Ticket #10377: 10377.3.patch

src/wp-comments-post.php

@@ -130 +130 @@
         wp_die( __( '<strong>ERROR</strong>: please type a comment.' ), 200 );
 }
 
+$comment_content_length = wp_get_comment_content_max_length();
+if ( $comment_content_length < strlen( $comment_content ) ) {
+        wp_die( __( '<strong>ERROR</strong>: your comment is too large.' ), 200 );
+}
+
 $comment_parent = isset($_POST['comment_parent']) ? absint($_POST['comment_parent']) : 0;
 
 $commentdata = compact('comment_post_ID', 'comment_author', 'comment_author_email', 'comment_author_url', 'comment_content', 'comment_type', 'comment_parent', 'user_ID');

src/wp-includes/comment-functions.php

@@ -853 +853 @@
 }
 
 /**
+ * Calculate the maximum length of the comment_content column of the comments table.
+ *
+ * @since 4.4.0
+ *
+ * @global wpdb $wpdb WordPress database abstraction object.
+ *
+ * @return int Maximum comment_content character length.
+ */
+function wp_get_comment_content_max_length() {
+        global $wpdb;
+
+        $col_length = $wpdb->get_col_length( $wpdb->comments, 'comment_content' );
+
+        if ( ! is_array( $col_length ) && (int) $col_length > 0 ) {
+                $content_length = (int) $col_length;
+        } elseif ( is_array( $col_length ) && isset( $col_length['length'] ) && (int) $col_length > 0 ) {
+                $content_length = (int) $col_length['length'];
+        } else {
+                $content_length = 65535;
+        }
+
+        return intval( $content_length ) - 10;
+}
+
+/**
  * Does comment contain blacklisted characters or words.
  *
  * @since 1.5.0

src/wp-includes/comment-template.php

@@ -1921 +1921 @@
         $fields = apply_filters( 'comment_form_default_fields', $fields );
         $defaults = array(
                 'fields'               => $fields,
-                'comment_field'        => '<p class="comment-form-comment"><label for="comment">' . _x( 'Comment', 'noun' ) . '</label> <textarea id="comment" name="comment" cols="45" rows="8"  aria-required="true" required="required"></textarea></p>',
+                'comment_field'        => '<p class="comment-form-comment"><label for="comment">' . _x( 'Comment', 'noun' ) . '</label> <textarea id="comment" name="comment" cols="45" rows="8" maxlength="' . wp_get_comment_content_max_length() . '" aria-required="true" required="required"></textarea></p>',
                 /** This filter is documented in wp-includes/link-template.php */
                 'must_log_in'          => '<p class="must-log-in">' . sprintf( __( 'You must be <a href="%s">logged in</a> to post a comment.' ), wp_login_url( apply_filters( 'the_permalink', get_permalink( $post_id ) ) ) ) . '</p>',
                 /** This filter is documented in wp-includes/link-template.php */