source: trunk/include/functions_comment.inc.php @ 17351

Last change on this file since 17351 was 17351, checked in by mistic100, 12 years ago

feature 2380: add URL for user comment

  • Property svn:eol-style set to LF
File size: 12.4 KB
Line 
1<?php
2// +-----------------------------------------------------------------------+
3// | Piwigo - a PHP based photo gallery                                    |
4// +-----------------------------------------------------------------------+
5// | Copyright(C) 2008-2012 Piwigo Team                  http://piwigo.org |
6// | Copyright(C) 2003-2008 PhpWebGallery Team    http://phpwebgallery.net |
7// | Copyright(C) 2002-2003 Pierrick LE GALL   http://le-gall.net/pierrick |
8// +-----------------------------------------------------------------------+
9// | This program is free software; you can redistribute it and/or modify  |
10// | it under the terms of the GNU General Public License as published by  |
11// | the Free Software Foundation                                          |
12// |                                                                       |
13// | This program is distributed in the hope that it will be useful, but   |
14// | WITHOUT ANY WARRANTY; without even the implied warranty of            |
15// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      |
16// | General Public License for more details.                              |
17// |                                                                       |
18// | You should have received a copy of the GNU General Public License     |
19// | along with this program; if not, write to the Free Software           |
20// | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, |
21// | USA.                                                                  |
22// +-----------------------------------------------------------------------+
23
24//returns string action to perform on a new comment: validate, moderate, reject
25function user_comment_check($action, $comment)
26{
27  global $conf,$user;
28
29  if ($action=='reject')
30    return $action;
31
32  $my_action = $conf['comment_spam_reject'] ? 'reject':'moderate';
33
34  if ($action==$my_action)
35    return $action;
36
37  // we do here only BASIC spam check (plugins can do more)
38  if ( !is_a_guest() )
39    return $action;
40
41  $link_count = preg_match_all( '/https?:\/\//',
42    $comment['content'], $matches);
43
44  if ( strpos($comment['author'], 'http://')!==false )
45  {
46    $link_count++;
47  }
48
49  if ( $link_count>$conf['comment_spam_max_links'] )
50  {
51    $_POST['cr'][] = 'links';
52    return $my_action;
53  }
54  return $action;
55}
56
57
58add_event_handler('user_comment_check', 'user_comment_check',
59  EVENT_HANDLER_PRIORITY_NEUTRAL, 2);
60
61/**
62 * Tries to insert a user comment in the database and returns one of :
63 * validate, moderate, reject
64 * @param array comm contains author, content, image_id
65 * @param string key secret key sent back to the browser
66 * @param array infos out array of messages
67 */
68function insert_user_comment( &$comm, $key, &$infos )
69{
70  global $conf, $user;
71
72  $comm = array_merge( $comm,
73    array(
74      'ip' => $_SERVER['REMOTE_ADDR'],
75      'agent' => $_SERVER['HTTP_USER_AGENT']
76    )
77   );
78
79  $infos = array();
80  if (!$conf['comments_validation'] or is_admin())
81  {
82    $comment_action='validate'; //one of validate, moderate, reject
83  }
84  else
85  {
86    $comment_action='moderate'; //one of validate, moderate, reject
87  }
88
89  // display author field if the user status is guest or generic
90  if (!is_classic_user())
91  {
92    if ( empty($comm['author']) )
93    {
94      $comm['author'] = 'guest';
95    }
96    $comm['author_id'] = $conf['guest_id'];
97    // if a guest try to use the name of an already existing user, he must be
98    // rejected
99    if ( $comm['author'] != 'guest' )
100    {
101      $query = '
102SELECT COUNT(*) AS user_exists
103  FROM '.USERS_TABLE.'
104  WHERE '.$conf['user_fields']['username']." = '".addslashes($comm['author'])."'";
105      $row = pwg_db_fetch_assoc( pwg_query( $query ) );
106      if ( $row['user_exists'] == 1 )
107      {
108        array_push($infos, l10n('This login is already used by another user') );
109        $comment_action='reject';
110      }
111    }
112  }
113  else
114  {
115    $comm['author'] = addslashes($user['username']);
116    $comm['author_id'] = $user['id'];
117  }
118
119  if ( empty($comm['content']) )
120  { // empty comment content
121    $comment_action='reject';
122  }
123
124  if ( !verify_ephemeral_key(@$key, $comm['image_id']) )
125  {
126    $comment_action='reject';
127    $_POST['cr'][] = 'key'; // rvelices: I use this outside to see how spam robots work
128  }
129 
130  // website
131  if ( !empty($comm['website_url']) and !preg_match('/^https?/i', $comm['website_url']) )
132  {
133    $comm['website_url'] = 'http://'.$comm['website_url'];
134  }
135  if ( !empty($comm['website_url']) and !url_check_format($comm['website_url']) )
136  {
137    array_push($infos, l10n('Your website URL is invalid'));
138    $comment_action='reject';
139  }
140 
141  // anonymous id = ip address
142  $ip_components = explode('.', $comm['ip']);
143  if (count($ip_components) > 3)
144  {
145    array_pop($ip_components);
146  }
147  $comm['anonymous_id'] = implode('.', $ip_components);
148
149  if ($comment_action!='reject' and $conf['anti-flood_time']>0 and !is_admin())
150  { // anti-flood system
151    $reference_date = pwg_db_get_flood_period_expression($conf['anti-flood_time']);
152
153    $query = '
154SELECT count(1) FROM '.COMMENTS_TABLE.'
155  WHERE date > '.$reference_date.'
156    AND author_id = '.$comm['author_id'];
157    if (!is_classic_user())
158    {
159      $query.= '
160      AND anonymous_id = "'.$comm['anonymous_id'].'"';
161    }
162    $query.= '
163;';
164
165    list($counter) = pwg_db_fetch_row(pwg_query($query));
166    if ( $counter > 0 )
167    {
168      array_push( $infos, l10n('Anti-flood system : please wait for a moment before trying to post another comment') );
169      $comment_action='reject';
170    }
171  }
172
173  // perform more spam check
174  $comment_action = trigger_event('user_comment_check',
175      $comment_action, $comm
176    );
177
178  if ( $comment_action!='reject' )
179  {
180    $query = '
181INSERT INTO '.COMMENTS_TABLE.'
182  (author, author_id, anonymous_id, content, date, validated, validation_date, image_id, website_url)
183  VALUES (
184    \''.$comm['author'].'\',
185    '.$comm['author_id'].',
186    \''.$comm['anonymous_id'].'\',
187    \''.$comm['content'].'\',
188    NOW(),
189    \''.($comment_action=='validate' ? 'true':'false').'\',
190    '.($comment_action=='validate' ? 'NOW()':'NULL').',
191    '.$comm['image_id'].',
192    '.(!empty($comm['website_url']) ? '\''.$comm['website_url'].'\'' : 'NULL').'
193  )
194';
195
196    pwg_query($query);
197
198    $comm['id'] = pwg_db_insert_id(COMMENTS_TABLE);
199
200    if ( ($conf['email_admin_on_comment'] && 'validate' == $comment_action)
201        or ($conf['email_admin_on_comment_validation'] and 'moderate' == $comment_action))
202    {
203      include_once(PHPWG_ROOT_PATH.'include/functions_mail.inc.php');
204
205      $comment_url = get_absolute_root_url().'comments.php?comment_id='.$comm['id'];
206
207      $keyargs_content = array
208      (
209        get_l10n_args('Author: %s', stripslashes($comm['author']) ),
210        get_l10n_args('Comment: %s', stripslashes($comm['content']) ),
211        get_l10n_args('', ''),
212        get_l10n_args('Manage this user comment: %s', $comment_url)
213      );
214
215      if ('moderate' == $comment_action)
216      {
217        $keyargs_content[] = get_l10n_args('', '');
218        $keyargs_content[] = get_l10n_args('(!) This comment requires validation', '');
219      }
220
221      pwg_mail_notification_admins
222      (
223        get_l10n_args('Comment by %s', stripslashes($comm['author']) ),
224        $keyargs_content
225      );
226    }
227  }
228  return $comment_action;
229}
230
231/**
232 * Tries to delete a user comment in the database
233 * only admin can delete all comments
234 * other users can delete their own comments
235 * so to avoid a new sql request we add author in where clause
236 *
237 * @param int or array of int comment_id
238 */
239function delete_user_comment($comment_id)
240{
241  $user_where_clause = '';
242  if (!is_admin())
243  {
244    $user_where_clause = '   AND author_id = \''.$GLOBALS['user']['id'].'\'';
245  }
246 
247  if (is_array($comment_id))
248    $where_clause = 'id IN('.implode(',', $comment_id).')';
249  else
250    $where_clause = 'id = '.$comment_id;
251   
252  $query = '
253DELETE FROM '.COMMENTS_TABLE.'
254  WHERE '.$where_clause.
255$user_where_clause.'
256;';
257  $result = pwg_query($query);
258 
259  if ($result) 
260  {
261    email_admin('delete', 
262                array('author' => $GLOBALS['user']['username'],
263                      'comment_id' => $comment_id
264                  ));
265  }
266 
267  trigger_action('user_comment_deletion', $comment_id);
268}
269
270/**
271 * Tries to update a user comment in the database
272 * only admin can update all comments
273 * users can edit their own comments if admin allow them
274 * so to avoid a new sql request we add author in where clause
275 *
276 * @param comment_id
277 * @param post_key
278 * @param content
279 */
280
281function update_user_comment($comment, $post_key)
282{
283  global $conf;
284
285  $comment_action = 'validate';
286
287  if ( !verify_ephemeral_key($post_key, $comment['image_id']) )
288  {
289    $comment_action='reject';
290  }
291  elseif (!$conf['comments_validation'] or is_admin()) // should the updated comment must be validated
292  {
293    $comment_action='validate'; //one of validate, moderate, reject
294  }
295  else
296  {
297    $comment_action='moderate'; //one of validate, moderate, reject
298  }
299
300  // perform more spam check
301  $comment_action =
302    trigger_event('user_comment_check',
303                  $comment_action,
304                  array_merge($comment,
305                              array('author' => $GLOBALS['user']['username'])
306                              )
307                  );
308
309  if ( $comment_action!='reject' )
310  {
311    $user_where_clause = '';
312    if (!is_admin())
313    {
314      $user_where_clause = '   AND author_id = \''.
315        $GLOBALS['user']['id'].'\'';
316    }
317
318    $query = '
319UPDATE '.COMMENTS_TABLE.'
320  SET content = \''.$comment['content'].'\',
321      validated = \''.($comment_action=='validate' ? 'true':'false').'\',
322      validation_date = '.($comment_action=='validate' ? 'NOW()':'NULL').'
323  WHERE id = '.$comment['comment_id'].
324$user_where_clause.'
325;';
326    $result = pwg_query($query);
327   
328    // mail admin and ask to validate the comment
329    if ($result and $conf['email_admin_on_comment_validation'] and 'moderate' == $comment_action) 
330    {
331      include_once(PHPWG_ROOT_PATH.'include/functions_mail.inc.php');
332
333      $comment_url = get_absolute_root_url().'comments.php?comment_id='.$comment['comment_id'];
334
335      $keyargs_content = array
336      (
337        get_l10n_args('Author: %s', stripslashes($GLOBALS['user']['username']) ),
338        get_l10n_args('Comment: %s', stripslashes($comment['content']) ),
339        get_l10n_args('', ''),
340        get_l10n_args('Manage this user comment: %s', $comment_url),
341        get_l10n_args('', ''),
342        get_l10n_args('(!) This comment requires validation', ''),
343      );
344
345      pwg_mail_notification_admins
346      (
347        get_l10n_args('Comment by %s', stripslashes($GLOBALS['user']['username']) ),
348        $keyargs_content
349      );
350    }
351    // just mail admin
352    else if ($result)
353    {
354      email_admin('edit', array('author' => $GLOBALS['user']['username'],
355                                'content' => stripslashes($comment['content'])) );
356    }
357  }
358 
359  return $comment_action;
360}
361
362function email_admin($action, $comment)
363{
364  global $conf;
365
366  if (!in_array($action, array('edit', 'delete'))
367      or (($action=='edit') and !$conf['email_admin_on_comment_edition'])
368      or (($action=='delete') and !$conf['email_admin_on_comment_deletion']))
369  {
370    return;
371  }
372
373  include_once(PHPWG_ROOT_PATH.'include/functions_mail.inc.php');
374
375  $keyargs_content = array();
376  $keyargs_content[] = get_l10n_args('Author: %s', $comment['author']);
377  if ($action=='delete')
378  {
379    $keyargs_content[] = get_l10n_args('This author removed the comment with id %d',
380                                       $comment['comment_id']
381                                       );
382  }
383  else
384  {
385    $keyargs_content[] = get_l10n_args('This author modified following comment:', '');
386    $keyargs_content[] = get_l10n_args('Comment: %s', $comment['content']);
387  }
388
389  pwg_mail_notification_admins(get_l10n_args('Comment by %s',
390                                             $comment['author']),
391                               $keyargs_content
392                               );
393}
394
395function get_comment_author_id($comment_id, $die_on_error=true)
396{
397  $query = '
398SELECT
399    author_id
400  FROM '.COMMENTS_TABLE.'
401  WHERE id = '.$comment_id.'
402;';
403  $result = pwg_query($query);
404  if (pwg_db_num_rows($result) == 0)
405  {
406    if ($die_on_error)
407    {
408      fatal_error('Unknown comment identifier');
409    }
410    else
411    {
412      return false;
413    }
414  }
415 
416  list($author_id) = pwg_db_fetch_row($result);
417
418  return $author_id;
419}
420
421/**
422 * Tries to validate a user comment in the database
423 * @param int or array of int comment_id
424 */
425function validate_user_comment($comment_id)
426{
427  if (is_array($comment_id))
428    $where_clause = 'id IN('.implode(',', $comment_id).')';
429  else
430    $where_clause = 'id = '.$comment_id;
431   
432  $query = '
433UPDATE '.COMMENTS_TABLE.'
434  SET validated = \'true\'
435    , validation_date = NOW()
436  WHERE '.$where_clause.'
437;';
438  pwg_query($query);
439 
440  trigger_action('user_comment_validation', $comment_id);
441}
442?>
Note: See TracBrowser for help on using the repository browser.