X-Git-Url: https://scripts.mit.edu/gitweb/autoinstalls/wordpress.git/blobdiff_plain/9e77185fafaf4e60e2b73821e0e4b9b1a11fb85f..5d244c8fd9a27c9f89dd08da2af6fbc67d4fce63:/wp-content/plugins/akismet/class.akismet.php diff --git a/wp-content/plugins/akismet/class.akismet.php b/wp-content/plugins/akismet/class.akismet.php index a9ab0eaa..5c786526 100644 --- a/wp-content/plugins/akismet/class.akismet.php +++ b/wp-content/plugins/akismet/class.akismet.php @@ -23,7 +23,7 @@ class Akismet { self::$initiated = true; add_action( 'wp_insert_comment', array( 'Akismet', 'auto_check_update_meta' ), 10, 2 ); - add_action( 'preprocess_comment', array( 'Akismet', 'auto_check_comment' ), 1 ); + add_filter( 'preprocess_comment', array( 'Akismet', 'auto_check_comment' ), 1 ); add_action( 'akismet_scheduled_delete', array( 'Akismet', 'delete_old_comments' ) ); add_action( 'akismet_scheduled_delete', array( 'Akismet', 'delete_old_comments_meta' ) ); add_action( 'akismet_schedule_cron_recheck', array( 'Akismet', 'cron_recheck' ) ); @@ -42,6 +42,9 @@ class Akismet { add_action( 'transition_comment_status', array( 'Akismet', 'transition_comment_status' ), 10, 3 ); + // Run this early in the pingback call, before doing a remote fetch of the source uri + add_action( 'xmlrpc_call', array( 'Akismet', 'pre_check_pingback' ) ); + if ( '3.0.5' == $GLOBALS['wp_version'] ) { remove_filter( 'comment_text', 'wp_kses_data' ); if ( is_admin() ) @@ -161,6 +164,7 @@ class Akismet { if ( function_exists('wp_next_scheduled') && function_exists('wp_schedule_single_event') ) { if ( !wp_next_scheduled( 'akismet_schedule_cron_recheck' ) ) { wp_schedule_single_event( time() + 1200, 'akismet_schedule_cron_recheck' ); + do_action( 'akismet_scheduled_recheck', 'invalid-response-' . $response[1] ); } } @@ -180,7 +184,7 @@ class Akismet { self::set_last_comment( $commentdata ); self::fix_scheduled_recheck(); - return self::$last_comment; + return $commentdata; } public static function get_last_comment() { @@ -256,13 +260,31 @@ class Akismet { public static function delete_old_comments() { global $wpdb; - while( $comment_ids = $wpdb->get_col( $wpdb->prepare( "SELECT comment_id FROM {$wpdb->comments} WHERE DATE_SUB(NOW(), INTERVAL 15 DAY) > comment_date_gmt AND comment_approved = 'spam' LIMIT %d", defined( 'AKISMET_DELETE_LIMIT' ) ? AKISMET_DELETE_LIMIT : 10000 ) ) ) { + /** + * Determines how many comments will be deleted in each batch. + * + * @param int The default, as defined by AKISMET_DELETE_LIMIT. + */ + $delete_limit = apply_filters( 'akismet_delete_comment_limit', defined( 'AKISMET_DELETE_LIMIT' ) ? AKISMET_DELETE_LIMIT : 10000 ); + $delete_limit = max( 1, intval( $delete_limit ) ); + + /** + * Determines how many days a comment will be left in the Spam queue before being deleted. + * + * @param int The default number of days. + */ + $delete_interval = apply_filters( 'akismet_delete_comment_interval', 15 ); + $delete_interval = max( 1, intval( $delete_interval ) ); + + while ( $comment_ids = $wpdb->get_col( $wpdb->prepare( "SELECT comment_id FROM {$wpdb->comments} WHERE DATE_SUB(NOW(), INTERVAL %d DAY) > comment_date_gmt AND comment_approved = 'spam' LIMIT %d", $delete_interval, $delete_limit ) ) ) { if ( empty( $comment_ids ) ) return; $wpdb->queries = array(); - do_action( 'delete_comment', $comment_ids ); + foreach ( $comment_ids as $comment_id ) { + do_action( 'delete_comment', $comment_id ); + } $comma_comment_ids = implode( ', ', array_map('intval', $comment_ids) ); @@ -529,6 +551,7 @@ class Akismet { if ( get_option( 'akismet_alert_code' ) || $status == 'invalid' ) { // since there is currently a problem with the key, reschedule a check for 6 hours hence wp_schedule_single_event( time() + 21600, 'akismet_schedule_cron_recheck' ); + do_action( 'akismet_scheduled_recheck', 'key-problem-' . get_option( 'akismet_alert_code' ) . '-' . $status ); return false; } @@ -590,6 +613,7 @@ class Akismet { delete_comment_meta( $comment_id, 'akismet_rechecking' ); wp_schedule_single_event( time() + 1200, 'akismet_schedule_cron_recheck' ); + do_action( 'akismet_scheduled_recheck', 'check-db-comment-' . $status ); return; } delete_comment_meta( $comment_id, 'akismet_rechecking' ); @@ -598,6 +622,7 @@ class Akismet { $remaining = $wpdb->get_var( "SELECT COUNT(*) FROM {$wpdb->commentmeta} WHERE meta_key = 'akismet_error'" ); if ( $remaining && !wp_next_scheduled('akismet_schedule_cron_recheck') ) { wp_schedule_single_event( time() + 1200, 'akismet_schedule_cron_recheck' ); + do_action( 'akismet_scheduled_recheck', 'remaining' ); } } @@ -615,6 +640,7 @@ class Akismet { if ( $future_check > $check_range ) { wp_clear_scheduled_hook( 'akismet_schedule_cron_recheck' ); wp_schedule_single_event( time() + 300, 'akismet_schedule_cron_recheck' ); + do_action( 'akismet_scheduled_recheck', 'fix-scheduled-recheck' ); } } @@ -791,11 +817,71 @@ class Akismet { 'timeout' => 15 ); - $akismet_url = "http://{$http_host}/1.1/{$path}"; + $akismet_url = $http_akismet_url = "http://{$http_host}/1.1/{$path}"; + + /** + * Try SSL first; if that fails, try without it and don't try it again for a while. + */ + + $ssl = $ssl_failed = false; + + // Check if SSL requests were disabled fewer than X hours ago. + $ssl_disabled = get_option( 'akismet_ssl_disabled' ); + + if ( $ssl_disabled && $ssl_disabled < ( time() - 60 * 60 * 24 ) ) { // 24 hours + $ssl_disabled = false; + delete_option( 'akismet_ssl_disabled' ); + } + else if ( $ssl_disabled ) { + do_action( 'akismet_ssl_disabled' ); + } + + if ( ! $ssl_disabled && function_exists( 'wp_http_supports') && ( $ssl = wp_http_supports( array( 'ssl' ) ) ) ) { + $akismet_url = set_url_scheme( $akismet_url, 'https' ); + + do_action( 'akismet_https_request_pre' ); + } + $response = wp_remote_post( $akismet_url, $http_args ); + Akismet::log( compact( 'akismet_url', 'http_args', 'response' ) ); - if ( is_wp_error( $response ) ) + + if ( $ssl && is_wp_error( $response ) ) { + do_action( 'akismet_https_request_failure', $response ); + + // Intermittent connection problems may cause the first HTTPS + // request to fail and subsequent HTTP requests to succeed randomly. + // Retry the HTTPS request once before disabling SSL for a time. + $response = wp_remote_post( $akismet_url, $http_args ); + + Akismet::log( compact( 'akismet_url', 'http_args', 'response' ) ); + + if ( is_wp_error( $response ) ) { + $ssl_failed = true; + + do_action( 'akismet_https_request_failure', $response ); + + do_action( 'akismet_http_request_pre' ); + + // Try the request again without SSL. + $response = wp_remote_post( $http_akismet_url, $http_args ); + + Akismet::log( compact( 'http_akismet_url', 'http_args', 'response' ) ); + } + } + + if ( is_wp_error( $response ) ) { + do_action( 'akismet_request_failure', $response ); + return array( '', '' ); + } + + if ( $ssl_failed ) { + // The request failed when using SSL but succeeded without it. Disable SSL for future requests. + update_option( 'akismet_ssl_disabled', time() ); + + do_action( 'akismet_https_disabled' ); + } return array( $response['headers'], $response['body'] ); } @@ -926,8 +1012,77 @@ p { return _http_build_query( $args, '', '&' ); } + /** + * Log debugging info to the error log. + * + * Enabled when WP_DEBUG_LOG is enabled, but can be disabled via the akismet_debug_log filter. + * + * @param mixed $akismet_debug The data to log. + */ public static function log( $akismet_debug ) { - if ( defined( 'WP_DEBUG_LOG' ) && WP_DEBUG_LOG ) - error_log( print_r( compact( 'akismet_debug' ), 1 ) ); //send message to debug.log when in debug mode + if ( apply_filters( 'akismet_debug_log', defined( 'WP_DEBUG_LOG' ) && WP_DEBUG_LOG ) ) { + error_log( print_r( compact( 'akismet_debug' ), true ) ); + } + } + + public static function pre_check_pingback( $method ) { + if ( $method !== 'pingback.ping' ) + return; + + global $wp_xmlrpc_server; + + if ( !is_object( $wp_xmlrpc_server ) ) + return false; + + // Lame: tightly coupled with the IXR class. + $args = $wp_xmlrpc_server->message->params; + + if ( !empty( $args[1] ) ) { + $post_id = url_to_postid( $args[1] ); + + // If this gets through the pre-check, make sure we properly identify the outbound request as a pingback verification + Akismet::pingback_forwarded_for( null, $args[0] ); + add_filter( 'http_request_args', array( 'Akismet', 'pingback_forwarded_for' ), 10, 2 ); + + $comment = array( + 'comment_author_url' => $args[0], + 'comment_post_ID' => $post_id, + 'comment_author' => '', + 'comment_author_email' => '', + 'comment_content' => '', + 'comment_type' => 'pingback', + 'akismet_pre_check' => '1', + 'comment_pingback_target' => $args[1], + ); + + $comment = Akismet::auto_check_comment( $comment ); + + if ( isset( $comment['akismet_result'] ) && 'true' == $comment['akismet_result'] ) { + // Lame: tightly coupled with the IXR classes. Unfortunately the action provides no context and no way to return anything. + $wp_xmlrpc_server->error( new IXR_Error( 0, 'Invalid discovery target' ) ); + } + } + } + + public static function pingback_forwarded_for( $r, $url ) { + static $urls = array(); + + // Call this with $r == null to prime the callback to add headers on a specific URL + if ( is_null( $r ) && !in_array( $url, $urls ) ) { + $urls[] = $url; + } + + // Add X-Pingback-Forwarded-For header, but only for requests to a specific URL (the apparent pingback source) + if ( is_array( $r ) && is_array( $r['headers'] ) && !isset( $r['headers']['X-Pingback-Forwarded-For'] ) && in_array( $url, $urls ) ) { + $remote_ip = preg_replace( '/[^a-fx0-9:.,]/i', '', $_SERVER['REMOTE_ADDR'] ); + + // Note: this assumes REMOTE_ADDR is correct, and it may not be if a reverse proxy or CDN is in use + $r['headers']['X-Pingback-Forwarded-For'] = $remote_ip; + + // Also identify the request as a pingback verification in the UA string so it appears in logs + $r['user-agent'] .= '; verifying pingback from ' . $remote_ip; + } + + return $r; } } \ No newline at end of file