Ticket #36901: 36901.patch

src/wp-includes/comment.php

@@ -38 +38 @@
  */
 function check_comment($author, $email, $url, $comment, $user_ip, $user_agent, $comment_type) {
         global $wpdb;
-
         // If manual moderation is enabled, skip all checks and return false.
         if ( 1 == get_option('comment_moderation') )
                 return false;
@@ -633 +632 @@
                  * @param array $commentdata Comment data.
                  */
                 do_action( 'comment_duplicate_trigger', $commentdata );
-                if ( defined( 'DOING_AJAX' ) ) {
-                        die( __('Duplicate comment detected; it looks as though you’ve already said that!') );
-                }
-                wp_die( __( 'Duplicate comment detected; it looks as though you’ve already said that!' ), 409 );
+                return new WP_Error( 'duplicate_comment', __( 'Duplicate comment detected; it looks as though you’ve already said that!' ), 409 );
         }
 
         /**
@@ -657 +653 @@
                 $commentdata['comment_date_gmt']
         );
 
+        $is_flood = apply_filters( 'is_comment_flood', false, $commentdata['comment_author_IP'], $commentdata['comment_author_email'], $commentdata['comment_date_gmt'] );
+        if ( $is_flood ) {
+                return new WP_Error( 'comment_flood', __( 'You are posting comments too quickly. Slow down.' ), 429 );
+        }
+
         if ( ! empty( $commentdata['user_id'] ) ) {
                 $user = get_userdata( $commentdata['user_id'] );
                 $post_author = $wpdb->get_var( $wpdb->prepare(
@@ -718 +719 @@
  *
  * @global wpdb $wpdb WordPress database abstraction object.
  *
+ * @param bool   $is_flood Is comment flood.
  * @param string $ip Comment IP.
  * @param string $email Comment author email address.
  * @param string $date MySQL time string.
+
  */
-function check_comment_flood_db( $ip, $email, $date ) {
+function check_comment_flood_db( $is_flood, $ip, $email, $date = false ) {
+        //Check for backwards compatibility
+        if( ! is_bool( $is_flood ) ){
+                $date = $email;
+                $email = $ip;
+                $ip = $is_flood;
+                $is_flood = false;
+        }
+        if( $is_flood )
+                return $is_flood;
+
         global $wpdb;
         // don't throttle admins or moderators
         if ( current_user_can( 'manage_options' ) || current_user_can( 'moderate_comments' ) ) {
-                return;
+                return false;
         }
         $hour_ago = gmdate( 'Y-m-d H:i:s', time() - HOUR_IN_SECONDS );
 
@@ -757 +770 @@
                  * @param int  $time_lastcomment Timestamp of when the last comment was posted.
                  * @param int  $time_newcomment  Timestamp of when the new comment was posted.
                  */
-                $flood_die = apply_filters( 'comment_flood_filter', false, $time_lastcomment, $time_newcomment );
-                if ( $flood_die ) {
+                $is_flood = apply_filters( 'comment_flood_filter', $is_flood, $time_lastcomment, $time_newcomment );
+                if ( $is_flood ) {
                         /**
                          * Fires before the comment flood message is triggered.
                          *
@@ -769 +782 @@
                          */
                         do_action( 'comment_flood_trigger', $time_lastcomment, $time_newcomment );
 
-                        if ( defined('DOING_AJAX') )
-                                die( __('You are posting comments too quickly. Slow down.') );
-
-                        wp_die( __( 'You are posting comments too quickly. Slow down.' ), 429 );
+                        return $is_flood;
                 }
         }
+        return $is_flood;
 }
 
 /**
@@ -1786 +1797 @@
         $commentdata = wp_filter_comment($commentdata);
 
         $commentdata['comment_approved'] = wp_allow_comment($commentdata);
+        if ( is_wp_error( $commentdata['comment_approved'] ) ) {
+                return $commentdata['comment_approved'];
+        }
 
         $comment_ID = wp_insert_comment($commentdata);
         if ( ! $comment_ID ) {
@@ -1800 +1814 @@
                 $commentdata = wp_filter_comment( $commentdata );
 
                 $commentdata['comment_approved'] = wp_allow_comment( $commentdata );
+                if ( is_wp_error( $commentdata['comment_approved'] ) ) {
+                        return $commentdata['comment_approved'];
+                }
 
                 $comment_ID = wp_insert_comment( $commentdata );
                 if ( ! $comment_ID ) {
@@ -2917 +2934 @@
         );
 
         $comment_id = wp_new_comment( wp_slash( $commentdata ) );
+        if ( is_wp_error( $comment_id ) ) {
+                return $comment_id;
+        }
+
         if ( ! $comment_id ) {
                 return new WP_Error( 'comment_save_error', __( '<strong>ERROR</strong>: The comment could not be saved. Please try again later.' ), 500 );
         }

src/wp-includes/default-filters.php

@@ -190 +190 @@
 add_filter( 'teeny_mce_before_init',    '_mce_set_direction'                  );
 add_filter( 'pre_kses',                 'wp_pre_kses_less_than'               );
 add_filter( 'sanitize_title',           'sanitize_title_with_dashes',   10, 3 );
-add_action( 'check_comment_flood',      'check_comment_flood_db',       10, 3 );
+add_filter( 'is_comment_flood',         'check_comment_flood_db',       10, 4 );
 add_filter( 'comment_flood_filter',     'wp_throttle_comment_flood',    10, 3 );
 add_filter( 'pre_comment_content',      'wp_rel_nofollow',              15    );
 add_filter( 'comment_email',            'antispambot'                         );

tests/phpunit/tests/comment-submission.php

@@ -714 +714 @@
                 return $commentdata;
         }
 
-}
+
+
+        public function test_submitting_duplicate_comments() {
+                $post = self::factory()->post->create_and_get( array(
+                        'post_status' => 'publish',
+                ) );
+                $data = array(
+                        'comment_post_ID'       => $post->ID,
+                        'comment'               => 'Did I say that?',
+                        'author'                => 'Repeat myself',
+                        'email'                 => 'mail@example.com',
+                );
+                $first_comment = wp_handle_comment_submission( $data );         
+                $second_comment = wp_handle_comment_submission( $data );
+                $this->assertWPError( $second_comment );
+                $this->assertSame( 'duplicate_comment', $second_comment->get_error_code() );
+        }
+
+        public function test_comments_flood() {
+                $post = self::factory()->post->create_and_get( array(
+                        'post_status' => 'publish',
+                ) );
+                $data = array(
+                        'comment_post_ID'       => $post->ID,
+                        'comment'               => 'Did I say that?',
+                        'author'                => 'Repeat myself',
+                        'email'                 => 'mail@example.com',
+                );
+                $first_comment = wp_handle_comment_submission( $data );
+
+                $data['comment'] = 'Wow! I am quick!';  
+                $second_comment = wp_handle_comment_submission( $data );
+
+                $this->assertWPError( $second_comment );
+                $this->assertSame( 'comment_flood', $second_comment->get_error_code() );
+        }
+
+        public function test_comments_flood_user_is_admin() {
+                $user = self::factory()->user->create_and_get( array(
+                        'role' => 'administrator',
+                ) );
+                wp_set_current_user( $user->ID );
+
+                $post = self::factory()->post->create_and_get( array(
+                        'post_status' => 'publish',
+                ) );
+                $data = array(
+                        'comment_post_ID'       => $post->ID,
+                        'comment'               => 'Did I say that?',
+                        'author'                => 'Repeat myself',
+                        'email'                 => 'mail@example.com',
+                );
+                $first_comment = wp_handle_comment_submission( $data );
+                
+                $data['comment'] = 'Wow! I am quick!';  
+                $second_comment = wp_handle_comment_submission( $data );
+
+                $this->assertNotWPError( $second_comment );
+                $this->assertEquals( $post->ID, $second_comment->comment_post_ID );
+        }
+
+}
+ No newline at end of file