root/branches/2.1/wp-includes/comment.php

<?php

function check_comment($author, $email, $url, $comment, $user_ip, $user_agent, $comment_type) {
    global $wpdb;

    if ( 1 == get_option('comment_moderation') )
        return false; // If moderation is set to manual

    if ( preg_match_all("|(href\t*?=\t*?['\"]?)?(https?:)?//|i", $comment, $out) >= get_option('comment_max_links') )
        return false; // Check # of external links

    $mod_keys = trim(get_option('moderation_keys'));
    if ( !empty($mod_keys) ) {
        $words = explode("\n", $mod_keys );

        foreach ($words as $word) {
            $word = trim($word);

            // Skip empty lines
            if ( empty($word) )
                continue;

            // Do some escaping magic so that '#' chars in the
            // spam words don't break things:
            $word = preg_quote($word, '#');

            $pattern = "#$word#i";
            if ( preg_match($pattern, $author) ) return false;
            if ( preg_match($pattern, $email) ) return false;
            if ( preg_match($pattern, $url) ) return false;
            if ( preg_match($pattern, $comment) ) return false;
            if ( preg_match($pattern, $user_ip) ) return false;
            if ( preg_match($pattern, $user_agent) ) return false;
        }
    }

    // Comment whitelisting:
    if ( 1 == get_option('comment_whitelist')) {
        if ( 'trackback' == $comment_type || 'pingback' == $comment_type ) { // check if domain is in blogroll
            $uri = parse_url($url);
            $domain = $uri['host'];
            $uri = parse_url( get_option('home') );
            $home_domain = $uri['host'];
            if ( $wpdb->get_var("SELECT link_id FROM $wpdb->links WHERE link_url LIKE ('%$domain%') LIMIT 1") || $domain == $home_domain )
                return true;
            else
                return false;
        } elseif ( $author != '' && $email != '' ) {
            $ok_to_comment = $wpdb->get_var("SELECT comment_approved FROM $wpdb->comments WHERE comment_author = '$author' AND comment_author_email = '$email' and comment_approved = '1' LIMIT 1");
            if ( ( 1 == $ok_to_comment ) &&
                ( empty($mod_keys) || false === strpos( $email, $mod_keys) ) )
                    return true;
            else
                return false;
        } else {
            return false;
        }
    }
    return true;
}


function get_approved_comments($post_id) {
    global $wpdb;

    $post_id = (int) $post_id;
    return $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = '$post_id' AND comment_approved = '1' ORDER BY comment_date");
}


// Retrieves comment data given a comment ID or comment object.
// Handles comment caching.
function &get_comment(&$comment, $output = OBJECT) {
    global $comment_cache, $wpdb;

    if ( empty($comment) )
        return null;

    if ( is_object($comment) ) {
        if ( !isset($comment_cache[$comment->comment_ID]) )
            $comment_cache[$comment->comment_ID] = &$comment;
        $_comment = & $comment_cache[$comment->comment_ID];
    } else {
        $comment = (int) $comment;
        if ( !isset($comment_cache[$comment]) ) {
            $_comment = $wpdb->get_row("SELECT * FROM $wpdb->comments WHERE comment_ID = '$comment' LIMIT 1");
            $comment_cache[$comment->comment_ID] = & $_comment;
        } else {
            $_comment = & $comment_cache[$comment];
        }
    }

    if ( $output == OBJECT ) {
        return $_comment;
    } elseif ( $output == ARRAY_A ) {
        return get_object_vars($_comment);
    } elseif ( $output == ARRAY_N ) {
        return array_values(get_object_vars($_comment));
    } else {
        return $_comment;
    }
}


// Deprecate in favor of get_comment()?
function get_commentdata( $comment_ID, $no_cache = 0, $include_unapproved = false ) { // less flexible, but saves DB queries
    global $postc, $id, $commentdata, $wpdb;
    if ( $no_cache ) {
        $query = "SELECT * FROM $wpdb->comments WHERE comment_ID = '$comment_ID'";
        if ( false == $include_unapproved )
            $query .= " AND comment_approved = '1'";
        $myrow = $wpdb->get_row($query, ARRAY_A);
    } else {
        $myrow['comment_ID']           = $postc->comment_ID;
        $myrow['comment_post_ID']      = $postc->comment_post_ID;
        $myrow['comment_author']       = $postc->comment_author;
        $myrow['comment_author_email'] = $postc->comment_author_email;
        $myrow['comment_author_url']   = $postc->comment_author_url;
        $myrow['comment_author_IP']    = $postc->comment_author_IP;
        $myrow['comment_date']         = $postc->comment_date;
        $myrow['comment_content']      = $postc->comment_content;
        $myrow['comment_karma']        = $postc->comment_karma;
        $myrow['comment_approved']     = $postc->comment_approved;
        $myrow['comment_type']         = $postc->comment_type;
    }
    return $myrow;
}


function get_lastcommentmodified($timezone = 'server') {
    global $cache_lastcommentmodified, $pagenow, $wpdb;
    $add_seconds_blog = get_option('gmt_offset') * 3600;
    $add_seconds_server = date('Z');
    $now = current_time('mysql', 1);
    if ( !isset($cache_lastcommentmodified[$timezone]) ) {
        switch ( strtolower($timezone)) {
            case 'gmt':
                $lastcommentmodified = $wpdb->get_var("SELECT comment_date_gmt FROM $wpdb->comments WHERE comment_date_gmt <= '$now' ORDER BY comment_date_gmt DESC LIMIT 1");
                break;
            case 'blog':
                $lastcommentmodified = $wpdb->get_var("SELECT comment_date FROM $wpdb->comments WHERE comment_date_gmt <= '$now' ORDER BY comment_date_gmt DESC LIMIT 1");
                break;
            case 'server':
                $lastcommentmodified = $wpdb->get_var("SELECT DATE_ADD(comment_date_gmt, INTERVAL '$add_seconds_server' SECOND) FROM $wpdb->comments WHERE comment_date_gmt <= '$now' ORDER BY comment_date_gmt DESC LIMIT 1");
                break;
        }
        $cache_lastcommentmodified[$timezone] = $lastcommentmodified;
    } else {
        $lastcommentmodified = $cache_lastcommentmodified[$timezone];
    }
    return $lastcommentmodified;
}


function sanitize_comment_cookies() {
    if ( isset($_COOKIE['comment_author_'.COOKIEHASH]) ) {
        $comment_author = apply_filters('pre_comment_author_name', $_COOKIE['comment_author_'.COOKIEHASH]);
        $comment_author = stripslashes($comment_author);
        $comment_author = attribute_escape($comment_author);
        $_COOKIE['comment_author_'.COOKIEHASH] = $comment_author;
    }

    if ( isset($_COOKIE['comment_author_email_'.COOKIEHASH]) ) {
        $comment_author_email = apply_filters('pre_comment_author_email', $_COOKIE['comment_author_email_'.COOKIEHASH]);
        $comment_author_email = stripslashes($comment_author_email);
        $comment_author_email = attribute_escape($comment_author_email);
        $_COOKIE['comment_author_email_'.COOKIEHASH] = $comment_author_email;
    }

    if ( isset($_COOKIE['comment_author_url_'.COOKIEHASH]) ) {
        $comment_author_url = apply_filters('pre_comment_author_url', $_COOKIE['comment_author_url_'.COOKIEHASH]);
        $comment_author_url = stripslashes($comment_author_url);
        $comment_author_url = clean_url($comment_author_url);
        $_COOKIE['comment_author_url_'.COOKIEHASH] = $comment_author_url;
    }
}


function wp_allow_comment($commentdata) {
    global $wpdb;
    extract($commentdata);

    // Simple duplicate check
    $dupe = "SELECT comment_ID FROM $wpdb->comments WHERE comment_post_ID = '$comment_post_ID' AND ( comment_author = '$comment_author' ";
    if ( $comment_author_email )
        $dupe .= "OR comment_author_email = '$comment_author_email' ";
    $dupe .= ") AND comment_content = '$comment_content' LIMIT 1";
    if ( $wpdb->get_var($dupe) )
        wp_die( __('Duplicate comment detected; it looks as though you\'ve already said that!') );

    // Simple flood-protection
    if ( $lasttime = $wpdb->get_var("SELECT comment_date_gmt FROM $wpdb->comments WHERE comment_author_IP = '$comment_author_IP' OR comment_author_email = '$comment_author_email' ORDER BY comment_date DESC LIMIT 1") ) {
        $time_lastcomment = mysql2date('U', $lasttime);
        $time_newcomment  = mysql2date('U', $comment_date_gmt);
        $flood_die = apply_filters('comment_flood_filter', false, $time_lastcomment, $time_newcomment);
        if ( $flood_die ) {
            do_action('comment_flood_trigger', $time_lastcomment, $time_newcomment);
            wp_die( __('You are posting comments too quickly.  Slow down.') );
        }
    }

    if ( $user_id ) {
        $userdata = get_userdata($user_id);
        $user = new WP_User($user_id);
        $post_author = $wpdb->get_var("SELECT post_author FROM $wpdb->posts WHERE ID = '$comment_post_ID' LIMIT 1");
    }

    if ( $userdata && ( $user_id == $post_author || $user->has_cap('level_9') ) ) {
        // The author and the admins get respect.
        $approved = 1;
     } else {
        // Everyone else's comments will be checked.
        if ( check_comment($comment_author, $comment_author_email, $comment_author_url, $comment_content, $comment_author_IP, $comment_agent, $comment_type) )
            $approved = 1;
        else
            $approved = 0;
        if ( wp_blacklist_check($comment_author, $comment_author_email, $comment_author_url, $comment_content, $comment_author_IP, $comment_agent) )
            $approved = 'spam';
    }

    $approved = apply_filters('pre_comment_approved', $approved);
    return $approved;
}


function wp_blacklist_check($author, $email, $url, $comment, $user_ip, $user_agent) {
    global $wpdb;

    do_action('wp_blacklist_check', $author, $email, $url, $comment, $user_ip, $user_agent);

    if ( preg_match_all('/&#(\d+);/', $comment . $author . $url, $chars) ) {
        foreach ( (array) $chars[1] as $char ) {
            // If it's an encoded char in the normal ASCII set, reject
            if ( 38 == $char )
                continue; // Unless it's &
            if ( $char < 128 )
                return true;
        }
    }

    $mod_keys = trim( get_option('blacklist_keys') );
    if ( '' == $mod_keys )
        return false; // If moderation keys are empty
    $words = explode("\n", $mod_keys );

    foreach ( (array) $words as $word ) {
        $word = trim($word);

        // Skip empty lines
        if ( empty($word) ) { continue; }

        // Do some escaping magic so that '#' chars in the
        // spam words don't break things:
        $word = preg_quote($word, '#');

        $pattern = "#$word#i";
        if (
               preg_match($pattern, $author)
            || preg_match($pattern, $email)
            || preg_match($pattern, $url)
            || preg_match($pattern, $comment)
            || preg_match($pattern, $user_ip)
            || preg_match($pattern, $user_agent)
         )
            return true;
    }
    return false;
}


function wp_delete_comment($comment_id) {
    global $wpdb;
    do_action('delete_comment', $comment_id);

    $comment = get_comment($comment_id);

    if ( ! $wpdb->query("DELETE FROM $wpdb->comments WHERE comment_ID='$comment_id' LIMIT 1") )
        return false;

    $post_id = $comment->comment_post_ID;
    if ( $post_id && $comment->comment_approved == 1 )
        wp_update_comment_count($post_id);

    do_action('wp_set_comment_status', $comment_id, 'delete');
    return true;
}


function wp_get_comment_status($comment_id) {
    global $wpdb;

    $result = $wpdb->get_var("SELECT comment_approved FROM $wpdb->comments WHERE comment_ID='$comment_id' LIMIT 1");

    if ( $result == NULL )
        return 'deleted';
    elseif ( $result == '1' )
        return 'approved';
    elseif ( $result == '0' )
        return 'unapproved';
    elseif ( $result == 'spam' )
        return 'spam';
    else
        return false;
}


function wp_get_current_commenter() {
    // Cookies should already be sanitized.

    $comment_author = '';
    if ( isset($_COOKIE['comment_author_'.COOKIEHASH]) )
        $comment_author = $_COOKIE['comment_author_'.COOKIEHASH];

    $comment_author_email = '';
    if ( isset($_COOKIE['comment_author_email_'.COOKIEHASH]) )
        $comment_author_email = $_COOKIE['comment_author_email_'.COOKIEHASH];

    $comment_author_url = '';
    if ( isset($_COOKIE['comment_author_url_'.COOKIEHASH]) )
        $comment_author_url = $_COOKIE['comment_author_url_'.COOKIEHASH];

    return compact('comment_author', 'comment_author_email', 'comment_author_url');
}


function wp_insert_comment($commentdata) {
    global $wpdb;
    extract($commentdata);

    if ( ! isset($comment_author_IP) )
        $comment_author_IP = preg_replace( '/[^0-9., ]/', '',$_SERVER['REMOTE_ADDR'] );
    if ( ! isset($comment_date) )
        $comment_date = current_time('mysql');
    if ( ! isset($comment_date_gmt) )
        $comment_date_gmt = get_gmt_from_date($comment_date);
    if ( ! isset($comment_parent) )
        $comment_parent = 0;
    if ( ! isset($comment_approved) )
        $comment_approved = 1;
    if ( ! isset($user_id) )
        $user_id = 0;

    $result = $wpdb->query("INSERT INTO $wpdb->comments
    (comment_post_ID, comment_author, comment_author_email, comment_author_url, comment_author_IP, comment_date, comment_date_gmt, comment_content, comment_approved, comment_agent, comment_type, comment_parent, user_id)
    VALUES
    ('$comment_post_ID', '$comment_author', '$comment_author_email', '$comment_author_url', '$comment_author_IP', '$comment_date', '$comment_date_gmt', '$comment_content', '$comment_approved', '$comment_agent', '$comment_type', '$comment_parent', '$user_id')
    ");

    $id = (int) $wpdb->insert_id;

    if ( $comment_approved == 1)
        wp_update_comment_count($comment_post_ID);

    return $id;
}


function wp_filter_comment($commentdata) {
    $commentdata['user_id']              = apply_filters('pre_user_id', $commentdata['user_ID']);
    $commentdata['comment_agent']        = apply_filters('pre_comment_user_agent', $commentdata['comment_agent']);
    $commentdata['comment_author']       = apply_filters('pre_comment_author_name', $commentdata['comment_author']);
    $commentdata['comment_content']      = apply_filters('pre_comment_content', $commentdata['comment_content']);
    $commentdata['comment_author_IP']    = apply_filters('pre_comment_user_ip', $commentdata['comment_author_IP']);
    $commentdata['comment_author_url']   = apply_filters('pre_comment_author_url', $commentdata['comment_author_url']);
    $commentdata['comment_author_email'] = apply_filters('pre_comment_author_email', $commentdata['comment_author_email']);
    $commentdata['filtered'] = true;
    return $commentdata;
}


function wp_throttle_comment_flood($block, $time_lastcomment, $time_newcomment) {
    if ( $block ) // a plugin has already blocked... we'll let that decision stand
        return $block;
    if ( ($time_newcomment - $time_lastcomment) < 15 )
        return true;
    return false;
}


function wp_new_comment( $commentdata ) {
    $commentdata = apply_filters('preprocess_comment', $commentdata);

    $commentdata['comment_post_ID'] = (int) $commentdata['comment_post_ID'];
    $commentdata['user_ID']         = (int) $commentdata['user_ID'];

    $commentdata['comment_author_IP'] = preg_replace( '/[^0-9., ]/', '',$_SERVER['REMOTE_ADDR'] );
    $commentdata['comment_agent']     = $_SERVER['HTTP_USER_AGENT'];

    $commentdata['comment_date']     = current_time('mysql');
    $commentdata['comment_date_gmt'] = current_time('mysql', 1);

    $commentdata = wp_filter_comment($commentdata);

    $commentdata['comment_approved'] = wp_allow_comment($commentdata);

    $comment_ID = wp_insert_comment($commentdata);

    do_action('comment_post', $comment_ID, $commentdata['comment_approved']);

    if ( 'spam' !== $commentdata['comment_approved'] ) { // If it's spam save it silently for later crunching
        if ( '0' == $commentdata['comment_approved'] )
            wp_notify_moderator($comment_ID);

        $post = &get_post($commentdata['comment_post_ID']); // Don't notify if it's your own comment

        if ( get_option('comments_notify') && $commentdata['comment_approved'] && $post->post_author != $commentdata['user_ID'] )
            wp_notify_postauthor($comment_ID, $commentdata['comment_type']);
    }

    return $comment_ID;
}


function wp_set_comment_status($comment_id, $comment_status) {
    global $wpdb;

    switch ( $comment_status ) {
        case 'hold':
            $query = "UPDATE $wpdb->comments SET comment_approved='0' WHERE comment_ID='$comment_id' LIMIT 1";
            break;
        case 'approve':
            $query = "UPDATE $wpdb->comments SET comment_approved='1' WHERE comment_ID='$comment_id' LIMIT 1";
            break;
        case 'spam':
            $query = "UPDATE $wpdb->comments SET comment_approved='spam' WHERE comment_ID='$comment_id' LIMIT 1";
            break;
        case 'delete':
            return wp_delete_comment($comment_id);
            break;
        default:
            return false;
    }

    if ( !$wpdb->query($query) )
        return false;

    do_action('wp_set_comment_status', $comment_id, $comment_status);
    $comment = get_comment($comment_id);
    wp_update_comment_count($comment->comment_post_ID);
    return true;
}


function wp_update_comment($commentarr) {
    global $wpdb;

    // First, get all of the original fields
    $comment = get_comment($commentarr['comment_ID'], ARRAY_A);

    // Escape data pulled from DB.
    foreach ( (array) $comment as $key => $value )
        $comment[$key] = $wpdb->escape($value);

    // Merge old and new fields with new fields overwriting old ones.
    $commentarr = array_merge($comment, $commentarr);

    $commentarr = wp_filter_comment( $commentarr );

    // Now extract the merged array.
    extract($commentarr);

    $comment_content = apply_filters('comment_save_pre', $comment_content);

    $comment_date_gmt = get_gmt_from_date($comment_date);

    $result = $wpdb->query(
        "UPDATE $wpdb->comments SET
            comment_content      = '$comment_content',
            comment_author       = '$comment_author',
            comment_author_email = '$comment_author_email',
            comment_approved     = '$comment_approved',
            comment_author_url   = '$comment_author_url',
            comment_date         = '$comment_date',
            comment_date_gmt  &nb