From 611898a5a7f5fe1272e9c426a3d66e680233178d Mon Sep 17 00:00:00 2001
From: Emidio Reggiani <emidio.reggiani@cp-spa.it>
Date: Sun, 28 Dec 2025 09:49:58 +0100
Subject: [PATCH] Bugfixes in comments subscription system and notifications.

---
 lang/en_US.ini               |  3 ++-
 system/htmly.php             | 20 ++++++++++----------
 system/includes/comments.php | 11 ++++++++---
 3 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/lang/en_US.ini b/lang/en_US.ini
index 204e1bc..8a84fd0 100644
--- a/lang/en_US.ini
+++ b/lang/en_US.ini
@@ -405,7 +405,8 @@ pending_comments = "Pending Comments"
 level = "Level"
 enable_jstime="Enable Javascript and timestamp anti-spam protection"
 jstime_desc="Usually bots dont't use Javascript. Form also checks if submitted between 3 and 600 seconds (preventing bots fast submission)"
-comment_email_admin_subject="New comment awaiting moderation"
+comment_email_admin_awaiting="New comment awaiting moderation"
+comment_email_admin_new="New comment"
 comment_email_subscription_subject = "Subscription confirmation to"
 comment_email_new = "New comment on"
 comment_email_from = "From"
diff --git a/system/htmly.php b/system/htmly.php
index 9c740db..4e31afa 100644
--- a/system/htmly.php
+++ b/system/htmly.php
@@ -3101,8 +3101,8 @@ get('/admin/categories/:category', function ($category) {
 
 // Show admin/comments - All comments
 get('/admin/comments', function () {
-    $user = $_SESSION[site_url()]['user'];
-    $role = user('role', $user);
+    $user = $_SESSION[site_url()]['user'] ?? null;
+    $role = user('role', $user) ?? null;
     if (login() && ($role === 'admin' || $role === 'editor')) {
         config('views.root', 'system/admin/views');
 
@@ -3139,8 +3139,8 @@ get('/admin/comments', function () {
 
 // Show admin/comments/pending - Pending comments
 get('/admin/comments/pending', function () {
-    $user = $_SESSION[site_url()]['user'];
-    $role = user('role', $user);
+    $user = $_SESSION[site_url()]['user'] ?? null;
+    $role = user('role', $user) ?? null;
     if (login() && ($role === 'admin' || $role === 'editor')) {
         config('views.root', 'system/admin/views');
 
@@ -3187,8 +3187,8 @@ get('/admin/comments/pending', function () {
 
 // Show admin/comments/settings - Settings page
 get('/admin/comments/settings', function () {
-    $user = $_SESSION[site_url()]['user'];
-    $role = user('role', $user);
+    $user = $_SESSION[site_url()]['user'] ?? null;
+    $role = user('role', $user) ?? null;
     if (login() && $role === 'admin') {
         config('views.root', 'system/admin/views');
 
@@ -3214,7 +3214,7 @@ get('/admin/comments/settings', function () {
 
 // Save comments settings
 post('/admin/comments/settings', function () {
-    $proper = is_csrf_proper(from($_REQUEST, 'csrf_token'));
+    $proper = is_csrf_proper(from($_REQUEST, 'csrf_token')) ?? null;
     if (login() && $proper) {
         $user = $_SESSION[site_url()]['user'];
         $role = user('role', $user);
@@ -3275,8 +3275,8 @@ post('/admin/comments/settings', function () {
 
 // Show edit comment form
 get('/admin/comments/edit/:commentfile/:commentid', function ($commentfile, $commentid) {
-    $user = $_SESSION[site_url()]['user'];
-    $role = user('role', $user);
+    $user = $_SESSION[site_url()]['user'] ?? null;
+    $role = user('role', $user) ?? null;
     if (login() && ($role === 'admin' || $role === 'editor')) {
         
         config('views.root', 'system/admin/views');
@@ -3321,7 +3321,7 @@ get('/admin/comments/edit/:commentfile/:commentid', function ($commentfile, $com
 
 // Update comment
 post('/admin/comments/update/:commentfile/:commentid', function ($commentfile, $commentid) {
-    $proper = is_csrf_proper(from($_REQUEST, 'csrf_token'));
+    $proper = is_csrf_proper(from($_REQUEST, 'csrf_token')) ?? null;
     if (login() && $proper) {
         $user = $_SESSION[site_url()]['user'];
         $role = user('role', $user);
diff --git a/system/includes/comments.php b/system/includes/comments.php
index f6aa4d0..c8262ea 100644
--- a/system/includes/comments.php
+++ b/system/includes/comments.php
@@ -931,7 +931,12 @@ function sendCommentEmail($to, $toName, $url, $comment, $type = 'admin')
         $mail->CharSet = 'UTF-8';
 
         if ($type === 'admin') {
-            $mail->Subject = i18n('comment_email_admin_subject') . " - " . config('blog.title');
+            if (comments_config('comments.moderation') === 'true') {
+                $mail->Subject = i18n('comment_email_admin_awaiting') . " - " . config('blog.title');
+            }
+            else {
+                $mail->Subject = i18n('comment_email_admin_new') . " - " . config('blog.title');    
+            }
             $mail->Body = "
                 <h3>".i18n('comment_email_new').": {$url}</h3>
                 <p><strong>" . i18n('comment_email_from') . ":</strong> {$comment['name']} ({$comment['email']})</p>
@@ -948,7 +953,7 @@ function sendCommentEmail($to, $toName, $url, $comment, $type = 'admin')
                 <p>" . nl2br(htmlspecialchars($comment['comment'])) . "</p>
                 <p><a href='" . site_url() . "{$url}#comment-{$comment['id']}'>" . i18n('comment_email_view_comment') . "</a></p>
                 <p>&nbsp;</p>
-                <p>" . i18n('comment_subscribe_unsubscribe_message') . " ".config('blog.title')." " . i18n('comment_subscribe_unsubscribe_anytime') . ": <a href=\"".config('site.url')."?unsubscribe=".encryptEmailForFilename($email, comments_config('comments.salt'))."\"><b>" .  i18n('comment_unsubscribe') . "</b></a>.</p>
+                <p>" . i18n('comment_subscribe_unsubscribe_message') . " ".config('blog.title')." " . i18n('comment_subscribe_unsubscribe_anytime') . ": <a href=\"".config('site.url')."?unsubscribe=".encryptEmailForFilename($to, comments_config('comments.salt'))."\"><b>" .  i18n('comment_unsubscribe') . "</b></a>.</p>
                 <p>&nbsp;</p>
             ";
         }
@@ -1014,7 +1019,7 @@ if (isset($_GET['subscribe'])) {
 }
 
 if (isset($_GET['unsubscribe'])) {
-    confirmSubscription($_GET['subscribe']);
+    deleteSubscription($_GET['unsubscribe']);
 }