Repository navigation
Expand file tree
/
Copy pathwp-trackback.php
More file actions
187 lines (156 loc) · 5.42 KB
/
Copy pathwp-trackback.php
File metadata and controls
187 lines (156 loc) · 5.42 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
<?php
/**
* Handle Trackbacks and Pingbacks Sent to WordPress
*
* @since 0.71
*
* @package WordPress
* @subpackage Trackbacks
*/
if ( empty( $wp ) ) {
require_once __DIR__ . '/wp-load.php';
wp( array( 'tb' => '1' ) );
}
// Always run as an unauthenticated user.
wp_set_current_user( 0 );
/**
* Response to a trackback.
*
* Responds with an error or success XML message.
*
* @since 0.71
*
* @param int|bool $error Whether there was an error.
* Default 0. Accepts 0 or 1, true or false.
* @param string $error_message Error message if an error occurred. Default empty string.
* @return void Never returns if `$error` is truthy, as the function dies after
* sending the error response.
* @phpstan-return ( $error is 0|false ? void : never )
*/
function trackback_response( $error = 0, $error_message = '' ) {
header( 'Content-Type: text/xml; charset=' . get_option( 'blog_charset' ) );
if ( $error ) {
echo '<?xml version="1.0" encoding="utf-8"?' . ">\n";
echo "<response>\n";
echo "<error>1</error>\n";
echo '<message>' . esc_xml( $error_message ) . "</message>\n";
echo '</response>';
die();
} else {
echo '<?xml version="1.0" encoding="utf-8"?' . ">\n";
echo "<response>\n";
echo "<error>0</error>\n";
echo '</response>';
}
}
if ( ! isset( $_GET['tb_id'] ) || ! $_GET['tb_id'] ) {
$post_id = explode( '/', $_SERVER['REQUEST_URI'] );
$post_id = (int) array_last( $post_id );
}
$trackback_url = isset( $_POST['url'] ) ? sanitize_url( $_POST['url'] ) : '';
$charset = isset( $_POST['charset'] ) ? sanitize_text_field( $_POST['charset'] ) : '';
// These three are stripslashed here so they can be properly escaped after mb_convert_encoding().
$title = isset( $_POST['title'] ) ? sanitize_text_field( wp_unslash( $_POST['title'] ) ) : '';
$excerpt = isset( $_POST['excerpt'] ) ? sanitize_textarea_field( wp_unslash( $_POST['excerpt'] ) ) : '';
$blog_name = isset( $_POST['blog_name'] ) ? sanitize_text_field( wp_unslash( $_POST['blog_name'] ) ) : '';
if ( $charset ) {
$charset = str_replace( array( ',', ' ' ), '', strtoupper( trim( $charset ) ) );
// Validate the specified "sender" charset is available on the receiving site.
if ( function_exists( 'mb_list_encodings' ) && ! in_array( $charset, mb_list_encodings(), true ) ) {
$charset = '';
}
}
if ( ! $charset ) {
$charset = 'ASCII, UTF-8, ISO-8859-1, JIS, EUC-JP, SJIS';
}
// No valid uses for UTF-7.
if ( str_contains( $charset, 'UTF-7' ) ) {
die;
}
// For international trackbacks.
if ( function_exists( 'mb_convert_encoding' ) ) {
$title = mb_convert_encoding( $title, get_option( 'blog_charset' ), $charset );
$excerpt = mb_convert_encoding( $excerpt, get_option( 'blog_charset' ), $charset );
$blog_name = mb_convert_encoding( $blog_name, get_option( 'blog_charset' ), $charset );
}
// Escape values to use in the trackback.
$title = wp_slash( $title );
$excerpt = wp_slash( $excerpt );
$blog_name = wp_slash( $blog_name );
/**
* @global wpdb $wpdb WordPress database abstraction object.
* @global WP_Post[] $posts Array of post objects.
*/
global $wpdb, $posts;
if ( is_single() || is_page() ) {
$post_id = $posts[0]->ID;
}
if ( ! isset( $post_id ) || ! (int) $post_id ) {
trackback_response( 1, __( 'I really need an ID for this to work.' ) );
}
if ( empty( $title ) && empty( $trackback_url ) && empty( $blog_name ) ) {
// If it doesn't look like a trackback at all.
wp_redirect( get_permalink( $post_id ) );
exit;
}
if ( ! empty( $trackback_url ) && ! empty( $title ) ) {
/**
* Fires before the trackback is added to a post.
*
* @since 4.7.0
*
* @param int $post_id Post ID related to the trackback.
* @param string $trackback_url Trackback URL.
* @param string $charset Character set.
* @param string $title Trackback title.
* @param string $excerpt Trackback excerpt.
* @param string $blog_name Site name.
*/
do_action( 'pre_trackback_post', $post_id, $trackback_url, $charset, $title, $excerpt, $blog_name );
header( 'Content-Type: text/xml; charset=' . get_option( 'blog_charset' ) );
if ( ! pings_open( $post_id ) ) {
trackback_response( 1, __( 'Sorry, trackbacks are closed for this item.' ) );
}
$title = wp_html_excerpt( $title, 250, '…' );
$excerpt = wp_html_excerpt( $excerpt, 252, '…' );
$comment_post_id = (int) $post_id;
$comment_author = $blog_name;
$comment_author_email = '';
$comment_author_url = $trackback_url;
$comment_content = "<strong>$title</strong>\n\n$excerpt";
$comment_type = 'trackback';
$dupe = $wpdb->get_results(
$wpdb->prepare(
"SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_author_url = %s",
$comment_post_id,
$comment_author_url
)
);
if ( $dupe ) {
trackback_response( 1, __( 'There is already a ping from that URL for this post.' ) );
}
$commentdata = array(
'comment_post_ID' => $comment_post_id,
);
$commentdata += compact(
'comment_author',
'comment_author_email',
'comment_author_url',
'comment_content',
'comment_type'
);
$result = wp_new_comment( $commentdata );
if ( is_wp_error( $result ) ) {
trackback_response( 1, $result->get_error_message() );
}
$trackback_id = $wpdb->insert_id;
/**
* Fires after a trackback is added to a post.
*
* @since 1.2.0
*
* @param int $trackback_id Trackback ID.
*/
do_action( 'trackback_post', $trackback_id );
trackback_response( 0 );
}