Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@
import org.apache.commons.lang3.builder.EqualsBuilder;
import org.apache.commons.lang3.builder.HashCodeBuilder;
import org.apache.roller.util.UUIDGenerator;
import org.apache.roller.weblogger.util.CommentAuthorUrl;


/**
Expand Down Expand Up @@ -130,6 +131,13 @@ public String getUrl() {
public void setUrl(String url) {
this.url = url;
}

/**
* URL of the comment writer when it can be safely rendered as a link.
*/
public String getSafeUrl() {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: this runs the validator (regex + DomainValidator lookup) on every call, and Comments.jsp evaluates #comment.safeUrl three times per row while weblog.vm evaluates $comment.url twice per comment. Compute once per render (an s:set in the JSP, a local in the macro, or memoize in the wrapper).

return CommentAuthorUrl.normalize(this.url);
}


/**
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -38,12 +38,17 @@ public final class WeblogEntryCommentWrapper {

// url strategy to use for any url building
private final URLStrategy urlStrategy;

private final String safeUrl;


// this is private so that we can force the use of the .wrap(pojo) method
private WeblogEntryCommentWrapper(WeblogEntryComment toWrap, URLStrategy strat) {
this.pojo = toWrap;
this.urlStrategy = strat;
String normalizedUrl = toWrap.getSafeUrl();
this.safeUrl = normalizedUrl == null
? "" : StringEscapeUtils.escapeHtml4(normalizedUrl);
}


Expand Down Expand Up @@ -93,7 +98,7 @@ public String getEmail() {
* Value is always html escaped.
*/
public String getUrl() {
return StringEscapeUtils.escapeHtml4(this.pojo.getUrl());
return safeUrl;
}


Expand Down Expand Up @@ -147,7 +152,7 @@ public String getRemoteHost() {


/**
* Get the http referrer of the comment poster, used for trackbacks.
* Get the HTTP referrer of the comment poster.
*
* Value is always html escaped.
*/
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,6 @@ public class WeblogRequestMapper implements RequestMapper {
private static final String RSD_SERVLET = "/roller-ui/rendering/rsd";

private static final String COMMENT_SERVLET = "/roller-ui/rendering/comment";
private static final String TRACKBACK_SERVLET = "/roller-ui/rendering/trackback";


// url patterns that are not allowed to be considered weblog handles
Expand Down Expand Up @@ -259,45 +258,24 @@ private String calculateForwardUrl(HttpServletRequest request,

StringBuilder forwardUrl = new StringBuilder(64);

// POST urls, like comment and trackback servlets
// POST URLs for the comment servlet
if("POST".equals(request.getMethod())) {
// posting to permalink, this means comment or trackback
if(context.equals("entry")) {
// trackback requests are required to have an "excerpt" param
if(request.getParameter("excerpt") != null) {
// Comment requests post content to a permalink.
if("entry".equals(context) && request.getParameter("content") != null) {

forwardUrl.append(TRACKBACK_SERVLET);
forwardUrl.append('/');
forwardUrl.append(handle);
if(locale != null) {
forwardUrl.append('/');
forwardUrl.append(locale);
}
forwardUrl.append('/');
forwardUrl.append(context);
if(data != null) {
forwardUrl.append('/');
forwardUrl.append(data);
}

// comment requests are required to have a "content" param
} else if(request.getParameter("content") != null) {

forwardUrl.append(COMMENT_SERVLET);
forwardUrl.append(COMMENT_SERVLET);
forwardUrl.append('/');
forwardUrl.append(handle);
if(locale != null) {
forwardUrl.append('/');
forwardUrl.append(handle);
if(locale != null) {
forwardUrl.append('/');
forwardUrl.append(locale);
}
forwardUrl.append(locale);
}
forwardUrl.append('/');
forwardUrl.append(context);
if(data != null) {
forwardUrl.append('/');
forwardUrl.append(context);
if(data != null) {
forwardUrl.append('/');
forwardUrl.append(data);
}
forwardUrl.append(data);
}

} else {
// someone posting data where they aren't supposed to
return null;
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -101,11 +101,6 @@ public boolean getCommentEmailNotify() {
return getBooleanProperty("users.comments.emailnotify");
}

public boolean getTrackbacksEnabled() {
return getBooleanProperty("users.trackbacks.enabled");
}


/** Get Roller version string */
public String getRollerVersion() {
return WebloggerFactory.getWeblogger().getVersion();
Expand Down Expand Up @@ -146,4 +141,3 @@ private boolean getBooleanProperty(String name) {
}

}

Original file line number Diff line number Diff line change
Expand Up @@ -137,6 +137,16 @@ public String action(String action, String namespace) {
public String getCommentAuthenticator() {
return getSite()+"/CommentAuthenticatorServlet?weblog="+weblog.getHandle();
}

/**
* Retained temporarily so older custom templates continue to render.
*
* @deprecated This endpoint is no longer available.
*/
@Deprecated(since = "6.1.6", forRemoval = true)
public String trackback(String anchor) {
return "";
}


public String themeResource(String theme, String filePath) {
Expand Down Expand Up @@ -184,11 +194,6 @@ public String comments(String anchor) {
}


public String trackback(String anchor) {
return urlStrategy.getWeblogEntryURL(weblog, locale, anchor, true);
}


public String date(String dateString) {
return urlStrategy.getWeblogCollectionURL(weblog, locale, null, dateString, null, -1, true);
}
Expand Down
Original file line number Diff line number Diff line change
@@ -1,75 +1,40 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. The ASF licenses this file to You
* under the Apache License, Version 2.0 (the "License"); you may not
* use this file except in compliance with the License.
* You may obtain a copy of the License at
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License. For additional information regarding
* copyright in this work, please see the NOTICE file in the top level
* directory of this distribution.
* limitations under the License.
*/

package org.apache.roller.weblogger.ui.rendering.plugins.comments;

import java.io.IOException;
import java.net.MalformedURLException;
import java.util.ResourceBundle;

import org.apache.roller.util.RollerConstants;
import org.apache.roller.weblogger.business.WebloggerFactory;
import org.apache.roller.weblogger.config.WebloggerRuntimeConfig;
import org.apache.roller.weblogger.pojos.WeblogEntryComment;
import org.apache.roller.weblogger.util.LinkbackExtractor;
import org.apache.roller.weblogger.util.RollerMessages;

/**
* Validates comment if comment's URL links back to the comment's entry,
* intended for use with trackbacks only.
* No-op retained temporarily for installations that still name this plugin.
*
* @deprecated The associated protocol endpoint is no longer available.
*/
@Deprecated(since = "6.1.6", forRemoval = true)
public class TrackbackLinkbackCommentValidator implements CommentValidator {

private ResourceBundle bundle = ResourceBundle.getBundle("ApplicationResources");


@Override
public String getName() {
return bundle.getString("comment.validator.trackbackLinkbackName");
return "Compatibility comment validator";
}

@Override
public int validate(WeblogEntryComment comment, RollerMessages messages) {

// linkback validation can be toggled at runtime, so check if it's enabled
// if it's disabled then just return a score of 100
if(!WebloggerRuntimeConfig.getBooleanProperty("site.trackbackVerification.enabled")) {
return RollerConstants.PERCENT_100;
}

int ret = 0;
LinkbackExtractor linkback = null;
try {
linkback = new LinkbackExtractor(
comment.getUrl(),
WebloggerFactory.getWeblogger().getUrlStrategy().getWeblogEntryURL(
comment.getWeblogEntry().getWebsite(),
null,
comment.getWeblogEntry().getAnchor(),
true));
} catch (MalformedURLException ignored1) {
} catch (IOException ignored2) {}

if (linkback != null && linkback.getExcerpt() != null) {
ret = RollerConstants.PERCENT_100;
} else {
messages.addError("comment.validator.trackbackLinkbackMessage");
}
return ret;
return RollerConstants.PERCENT_100;
}

}
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,6 @@
import org.apache.commons.lang3.StringUtils;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.apache.commons.validator.routines.UrlValidator;
import org.apache.roller.util.RollerConstants;
import org.apache.roller.weblogger.WebloggerException;
import org.apache.roller.weblogger.config.WebloggerConfig;
Expand All @@ -49,6 +48,7 @@
import org.apache.roller.weblogger.ui.rendering.plugins.comments.DefaultCommentAuthenticator;
import org.apache.roller.weblogger.ui.rendering.util.WeblogCommentRequest;
import org.apache.roller.weblogger.ui.rendering.util.WeblogEntryCommentForm;
import org.apache.roller.weblogger.util.CommentAuthorUrl;
import org.apache.roller.weblogger.util.GenericThrottle;
import org.apache.roller.weblogger.util.IPBanList;
import org.apache.roller.weblogger.util.MailUtil;
Expand Down Expand Up @@ -231,21 +231,10 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
comment.setName(commentRequest.getName());
comment.setEmail(commentRequest.getEmail());

// Validate url
if (StringUtils.isNotEmpty(commentRequest.getUrl())) {
String theUrl = commentRequest.getUrl().trim().toLowerCase();
StringBuilder url = new StringBuilder();
if (theUrl.startsWith("http://")) {
url.append(theUrl);
} else if (theUrl.startsWith("https://")) {
url.append(theUrl);
} else {
url.append("http://").append(theUrl);
}
comment.setUrl(url.toString());
} else {
comment.setUrl("");
}
String submittedCommentUrl = StringUtils.trimToEmpty(commentRequest.getUrl());
String normalizedCommentUrl = CommentAuthorUrl.normalizeInput(submittedCommentUrl);
comment.setUrl(normalizedCommentUrl != null
? normalizedCommentUrl : submittedCommentUrl);

comment.setContent(commentRequest.getContent());
comment.setNotify(commentRequest.isNotify());
Expand Down Expand Up @@ -288,9 +277,8 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
log.debug("Email Adddress is invalid : "
+ commentRequest.getEmail());
// if there is an URL it must be valid
} else if (StringUtils.isNotEmpty(comment.getUrl())
&& !new UrlValidator(new String[] { "http", "https" })
.isValid(comment.getUrl())) {
} else if (StringUtils.isNotEmpty(submittedCommentUrl)
&& normalizedCommentUrl == null) {
error = messageUtils.getString("error.commentPostFailedURL");
log.debug("URL is invalid : " + comment.getUrl());
// if this is a real comment post then authenticate request
Expand Down
Loading