1<?php
  2/**
  3 * Handles Comment Post to WordPress and prevents duplicate comment posting.
  4 *
  5 * @package WordPress
  6 */
  7
  8if ( 'POST' !== $_SERVER['REQUEST_METHOD'] ) {
  9	$protocol = $_SERVER['SERVER_PROTOCOL'];
 10	if ( ! in_array( $protocol, array( 'HTTP/1.1', 'HTTP/2', 'HTTP/2.0', 'HTTP/3' ), true ) ) {
 11		$protocol = 'HTTP/1.0';
 12	}
 13
 14	header( 'Allow: POST' );
 15	header( "$protocol 405 Method Not Allowed" );
 16	header( 'Content-Type: text/plain' );
 17	exit;
 18}
 19
 20/** Sets up the WordPress Environment. */
 21require __DIR__ . '/wp-load.php';
 22
 23nocache_headers();
 24
 25$comment = wp_handle_comment_submission( wp_unslash( $_POST ) );
 26if ( is_wp_error( $comment ) ) {
 27	$data = (int) $comment->get_error_data();
 28	if ( ! empty( $data ) ) {
 29		wp_die(
 30			'<p>' . $comment->get_error_message() . '</p>',
 31			__( 'Comment Submission Failure' ),
 32			array(
 33				'response'  => $data,
 34				'back_link' => true,
 35			)
 36		);
 37	} else {
 38		exit;
 39	}
 40}
 41
 42$user            = wp_get_current_user();
 43$cookies_consent = ( isset( $_POST['wp-comment-cookies-consent'] ) );
 44
 45/**
 46 * Fires after comment cookies are set.
 47 *
 48 * @since 3.4.0
 49 * @since 4.9.6 The `$cookies_consent` parameter was added.
 50 *
 51 * @param WP_Comment $comment         Comment object.
 52 * @param WP_User    $user            Comment author's user object. The user may not exist.
 53 * @param bool       $cookies_consent Comment author's consent to store cookies.
 54 */
 55do_action( 'set_comment_cookies', $comment, $user, $cookies_consent );
 56
 57$location = empty( $_POST['redirect_to'] ) ? get_comment_link( $comment ) : $_POST['redirect_to'] . '#comment-' . $comment->comment_ID;
 58
 59// If user didn't consent to cookies, add specific query arguments to display the awaiting moderation message.
 60if ( ! $cookies_consent && 'unapproved' === wp_get_comment_status( $comment ) && ! empty( $comment->comment_author_email ) ) {
 61	$location = add_query_arg(
 62		array(
 63			'unapproved'      => $comment->comment_ID,
 64			'moderation-hash' => wp_hash( $comment->comment_date_gmt ),
 65		),
 66		$location
 67	);
 68}
 69
 70/**
 71 * Filters the location URI to send the commenter after posting.
 72 *
 73 * @since 2.0.5
 74 *
 75 * @param string     $location The 'redirect_to' URI sent via $_POST.
 76 * @param WP_Comment $comment  Comment object.
 77 */
 78$location = apply_filters( 'comment_post_redirect', $location, $comment );
 79
 80wp_safe_redirect( $location );
 81exit;
 82