<?php

/**

 * Manages WordPress comments

 *

 * @package WordPress

 * @subpackage Comment

 */

/**

 * Checks whether a comment passes internal checks to be allowed to add.

 *

 * If comment moderation is set in the administration, then all comments,

 * regardless of their type and whitelist will be set to false. If the number of

 * links exceeds the amount in the administration, then the check fails. If any

 * of the parameter contents match the blacklist of words, then the check fails.

 *

 * If the number of links exceeds the amount in the administration, then the

 * check fails. If any of the parameter contents match the blacklist of words,

 * then the check fails.

 *

 * If the comment author was approved before, then the comment is

 * automatically whitelisted.

 *

 * If none of the checks fail, then the failback is to set the check to pass

 * (return true).

 *

 * @since 1.2.0

 * @uses $wpdb

 *

 * @param string $author Comment Author's name

 * @param string $email Comment Author's email

 * @param string $url Comment Author's URL

 * @param string $comment Comment contents

 * @param string $user_ip Comment Author's IP address

 * @param string $user_agent Comment Author's User Agent

 * @param string $comment_type Comment type, either user submitted comment,

 *		trackback, or pingback

 * @return bool Whether the checks passed (true) and the comments should be

 *		displayed or set to moderated

 */

function check_comment($author, $email, $url, $comment, $user_ip, $user_agent, $comment_type) {

	global $wpdb;

	if ( 1 == get_option('comment_moderation') )

		return false; // If moderation is set to manual

	$comment = apply_filters( 'comment_text', $comment );

	// Check # of external links

	if ( $max_links = get_option( 'comment_max_links' ) ) {

		$num_links = preg_match_all( '/<a [^>]*href/i', $comment, $out );

		$num_links = apply_filters( 'comment_max_links_url', $num_links, $url ); // provide for counting of $url as a link

		if ( $num_links >= $max_links )

			return false;

	}

	$mod_keys = trim(get_option('moderation_keys'));

	if ( !empty($mod_keys) ) {

		$words = explode("\n", $mod_keys );

		foreach ( (array) $words as $word) {

			$word = trim($word);

			// Skip empty lines

			if ( empty($word) )

				continue;

			// Do some escaping magic so that '#' chars in the

			// spam words don't break things:

			$word = preg_quote($word, '#');

			$pattern = "#$word#i";

			if ( preg_match($pattern, $author) ) return false;

			if ( preg_match($pattern, $email) ) return false;

			if ( preg_match($pattern, $url) ) return false;

			if ( preg_match($pattern, $comment) ) return false;

			if ( preg_match($pattern, $user_ip) ) return false;

			if ( preg_match($pattern, $user_agent) ) return false;

		}

	}

	// Comment whitelisting:

	if ( 1 == get_option('comment_whitelist')) {

		if ( 'trackback' != $comment_type && 'pingback' != $comment_type && $author != '' && $email != '' ) {

			// expected_slashed ($author, $email)

			$ok_to_comment = $wpdb->get_var("SELECT comment_approved FROM $wpdb->comments WHERE comment_author = '$author' AND comment_author_email = '$email' and comment_approved = '1' LIMIT 1");

			if ( ( 1 == $ok_to_comment ) &&

				( empty($mod_keys) || false === strpos( $email, $mod_keys) ) )

					return true;

			else

				return false;

		} else {

			return false;

		}

	}

	return true;

}

/**

 * Retrieve the approved comments for post $post_id.

 *

 * @since 2.0.0

 * @uses $wpdb

 *

 * @param int $post_id The ID of the post

 * @return array $comments The approved comments

 */

function get_approved_comments($post_id) {

	global $wpdb;

	return $wpdb->get_results($wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_approved = '1' ORDER BY comment_date", $post_id));

}

/**

 * Retrieves comment data given a comment ID or comment object.

 *

 * If an object is passed then the comment data will be cached and then returned

 * after being passed through a filter. If the comment is empty, then the global

 * comment variable will be used, if it is set.

 *

 * If the comment is empty, then the global comment variable will be used, if it

 * is set.

 *

 * @since 2.0.0

 * @uses $wpdb

 *

 * @param object|string|int $comment Comment to retrieve.

 * @param string $output Optional. OBJECT or ARRAY_A or ARRAY_N constants.

 * @return object|array|null Depends on $output value.

 */

function get_comment(&$comment, $output = OBJECT) {

	global $wpdb;

	$null = null;

	if ( empty($comment) ) {

		if ( isset($GLOBALS['comment']) )

			$_comment = & $GLOBALS['comment'];

		else

			$_comment = null;

	} elseif ( is_object($comment) ) {

		wp_cache_add($comment->comment_ID, $comment, 'comment');

		$_comment = $comment;

	} else {

		if ( isset($GLOBALS['comment']) && ($GLOBALS['comment']->comment_ID == $comment) ) {

			$_comment = & $GLOBALS['comment'];

		} elseif ( ! $_comment = wp_cache_get($comment, 'comment') ) {

			$_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->comments WHERE comment_ID = %d LIMIT 1", $comment));

			if ( ! $_comment )

				return $null;

			wp_cache_add($_comment->comment_ID, $_comment, 'comment');

		}

	}

	$_comment = apply_filters('get_comment', $_comment);

	if ( $output == OBJECT ) {

		return $_comment;

	} elseif ( $output == ARRAY_A ) {

		$__comment = get_object_vars($_comment);

		return $__comment;

	} elseif ( $output == ARRAY_N ) {

		$__comment = array_values(get_object_vars($_comment));

		return $__comment;

	} else {

		return $_comment;

	}

}

/**

 * Retrieve a list of comments.

 *

 * The comment list can be for the blog as a whole or for an individual post.

 *

 * The list of comment arguments are 'status', 'orderby', 'comment_date_gmt',

 * 'order', 'number', 'offset', and 'post_id'.

 *

 * @since 2.7.0

 * @uses $wpdb

 *

 * @param mixed $args Optional. Array or string of options to override defaults.

 * @return array List of comments.

 */

function get_comments( $args = '' ) {

	$query = new WP_Comment_Query;

	return $query->query( $args );

}

/**

 * WordPress Comment Query class.

 *

 * @since 3.1.0

 */

class WP_Comment_Query {

	/**

	 * Metadata query container

	 *

	 * @since 3.5.0

	 * @access public

	 * @var object WP_Meta_Query

	 */

	var $meta_query = false;

	/**

	 * Execute the query

	 *

	 * @since 3.1.0

	 *

	 * @param string|array $query_vars

	 * @return int|array

	 */

	function query( $query_vars ) {

		global $wpdb;

		$defaults = array(

			'author_email' => '',

			'ID' => '',

			'karma' => '',

			'number' => '',

			'offset' => '',

			'orderby' => '',

			'order' => 'DESC',

			'parent' => '',

			'post_ID' => '',

			'post_id' => 0,

			'post_author' => '',

			'post_name' => '',

			'post_parent' => '',

			'post_status' => '',

			'post_type' => '',

			'status' => '',

			'type' => '',

			'user_id' => '',

			'search' => '',

			'count' => false,

			'meta_key' => '',

			'meta_value' => '',

			'meta_query' => '',

		);

		$groupby = '';

		$this->query_vars = wp_parse_args( $query_vars, $defaults );

		// Parse meta query

		$this->meta_query = new WP_Meta_Query();

		$this->meta_query->parse_query_vars( $this->query_vars );

		do_action_ref_array( 'pre_get_comments', array( &$this ) );

		extract( $this->query_vars, EXTR_SKIP );

		// $args can be whatever, only use the args defined in defaults to compute the key

		$key = md5( serialize( compact(array_keys($defaults)) )  );

		$last_changed = wp_cache_get( 'last_changed', 'comment' );

		if ( ! $last_changed )

			$last_changed = wp_cache_set( 'last_changed', 1, 'comment' );

		$cache_key = "get_comments:$key:$last_changed";

		if ( $cache = wp_cache_get( $cache_key, 'comment' ) )

			return $cache;

		$post_id = absint($post_id);

		if ( 'hold' == $status )

			$approved = "comment_approved = '0'";

		elseif ( 'approve' == $status )

			$approved = "comment_approved = '1'";

		elseif ( ! empty( $status ) && 'all' != $status )

			$approved = $wpdb->prepare( "comment_approved = %s", $status );

		else

			$approved = "( comment_approved = '0' OR comment_approved = '1' )";

		$order = ( 'ASC' == strtoupper($order) ) ? 'ASC' : 'DESC';

		if ( ! empty( $orderby ) ) {

			$ordersby = is_array($orderby) ? $orderby : preg_split('/[,\s]/', $orderby);

			$allowed_keys = array(

				'comment_agent',

				'comment_approved',

				'comment_author',

				'comment_author_email',

				'comment_author_IP',

				'comment_author_url',

				'comment_content',

				'comment_date',

				'comment_date_gmt',

				'comment_ID',

				'comment_karma',

				'comment_parent',

				'comment_post_ID',

				'comment_type',

				'user_id',

			);

			if ( ! empty( $this->query_vars['meta_key'] ) ) {

				$allowed_keys[] = $q['meta_key'];

				$allowed_keys[] = 'meta_value';

				$allowed_keys[] = 'meta_value_num';

			}

			$ordersby = array_intersect( $ordersby, $allowed_keys );

			foreach ( $ordersby as $key => $value ) {

				if ( $value == $q['meta_key'] || $value == 'meta_value' ) {

					$ordersby[ $key ] = "$wpdb->commentmeta.meta_value";

				} elseif ( $value == 'meta_value_num' ) {

					$ordersby[ $key ] = "$wpdb->commentmeta.meta_value+0";

				}

			}

			$orderby = empty( $ordersby ) ? 'comment_date_gmt' : implode(', ', $ordersby);

		} else {

			$orderby = 'comment_date_gmt';

		}

		$number = absint($number);

		$offset = absint($offset);

		if ( !empty($number) ) {

			if ( $offset )

				$limits = 'LIMIT ' . $offset . ',' . $number;

			else

				$limits = 'LIMIT ' . $number;

		} else {

			$limits = '';

		}

		if ( $count )

			$fields = 'COUNT(*)';

		else

			$fields = '*';

		$join = '';

		$where = $approved;

		if ( ! empty($post_id) )

			$where .= $wpdb->prepare( ' AND comment_post_ID = %d', $post_id );

		if ( '' !== $author_email )

			$where .= $wpdb->prepare( ' AND comment_author_email = %s', $author_email );

		if ( '' !== $karma )

			$where .= $wpdb->prepare( ' AND comment_karma = %d', $karma );

		if ( 'comment' == $type ) {

			$where .= " AND comment_type = ''";

		} elseif( 'pings' == $type ) {

			$where .= ' AND comment_type IN ("pingback", "trackback")';

		} elseif ( ! empty( $type ) ) {

			$where .= $wpdb->prepare( ' AND comment_type = %s', $type );

		}

		if ( '' !== $parent )

			$where .= $wpdb->prepare( ' AND comment_parent = %d', $parent );

		if ( '' !== $user_id )

			$where .= $wpdb->prepare( ' AND user_id = %d', $user_id );

		if ( '' !== $search )

			$where .= $this->get_search_sql( $search, array( 'comment_author', 'comment_author_email', 'comment_author_url', 'comment_author_IP', 'comment_content' ) );

		$post_fields = array_filter( compact( array( 'post_author', 'post_name', 'post_parent', 'post_status', 'post_type', ) ) );

		if ( ! empty( $post_fields ) ) {

			$join = "JOIN $wpdb->posts ON $wpdb->posts.ID = $wpdb->comments.comment_post_ID";

			foreach( $post_fields as $field_name => $field_value )

				$where .= $wpdb->prepare( " AND {$wpdb->posts}.{$field_name} = %s", $field_value );

		}

		if ( ! empty( $this->meta_query->queries ) ) {

			$clauses = $this->meta_query->get_sql( 'comment', $wpdb->comments, 'comment_ID', $this );

			$join .= $clauses['join'];

			$where .= $clauses['where'];

			$groupby = "{$wpdb->comments}.comment_ID";

		}

		$pieces = array( 'fields', 'join', 'where', 'orderby', 'order', 'limits', 'groupby' );

		$clauses = apply_filters_ref_array( 'comments_clauses', array( compact( $pieces ), &$this ) );

		foreach ( $pieces as $piece )

			$$piece = isset( $clauses[ $piece ] ) ? $clauses[ $piece ] : '';

		if ( $groupby )

			$groupby = 'GROUP BY ' . $groupby;

		$query = "SELECT $fields FROM $wpdb->comments $join WHERE $where $groupby ORDER BY $orderby $order $limits";

		if ( $count )

			return $wpdb->get_var( $query );

		$comments = $wpdb->get_results( $query );

		$comments = apply_filters_ref_array( 'the_comments', array( $comments, &$this ) );

		wp_cache_add( $cache_key, $comments, 'comment' );

		return $comments;

	}

	/*

	 * Used internally to generate an SQL string for searching across multiple columns

	 *

	 * @access protected

	 * @since 3.1.0

	 *

	 * @param string $string

	 * @param array $cols

	 * @return string

	 */

	function get_search_sql( $string, $cols ) {

		$string = esc_sql( like_escape( $string ) );

		$searches = array();

		foreach ( $cols as $col )

			$searches[] = "$col LIKE '%$string%'";