Ticket #36901: 36901.6.diff

src/wp-includes/comment.php

@@ -581 +581 @@
  * Validates whether this comment is allowed to be made.
  *
  * @since 2.0.0
+ * @since 4.7.0 The `$avoid_die` parameter was added.
  *
  * @global wpdb $wpdb WordPress database abstraction object.
  *
- * @param array $commentdata Contains information on the comment
- * @return int|string Signifies the approval status (0|1|'spam')
+ * @param array   $commentdata Contains information on the comment.
+ * @param boolean $avoid_die   Should errors be returned as WP_Error objects
+ *                             instead of executing wp_die()? Default false.
+ * @return int|string|WP_Error Allowed comments return the approval status (0|1|'spam').
+ *                             If $avoid_die is true, unallowed comments return a WP_Error.
  */
-function wp_allow_comment( $commentdata ) {
+function wp_allow_comment( $commentdata, $avoid_die = false ) {
         global $wpdb;
 
         // Simple duplicate check
@@ -632 +636 @@
                  * @param array $commentdata Comment data.
                  */
                 do_action( 'comment_duplicate_trigger', $commentdata );
-                if ( wp_doing_ajax() ) {
-                        die( __('Duplicate comment detected; it looks as though you’ve already said that!') );
+                if ( true === $avoid_die ) {
+                        return new WP_Error( 'comment_duplicate', __( 'Duplicate comment detected; it looks as though you’ve already said that!' ), 409 );
+                } else {
+                        if ( wp_doing_ajax() ) {
+                                die( __('Duplicate comment detected; it looks as though you’ve already said that!') );
+                        }
+
+                        wp_die( __( 'Duplicate comment detected; it looks as though you’ve already said that!' ), 409 );
                 }
-                wp_die( __( 'Duplicate comment detected; it looks as though you’ve already said that!' ), 409 );
         }
 
         /**
@@ -644 +653 @@
          * Allows checking for comment flooding.
          *
          * @since 2.3.0
+         * @since 4.7.0 The `$avoid_die` parameter was added.
          *
          * @param string $comment_author_IP    Comment author's IP address.
          * @param string $comment_author_email Comment author's email.
          * @param string $comment_date_gmt     GMT date the comment was posted.
+         * @param boolean $avoid_die           Prevent executing wp_die() or die()
+         *                                     if a comment flood is occuring.
          */
         do_action(
                 'check_comment_flood',
                 $commentdata['comment_author_IP'],
                 $commentdata['comment_author_email'],
-                $commentdata['comment_date_gmt']
+                $commentdata['comment_date_gmt'],
+                $avoid_die
         );
 
+        /**
+         * Filters whether a comment is part of a comment flood or not.
+         *
+         * @since 4.7.0
+         *
+         * @param boolean $is_flood                            Is a comment flooding occurring?
+         *                                                     Default is false.
+         * @param string  $commentdata['comment_author_IP']    Comment author's IP address.
+         * @param string  $commentdata['comment_author_email'] Comment author's email.
+         * @param string  $commentdata['comment_date_gmt']     GMT date the comment was posted.
+         * @param boolean $avoid_die                           Prevent executing wp_die() or die()
+         *                                                     if a comment flood is occuring.
+         */
+        $is_flood = apply_filters(
+                'wp_is_comment_flood',
+                false,
+                $commentdata['comment_author_IP'],
+                $commentdata['comment_author_email'],
+                $commentdata['comment_date_gmt'],
+                $avoid_die
+        );
+
+        if ( $is_flood ) {
+                return new WP_Error( 'comment_flood', __( 'You are posting comments too quickly. Slow down.' ), 429 );
+        }
+
         if ( ! empty( $commentdata['user_id'] ) ) {
                 $user = get_userdata( $commentdata['user_id'] );
                 $post_author = $wpdb->get_var( $wpdb->prepare(
@@ -708 +747 @@
 }
 
 /**
+ * Hooks WP's native database-based comment-flood check.
+ *
+ * @since 2.3.0
+ * @since 4.7.0 Converted to be an add_filter() wrapper.
+ */
+function check_comment_flood_db() {
+        add_filter( 'wp_is_comment_flood', 'wp_check_comment_flood', 10, 5 );
+}
+
+/**
  * Check whether comment flooding is occurring.
  *
  * Won't run, if current user can manage options, so to not block
  * administrators.
  *
- * @since 2.3.0
+ * @since 4.7.0
  *
  * @global wpdb $wpdb WordPress database abstraction object.
  *
- * @param string $ip Comment IP.
- * @param string $email Comment author email address.
- * @param string $date MySQL time string.
+ * @param boolean $is_flood  Is a comment flooding occurring?
+ * @param string  $ip        Comment IP.
+ * @param string  $email     Comment author email address.
+ * @param string  $date      MySQL time string.
+ * @param boolean $avoid_die Prevent executing wp_die() or die() if a
+ *                           comment flood is occuring. Default is false.
+ * @return boolean|WP_Error True or a WP_Error if a comment flood is occuring,
+ *                          otherwise false.
  */
-function check_comment_flood_db( $ip, $email, $date ) {
+function wp_check_comment_flood( $is_flood, $ip, $email, $date, $avoid_die = false ) {
+
         global $wpdb;
+
+        if ( true === $is_flood ) {
+                return $is_flood;
+        }
+
         // don't throttle admins or moderators
         if ( current_user_can( 'manage_options' ) || current_user_can( 'moderate_comments' ) ) {
-                return;
+                return false;
         }
         $hour_ago = gmdate( 'Y-m-d H:i:s', time() - HOUR_IN_SECONDS );
 
@@ -767 +827 @@
                          * @param int $time_newcomment  Timestamp of when the new comment was posted.
                          */
                         do_action( 'comment_flood_trigger', $time_lastcomment, $time_newcomment );
+                        if ( true === $avoid_die ) {
+                                return true;
+                        } else {
+                                if ( wp_doing_ajax() ) {
+                                        die( __('You are posting comments too quickly. Slow down.') );
+                                }
 
-                        if ( wp_doing_ajax() )
-                                die( __('You are posting comments too quickly. Slow down.') );
-
-                        wp_die( __( 'You are posting comments too quickly. Slow down.' ), 429 );
+                                wp_die( __( 'You are posting comments too quickly. Slow down.' ), 429 );
+                        }
                 }
         }
+
+        return false;
 }
 
 /**
@@ -1717 +1783 @@
  *
  * @since 1.5.0
  * @since 4.3.0 'comment_agent' and 'comment_author_IP' can be set via `$commentdata`.
+ * @since 4.7.0 The `$avoid_die` parameter was added.
  *
  * @see wp_insert_comment()
  * @global wpdb $wpdb WordPress database abstraction object.
@@ -1740 +1807 @@
  *     @type string $comment_author_IP    Comment author IP address in IPv4 format. Default is the value of
  *                                        'REMOTE_ADDR' in the `$_SERVER` superglobal sent in the original request.
  * }
- * @return int|false The ID of the comment on success, false on failure.
+ * @param boolean $avoid_die Should errors be returned as WP_Error objects instead of
+ *                           executing wp_die()? Default false.
+ * @return int|false|WP_Error The ID of the comment on success, false or WP_Error on failure.
  */
-function wp_new_comment( $commentdata ) {
+function wp_new_comment( $commentdata, $avoid_die = false ) {
         global $wpdb;
 
         if ( isset( $commentdata['user_ID'] ) ) {
@@ -1791 +1860 @@
 
         $commentdata = wp_filter_comment($commentdata);
 
-        $commentdata['comment_approved'] = wp_allow_comment($commentdata);
+        $commentdata['comment_approved'] = wp_allow_comment( $commentdata, $avoid_die );
+        if ( is_wp_error( $commentdata['comment_approved'] ) ) {
+                return $commentdata['comment_approved'];
+        }
 
         $comment_ID = wp_insert_comment($commentdata);
         if ( ! $comment_ID ) {
@@ -1805 +1877 @@
 
                 $commentdata = wp_filter_comment( $commentdata );
 
-                $commentdata['comment_approved'] = wp_allow_comment( $commentdata );
+                $commentdata['comment_approved'] = wp_allow_comment( $commentdata, $avoid_die );
+                if ( is_wp_error( $commentdata['comment_approved'] ) ) {
+                        return $commentdata['comment_approved'];
+                }
 
                 $comment_ID = wp_insert_comment( $commentdata );
                 if ( ! $comment_ID ) {
@@ -2927 +3002 @@
                 'user_ID'
         );
 
-        $comment_id = wp_new_comment( wp_slash( $commentdata ) );
+        $comment_id = wp_new_comment( wp_slash( $commentdata ), true );
+        if ( is_wp_error( $comment_id ) ) {
+                return $comment_id;
+        }
+
         if ( ! $comment_id ) {
                 return new WP_Error( 'comment_save_error', __( '<strong>ERROR</strong>: The comment could not be saved. Please try again later.' ), 500 );
         }
 
         return get_comment( $comment_id );
-
 }

tests/phpunit/tests/comment-submission.php

@@ -714 +714 @@
                 return $commentdata;
         }
 
+        /**
+         * @ticket 36901
+         */
+        public function test_submitting_duplicate_comments() {
+                $post = self::factory()->post->create_and_get( array(
+                        'post_status' => 'publish',
+                ) );
+                $data = array(
+                        'comment_post_ID' => $post->ID,
+                        'comment'         => 'Did I say that?',
+                        'author'          => 'Repeat myself',
+                        'email'           => 'mail@example.com',
+                );
+                $first_comment = wp_handle_comment_submission( $data );
+                $second_comment = wp_handle_comment_submission( $data );
+                $this->assertWPError( $second_comment );
+                $this->assertSame( 'comment_duplicate', $second_comment->get_error_code() );
+        }
+
+        /**
+         * @ticket 36901
+         */
+        public function test_comments_flood() {
+                $post = self::factory()->post->create_and_get( array(
+                        'post_status' => 'publish',
+                ) );
+                $data = array(
+                        'comment_post_ID' => $post->ID,
+                        'comment'         => 'Did I say that?',
+                        'author'          => 'Repeat myself',
+                        'email'           => 'mail@example.com',
+                );
+                $first_comment = wp_handle_comment_submission( $data );
+
+                $data['comment'] = 'Wow! I am quick!';
+                $second_comment = wp_handle_comment_submission( $data );
+
+                $this->assertWPError( $second_comment );
+                $this->assertSame( 'comment_flood', $second_comment->get_error_code() );
+        }
+
+        /**
+         * @ticket 36901
+         */
+        public function test_comments_flood_user_is_admin() {
+                $user = self::factory()->user->create_and_get( array(
+                        'role' => 'administrator',
+                ) );
+                wp_set_current_user( $user->ID );
+
+                $post = self::factory()->post->create_and_get( array(
+                        'post_status' => 'publish',
+                ) );
+                $data = array(
+                        'comment_post_ID' => $post->ID,
+                        'comment'         => 'Did I say that?',
+                        'author'          => 'Repeat myself',
+                        'email'           => 'mail@example.com',
+                );
+                $first_comment = wp_handle_comment_submission( $data );
+
+                $data['comment'] = 'Wow! I am quick!';
+                $second_comment = wp_handle_comment_submission( $data );
+
+                $this->assertNotWPError( $second_comment );
+                $this->assertEquals( $post->ID, $second_comment->comment_post_ID );
+        }
 }