1 files changed, 87 insertions, 53 deletions

diff --git a/plugins/jetpack/modules/gravatar-hovercards.php b/plugins/jetpack/modules/gravatar-hovercards.php
index 9e7bf1e8..c8d75624 100644
--- a/plugins/jetpack/modules/gravatar-hovercards.php
+++ b/plugins/jetpack/modules/gravatar-hovercards.php
@@ -10,19 +10,24 @@
  * Module Tags: Social, Appearance
  * Feature: Appearance
  * Additional Search Queries: gravatar, hovercards
+ *
+ * @package automattic/jetpack
  */
 
 define( 'GROFILES__CACHE_BUSTER', gmdate( 'YW' ) );
 
+/**
+ * Actions that are run on init.
+ */
 function grofiles_hovercards_init() {
-	add_filter( 'get_avatar',          'grofiles_get_avatar', 10, 2 );
-	add_action( 'wp_enqueue_scripts',  'grofiles_attach_cards' );
-	add_action( 'wp_footer',           'grofiles_extra_data' );
-	add_action( 'admin_init',          'grofiles_add_settings' );
-
-	add_action( 'load-index.php',              'grofiles_admin_cards' );
-	add_action( 'load-users.php',              'grofiles_admin_cards' );
-	add_action( 'load-edit-comments.php',      'grofiles_admin_cards' );
+	add_filter( 'get_avatar', 'grofiles_get_avatar', 10, 2 );
+	add_action( 'wp_enqueue_scripts', 'grofiles_attach_cards' );
+	add_action( 'wp_footer', 'grofiles_extra_data' );
+	add_action( 'admin_init', 'grofiles_add_settings' );
+
+	add_action( 'load-index.php', 'grofiles_admin_cards' );
+	add_action( 'load-users.php', 'grofiles_admin_cards' );
+	add_action( 'load-edit-comments.php', 'grofiles_admin_cards' );
 	add_action( 'load-options-discussion.php', 'grofiles_admin_cards_forced' );
 
 	add_filter( 'jetpack_module_configuration_url_gravatar-hovercards', 'gravatar_hovercards_configuration_url' );
@@ -30,6 +35,9 @@ function grofiles_hovercards_init() {
 	add_filter( 'get_comment_author_url', 'grofiles_amp_comment_author_url', 10, 2 );
 }
 
+/**
+ * Set configuration page URL.
+ */
 function gravatar_hovercards_configuration_url() {
 	return admin_url( 'options-discussion.php#show_avatars' );
 }
@@ -44,11 +52,12 @@ add_action( 'jetpack_modules_loaded', 'grofiles_hovercards_init' );
  * @todo - always print HTML, hide via CSS/JS if !show_avatars
  */
 function grofiles_add_settings() {
-	if ( !get_option( 'show_avatars' ) )
+	if ( ! get_option( 'show_avatars' ) ) {
 		return;
+	}
 
- 	add_settings_field( 'gravatar_disable_hovercards', __( 'Gravatar Hovercards', 'jetpack' ), 'grofiles_setting_callback', 'discussion', 'avatars' );
- 	register_setting( 'discussion', 'gravatar_disable_hovercards', 'grofiles_hovercard_option_sanitize' );
+	add_settings_field( 'gravatar_disable_hovercards', __( 'Gravatar Hovercards', 'jetpack' ), 'grofiles_setting_callback', 'discussion', 'avatars' );
+	register_setting( 'discussion', 'gravatar_disable_hovercards', 'grofiles_hovercard_option_sanitize' );
 }
 
 /**
@@ -57,10 +66,14 @@ function grofiles_add_settings() {
 function grofiles_setting_callback() {
 	global $current_user;
 
-	$checked = 'disabled' == get_option( 'gravatar_disable_hovercards' ) ? '' : 'checked="checked" ';
+	$option = get_option( 'gravatar_disable_hovercards' );
+	printf(
+		"<label id='gravatar-hovercard-options'><input %s name='gravatar_disable_hovercards' id='gravatar_disable_hovercards' type='checkbox' value='enabled' class='code'/>%s</label>",
+		checked( $option, 'enabled', false ),
+		esc_html__( 'View people\'s profiles when you mouse over their Gravatars', 'jetpack' )
+	);
 
- 	echo "<label id='gravatar-hovercard-options'><input {$checked}name='gravatar_disable_hovercards' id='gravatar_disable_hovercards' type='checkbox' value='enabled' class='code' /> " . __( "View people's profiles when you mouse over their Gravatars", 'jetpack' ) . "</label>";
-?>
+	?>
 <style type="text/css">
 #grav-profile-example img {
 	float: left;
@@ -86,22 +99,29 @@ jQuery( function($) {
 } );
 // ]]>
 </script>
-	<p id="grav-profile-example" class="hide-if-no-js"<?php if ( !$checked ) echo ' style="display:none"'; ?>><?php echo get_avatar( $current_user->ID, 64 ); ?> <span><?php _e( 'Put your mouse over your Gravatar to check out your profile.', 'jetpack' ); ?> <br class="clear" /></span></p>
-<?php
+	<p id="grav-profile-example" class="hide-if-no-js"
+		<?php
+		if ( 'disabled' === $option ) {
+			echo ' style="display:none"';}
+		?>
+		>
+		<?php echo get_avatar( $current_user->ID, 64 ); ?> <span><?php esc_html_e( 'Put your mouse over your Gravatar to check out your profile.', 'jetpack' ); ?> <br class="clear" /></span></p>
+	<?php
 }
 
 /**
  * Sanitation filter for Gravatar Hovercard setting
+ *
+ * @param string $val Disabled or enabled.
  */
 function grofiles_hovercard_option_sanitize( $val ) {
-	if ( 'disabled' == $val ) {
+	if ( 'disabled' === $val ) {
 		return $val;
 	}
 
 	return $val ? 'enabled' : 'disabled';
 }
 
-
 /* Hovercard Display */
 
 /**
@@ -116,18 +136,18 @@ function grofiles_hovercard_option_sanitize( $val ) {
 function grofiles_gravatars_to_append( $author = null ) {
 	static $authors = array();
 
-	// Get
-	if ( is_null( $author ) ) {
+	// Get.
+	if ( $author === null ) {
 		return array_keys( $authors );
 	}
 
-	// Set
+	// Set.
 
 	if ( is_numeric( $author ) ) {
 		$author = (int) $author;
 	}
 
-	$authors[$author] = true;
+	$authors[ $author ] = true;
 }
 
 /**
@@ -154,7 +174,7 @@ function grofiles_amp_comment_author_url( $url, $id ) {
  * Attached to the 'get_avatar' filter.
  *
  * @param string $avatar The <img/> element of the avatar.
- * @param mixed $author User ID, email address, user login, comment object, user object, post object
+ * @param mixed  $author User ID, email address, user login, comment object, user object, post object.
  *
  * @return string The <img/> element of the avatar.
  */
@@ -163,14 +183,16 @@ function grofiles_get_avatar( $avatar, $author ) {
 
 	if ( is_numeric( $author ) ) {
 		grofiles_gravatars_to_append( $author );
-	} else if ( is_string( $author ) ) {
+	} elseif ( is_string( $author ) ) {
 		if ( false !== strpos( $author, '@' ) ) {
 			grofiles_gravatars_to_append( $author );
 		} else {
-			if ( $user = get_user_by( 'slug', $author ) )
+			$user = get_user_by( 'slug', $author );
+			if ( $user ) {
 				grofiles_gravatars_to_append( $user->ID );
+			}
 		}
-	} else if ( isset( $author->comment_type ) ) {
+	} elseif ( isset( $author->comment_type ) ) {
 		if ( $is_amp ) {
 			if ( 1 === preg_match( '/avatar\/([a-zA-Z0-9]+)\?/', $avatar, $email_hash ) ) {
 				$email_hash  = $email_hash[1];
@@ -205,15 +227,17 @@ function grofiles_get_avatar( $avatar, $author ) {
 			return $avatar;
 		}
 
-		if ( '' != $author->comment_type && 'comment' != $author->comment_type )
+		if ( '' !== $author->comment_type && 'comment' !== $author->comment_type ) {
 			return $avatar;
-		if ( $author->user_id )
+		}
+		if ( $author->user_id ) {
 			grofiles_gravatars_to_append( $author->user_id );
-		else
+		} else {
 			grofiles_gravatars_to_append( $author->comment_author_email );
-	} else if ( isset( $author->user_login ) ) {
+		}
+	} elseif ( isset( $author->user_login ) ) {
 		grofiles_gravatars_to_append( $author->ID );
-	} else if ( isset( $author->post_author ) ) {
+	} elseif ( isset( $author->post_author ) ) {
 		grofiles_gravatars_to_append( $author->post_author );
 	}
 
@@ -226,7 +250,6 @@ function grofiles_get_avatar( $avatar, $author ) {
  * @todo is_singular() only?
  */
 function grofiles_attach_cards() {
-	global $blog_id;
 
 	// Is the display of Avatars disabled?
 	if ( ! get_option( 'show_avatars' ) ) {
@@ -234,7 +257,7 @@ function grofiles_attach_cards() {
 	}
 
 	// Is the display of Gravatar Hovercards disabled?
-	if ( 'disabled' == Jetpack_Options::get_option_and_ensure_autoload( 'gravatar_disable_hovercards', '0' ) ) {
+	if ( 'disabled' === Jetpack_Options::get_option_and_ensure_autoload( 'gravatar_disable_hovercards', '0' ) ) {
 		return;
 	}
 
@@ -247,31 +270,41 @@ function grofiles_attach_cards() {
 			$cu      = wp_get_current_user();
 			$my_hash = md5( $cu->user_email );
 		} elseif ( ! empty( $_COOKIE[ 'comment_author_email_' . COOKIEHASH ] ) ) {
-			$my_hash = md5( $_COOKIE[ 'comment_author_email_' . COOKIEHASH ] );
+			$my_hash = md5( filter_var( wp_unslash( $_COOKIE[ 'comment_author_email_' . COOKIEHASH ] ) ) );
 		} else {
 			$my_hash = '';
 		}
 		wp_localize_script( 'wpgroho', 'WPGroHo', compact( 'my_hash' ) );
 	}
 }
-
+/**
+ * Add hovercards on Discussion settings panel.
+ */
 function grofiles_attach_cards_forced() {
 	add_filter( 'pre_option_gravatar_disable_hovercards', 'grofiles_force_gravatar_enable_hovercards' );
 	grofiles_attach_cards();
 }
-
+/**
+ * Set hovercards as enabled on Discussion settings panel.
+ */
 function grofiles_force_gravatar_enable_hovercards() {
 	return 'enabled';
 }
-
+/**
+ * Add script to admin footer on Discussion settings panel.
+ */
 function grofiles_admin_cards_forced() {
 	add_action( 'admin_footer', 'grofiles_attach_cards_forced' );
 }
-
+/**
+ * Add script to admin footer.
+ */
 function grofiles_admin_cards() {
 	add_action( 'admin_footer', 'grofiles_attach_cards' );
 }
-
+/**
+ * Dequeue the FE assets when there are no gravatars on the page to be displayed.
+ */
 function grofiles_extra_data() {
 	$authors = grofiles_gravatars_to_append();
 
@@ -279,15 +312,15 @@ function grofiles_extra_data() {
 		wp_dequeue_script( 'grofiles-cards' );
 		wp_dequeue_script( 'wpgroho' );
 	} else {
-?>
+		?>
 	<div style="display:none">
-<?php
+		<?php
 		foreach ( $authors as $author ) {
 			grofiles_hovercards_data_html( $author );
 		}
-?>
+		?>
 	</div>
-<?php
+		<?php
 	}
 }
 
@@ -296,7 +329,7 @@ function grofiles_extra_data() {
  *
  * @since 5.5.0 Add support for a passed WP_User object
  *
- * @param int|string|WP_User $author User ID, email address, or a WP_User object
+ * @param int|string|WP_User $author User ID, email address, or a WP_User object.
  */
 function grofiles_hovercards_data_html( $author ) {
 	$data = grofiles_hovercards_data( $author );
@@ -315,16 +348,15 @@ function grofiles_hovercards_data_html( $author ) {
 	if ( ! $hash ) {
 		return;
 	}
-?>
-	<div class="grofile-hash-map-<?php echo $hash; ?>">
-<?php	foreach ( $data as $key => $value ) : ?>
+	?>
+	<div class="grofile-hash-map-<?php echo esc_attr( $hash ); ?>">
+	<?php	foreach ( $data as $key => $value ) : ?>
 		<span class="<?php echo esc_attr( $key ); ?>"><?php echo esc_html( $value ); ?></span>
 <?php	endforeach; ?>
 	</div>
-<?php
+	<?php
 }
 
-
 /* API */
 
 /**
@@ -350,18 +382,20 @@ function grofiles_hovercards_data_callbacks() {
 /**
  * Keyed JSON object containing all profile data provided by registered callbacks
  *
- * @param int|strung $author User ID or email address
+ * @param int|strung $author User ID or email address.
  *
  * @return array( data_key => data, ... )
  */
 function grofiles_hovercards_data( $author ) {
 	$r = array();
 	foreach ( grofiles_hovercards_data_callbacks() as $key => $callback ) {
-		if ( !is_callable( $callback ) )
+		if ( ! is_callable( $callback ) ) {
 			continue;
+		}
 		$data = call_user_func( $callback, $author, $key );
-		if ( !is_null( $data ) )
-			$r[$key] = $data;
+		if ( $data !== null ) {
+			$r[ $key ] = $data;
+		}
 	}
 
 	return $r;