1<?php
  2/**
  3 * Handle Trackbacks and Pingbacks Sent to WordPress
  4 *
  5 * @since 0.71
  6 *
  7 * @package WordPress
  8 * @subpackage Trackbacks
  9 */
 10
 11if ( empty( $wp ) ) {
 12	require_once __DIR__ . '/wp-load.php';
 13	wp( array( 'tb' => '1' ) );
 14}
 15
 16// Always run as an unauthenticated user.
 17wp_set_current_user( 0 );
 18
 19/**
 20 * Response to a trackback.
 21 *
 22 * Responds with an error or success XML message.
 23 *
 24 * @since 0.71
 25 *
 26 * @param int|bool $error         Whether there was an error.
 27 *                                Default '0'. Accepts '0' or '1', true or false.
 28 * @param string   $error_message Error message if an error occurred. Default empty string.
 29 */
 30function trackback_response( $error = 0, $error_message = '' ) {
 31	header( 'Content-Type: text/xml; charset=' . get_option( 'blog_charset' ) );
 32
 33	if ( $error ) {
 34		echo '<?xml version="1.0" encoding="utf-8"?' . ">\n";
 35		echo "<response>\n";
 36		echo "<error>1</error>\n";
 37		echo "<message>$error_message</message>\n";
 38		echo '</response>';
 39		die();
 40	} else {
 41		echo '<?xml version="1.0" encoding="utf-8"?' . ">\n";
 42		echo "<response>\n";
 43		echo "<error>0</error>\n";
 44		echo '</response>';
 45	}
 46}
 47
 48if ( ! isset( $_GET['tb_id'] ) || ! $_GET['tb_id'] ) {
 49	$post_id = explode( '/', $_SERVER['REQUEST_URI'] );
 50	$post_id = (int) $post_id[ count( $post_id ) - 1 ];
 51}
 52
 53$trackback_url = isset( $_POST['url'] ) ? sanitize_url( $_POST['url'] ) : '';
 54$charset       = isset( $_POST['charset'] ) ? sanitize_text_field( $_POST['charset'] ) : '';
 55
 56// These three are stripslashed here so they can be properly escaped after mb_convert_encoding().
 57$title     = isset( $_POST['title'] ) ? sanitize_text_field( wp_unslash( $_POST['title'] ) ) : '';
 58$excerpt   = isset( $_POST['excerpt'] ) ? sanitize_textarea_field( wp_unslash( $_POST['excerpt'] ) ) : '';
 59$blog_name = isset( $_POST['blog_name'] ) ? sanitize_text_field( wp_unslash( $_POST['blog_name'] ) ) : '';
 60
 61if ( $charset ) {
 62	$charset = str_replace( array( ',', ' ' ), '', strtoupper( trim( $charset ) ) );
 63
 64	// Validate the specified "sender" charset is available on the receiving site.
 65	if ( function_exists( 'mb_list_encodings' ) && ! in_array( $charset, mb_list_encodings(), true ) ) {
 66		$charset = '';
 67	}
 68}
 69
 70if ( ! $charset ) {
 71	$charset = 'ASCII, UTF-8, ISO-8859-1, JIS, EUC-JP, SJIS';
 72}
 73
 74// No valid uses for UTF-7.
 75if ( str_contains( $charset, 'UTF-7' ) ) {
 76	die;
 77}
 78
 79// For international trackbacks.
 80if ( function_exists( 'mb_convert_encoding' ) ) {
 81	$title     = mb_convert_encoding( $title, get_option( 'blog_charset' ), $charset );
 82	$excerpt   = mb_convert_encoding( $excerpt, get_option( 'blog_charset' ), $charset );
 83	$blog_name = mb_convert_encoding( $blog_name, get_option( 'blog_charset' ), $charset );
 84}
 85
 86// Escape values to use in the trackback.
 87$title     = wp_slash( $title );
 88$excerpt   = wp_slash( $excerpt );
 89$blog_name = wp_slash( $blog_name );
 90
 91if ( is_single() || is_page() ) {
 92	$post_id = $posts[0]->ID;
 93}
 94
 95if ( ! isset( $post_id ) || ! (int) $post_id ) {
 96	trackback_response( 1, __( 'I really need an ID for this to work.' ) );
 97}
 98
 99if ( empty( $title ) && empty( $trackback_url ) && empty( $blog_name ) ) {
100	// If it doesn't look like a trackback at all.
101	wp_redirect( get_permalink( $post_id ) );
102	exit;
103}
104
105if ( ! empty( $trackback_url ) && ! empty( $title ) ) {
106	/**
107	 * Fires before the trackback is added to a post.
108	 *
109	 * @since 4.7.0
110	 *
111	 * @param int    $post_id       Post ID related to the trackback.
112	 * @param string $trackback_url Trackback URL.
113	 * @param string $charset       Character set.
114	 * @param string $title         Trackback title.
115	 * @param string $excerpt       Trackback excerpt.
116	 * @param string $blog_name     Site name.
117	 */
118	do_action( 'pre_trackback_post', $post_id, $trackback_url, $charset, $title, $excerpt, $blog_name );
119
120	header( 'Content-Type: text/xml; charset=' . get_option( 'blog_charset' ) );
121
122	if ( ! pings_open( $post_id ) ) {
123		trackback_response( 1, __( 'Sorry, trackbacks are closed for this item.' ) );
124	}
125
126	$title   = wp_html_excerpt( $title, 250, '&#8230;' );
127	$excerpt = wp_html_excerpt( $excerpt, 252, '&#8230;' );
128
129	$comment_post_id      = (int) $post_id;
130	$comment_author       = $blog_name;
131	$comment_author_email = '';
132	$comment_author_url   = $trackback_url;
133	$comment_content      = "<strong>$title</strong>\n\n$excerpt";
134	$comment_type         = 'trackback';
135
136	$dupe = $wpdb->get_results(
137		$wpdb->prepare(
138			"SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_author_url = %s",
139			$comment_post_id,
140			$comment_author_url
141		)
142	);
143
144	if ( $dupe ) {
145		trackback_response( 1, __( 'There is already a ping from that URL for this post.' ) );
146	}
147
148	$commentdata = array(
149		'comment_post_ID' => $comment_post_id,
150	);
151
152	$commentdata += compact(
153		'comment_author',
154		'comment_author_email',
155		'comment_author_url',
156		'comment_content',
157		'comment_type'
158	);
159
160	$result = wp_new_comment( $commentdata );
161
162	if ( is_wp_error( $result ) ) {
163		trackback_response( 1, $result->get_error_message() );
164	}
165
166	$trackback_id = $wpdb->insert_id;
167
168	/**
169	 * Fires after a trackback is added to a post.
170	 *
171	 * @since 1.2.0
172	 *
173	 * @param int $trackback_id Trackback ID.
174	 */
175	do_action( 'trackback_post', $trackback_id );
176
177	trackback_response( 0 );
178}
179