                         return _ERROR_ITEMCLOSED;\r
 388                 }\r
 389                 \r
 390                 // don't allow words that are too long\r
 391                 if ( preg_match('/[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}/', $comment['body']) != 0 )\r
 392                 {\r
 393                         return _ERROR_COMMENT_LONGWORD;\r
 394                 }\r
 395                 \r
 396                 // check lengths of comment\r
 397                 if ( i18n::strlen($comment['body']) < 3 )\r
 398                 {\r
 399                         return _ERROR_COMMENT_NOCOMMENT;\r
 400                 }\r
 401                 \r
 402                 if ( i18n::strlen($comment['body']) > 5000 )\r
 403                 {\r
 404                         return _ERROR_COMMENT_TOOLONG;\r
 405                 }\r
 406                 \r
 407                 // only check username if no member logged in\r
 408                 if ( !$member->isLoggedIn() && (i18n::strlen($comment['user']) < 2) )\r
 409                 {\r
 410                         return _ERROR_COMMENT_NOUSERNAME;\r
 411                 }\r
 412                 \r
 413                 if ( (i18n::strlen($comment['email']) != 0) && !NOTIFICATION::address_validation(trim($comment['email'])) )\r
 414                 {\r
 415                         return _ERROR_BADMAILADDRESS;\r
 416                 }\r
 417                 \r
 418                 // let plugins do verification (any plugin which thinks the comment is invalid\r
 419                 // can change 'error' to something other than '1')\r
 420                 $result = 1;\r
 421                 $manager->notify('ValidateForm', array('type' => 'comment', 'comment' => &$comment, 'error' => &$result, 'spamcheck' => &$spamcheck) );\r
 422                 \r
 423                 return $result;\r
 424         }\r
 425 }\r