comment form nonce

[tellyworth]

This adds a nonce to public comment forms, via the comment_form action.

Can non-logged-in users still comment?

I don't see what this solves. I assume it's attempting to prevent automated commenting by bots. The nonce will be identical for every non-logged in visitor so it'll be very easy for an automated comment bot to get this nonce and use it in its requests, and then we're back to square one.

Scribu: yes they can.

An admin has greater posting privileges than a non-logged-in user, so there would be some advantage just in preventing XSS-commenting for only logged-in users.

And perhaps we could use the client's IP address in the nonce hash when generating it for non-logged-in users?

"I don't see what this solves. I assume it's attempting to prevent automated commenting by bots. The nonce will be identical for every non-logged in visitor so it'll be very easy for an automated comment bot to get this nonce and use it in its requests, and then we're back to square one."

It blocks several things:

1. Dumb bots that just drive-by POST without fetching the page. These are still very common, so it will block a substantial amount of spam.

2. XSS attacks that try to defeat spam filters by tricking real people into submitting an anonymous comment on another blog. Currently rare, but there's no reason to wait until it becomes common.

3. Slightly less dumb bots that do a single fetch on a blog first, then submit many comments on multiple posts. This won't work with the patch applied because the nonce is unique to each post.

This is not intended to block all spam (that's the job of specialized plugins), just raise the bar a little by eliminating the simplest attacks.

filosofo, incorporating the client's IP address would block some legitimate comments. There is scope for hashing and checking additional info, but I think that's the job of spam filtering plugins, not core (that sort of stuff has to change frequently for it to be effective).

Nice idea.

I don't think we should use normal nonces for this.

I think it is better that we have a different class of "nonce" for use on the frontend for non-logged in users.

We can then enforce the usage of the current nonces for logged in users only.

you can also use wp-hashcash...

in case anyone missed it, such a patch can have severe implications when it comes to caching.

Punting, pending more discussion.

I just came across this ticket now via a Google search (I need to do something similar for another project).

This seems like something far more suitable for a plugin as I don't see any way of getting around this when caching heavily.

Related forum post - ​http://wordpress.org/support/topic/wp-comments-postphp-misery

Related: #13791

refreshed patch tested against trunk