source: branches/2.0/include/functions_comment.inc.php @ 4966

Last change on this file since 4966 was 4508, checked in by plg, 14 years ago

bug 1328: implement check_pwg_token for emails on user comments management.

The check_pwg_token and get_pwg_token functions were moved to the public side
(for use on comments.php)

The email sent to admins on new user comment does not directly includes
validate/delete actions.

  • Property svn:eol-style set to LF
  • Property svn:keywords set to Author Date Id Revision
File size: 6.1 KB
Line 
1<?php
2// +-----------------------------------------------------------------------+
3// | Piwigo - a PHP based picture gallery                                  |
4// +-----------------------------------------------------------------------+
5// | Copyright(C) 2008-2009 Piwigo Team                  http://piwigo.org |
6// | Copyright(C) 2003-2008 PhpWebGallery Team    http://phpwebgallery.net |
7// | Copyright(C) 2002-2003 Pierrick LE GALL   http://le-gall.net/pierrick |
8// +-----------------------------------------------------------------------+
9// | This program is free software; you can redistribute it and/or modify  |
10// | it under the terms of the GNU General Public License as published by  |
11// | the Free Software Foundation                                          |
12// |                                                                       |
13// | This program is distributed in the hope that it will be useful, but   |
14// | WITHOUT ANY WARRANTY; without even the implied warranty of            |
15// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      |
16// | General Public License for more details.                              |
17// |                                                                       |
18// | You should have received a copy of the GNU General Public License     |
19// | along with this program; if not, write to the Free Software           |
20// | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, |
21// | USA.                                                                  |
22// +-----------------------------------------------------------------------+
23
24//returns string action to perform on a new comment: validate, moderate, reject
25function user_comment_check($action, $comment)
26{
27  global $conf,$user;
28
29  if ($action=='reject')
30    return $action;
31
32  $my_action = $conf['comment_spam_reject'] ? 'reject':'moderate';
33
34  if ($action==$my_action)
35    return $action;
36
37  // we do here only BASIC spam check (plugins can do more)
38  if ( !is_a_guest() )
39    return $action;
40
41  $link_count = preg_match_all( '/https?:\/\//',
42    $comment['content'], $matches);
43
44  if ( strpos($comment['author'], 'http://')!==false )
45  {
46    $link_count++;
47  }
48
49  if ( $link_count>$conf['comment_spam_max_links'] )
50    return $my_action;
51
52  return $action;
53}
54
55
56add_event_handler('user_comment_check', 'user_comment_check',
57  EVENT_HANDLER_PRIORITY_NEUTRAL, 2);
58
59/**
60 * Tries to insert a user comment in the database and returns one of :
61 * validate, moderate, reject
62 * @param array comm contains author, content, image_id
63 * @param string key secret key sent back to the browser
64 * @param array infos out array of messages
65 */
66function insert_user_comment( &$comm, $key, &$infos )
67{
68  global $conf, $user;
69
70  $comm = array_merge( $comm,
71    array(
72      'ip' => $_SERVER['REMOTE_ADDR'],
73      'agent' => $_SERVER['HTTP_USER_AGENT']
74    )
75   );
76
77  $infos = array();
78  if (!$conf['comments_validation'] or is_admin())
79  {
80    $comment_action='validate'; //one of validate, moderate, reject
81  }
82  else
83  {
84    $comment_action='moderate'; //one of validate, moderate, reject
85  }
86
87  // display author field if the user status is guest or generic
88  if (!is_classic_user())
89  {
90    if ( empty($comm['author']) )
91    {
92      $comm['author'] = 'guest';
93    }
94    // if a guest try to use the name of an already existing user, he must be
95    // rejected
96    if ( $comm['author'] != 'guest' )
97    {
98      $query = '
99SELECT COUNT(*) AS user_exists
100  FROM '.USERS_TABLE.'
101  WHERE '.$conf['user_fields']['username']." = '".addslashes($comm['author'])."'";
102      $row = mysql_fetch_assoc( pwg_query( $query ) );
103      if ( $row['user_exists'] == 1 )
104      {
105        array_push($infos, l10n('comment_user_exists') );
106        $comment_action='reject';
107      }
108    }
109  }
110  else
111  {
112    $comm['author'] = $user['username'];
113  }
114  if ( empty($comm['content']) )
115  { // empty comment content
116    $comment_action='reject';
117  }
118
119  $key = explode( ':', @$key );
120  if ( count($key)!=2
121        or $key[0]>time()-2 // page must have been retrieved more than 2 sec ago
122        or $key[0]<time()-3600 // 60 minutes expiration
123        or hash_hmac(
124              'md5', $key[0].':'.$comm['image_id'], $conf['secret_key']
125            ) != $key[1]
126      )
127  {
128    $comment_action='reject';
129  }
130
131  if ($comment_action!='reject' and $conf['anti-flood_time']>0 )
132  { // anti-flood system
133    $reference_date = time() - $conf['anti-flood_time'];
134    $query = '
135SELECT id FROM '.COMMENTS_TABLE.'
136  WHERE date > FROM_UNIXTIME('.$reference_date.')
137    AND author = "'.addslashes($comm['author']).'"';
138    if ( mysql_num_rows( pwg_query( $query ) ) > 0 )
139    {
140      array_push( $infos, l10n('comment_anti-flood') );
141      $comment_action='reject';
142    }
143  }
144
145  // perform more spam check
146  $comment_action = trigger_event('user_comment_check',
147      $comment_action, $comm
148    );
149
150  if ( $comment_action!='reject' )
151  {
152    $query = '
153INSERT INTO '.COMMENTS_TABLE.'
154  (author, content, date, validated, validation_date, image_id)
155  VALUES (
156    "'.addslashes($comm['author']).'",
157    "'.addslashes($comm['content']).'",
158    NOW(),
159    "'.($comment_action=='validate' ? 'true':'false').'",
160    '.($comment_action=='validate' ? 'NOW()':'NULL').',
161    '.$comm['image_id'].'
162  )
163';
164
165    pwg_query($query);
166
167    $comm['id'] = mysql_insert_id();
168
169    if ($conf['email_admin_on_comment']
170        or ($conf['email_admin_on_comment_validation'] and 'moderate' == $comment_action))
171    {
172      include_once(PHPWG_ROOT_PATH.'include/functions_mail.inc.php');
173
174      $comment_url = get_absolute_root_url().'comments.php?comment_id='.$comm['id'];
175
176      $keyargs_content = array
177      (
178        get_l10n_args('Author: %s', $comm['author']),
179        get_l10n_args('Comment: %s', $comm['content']),
180        get_l10n_args('', ''),
181        get_l10n_args('Manage this user comment: %s', $comment_url)
182      );
183
184      if ('moderate' == $comment_action)
185      {
186        $keyargs_content[] = get_l10n_args('', '');
187        $keyargs_content[] = get_l10n_args('(!) This comment requires validation', '');
188      }
189
190      pwg_mail_notification_admins
191      (
192        get_l10n_args('Comment by %s', $comm['author']),
193        $keyargs_content
194      );
195    }
196  }
197  return $comment_action;
198}
199
200?>
Note: See TracBrowser for help on using the repository browser.