Ticket #38466: 38466.diff

src/wp-includes/class-wp-xmlrpc-server.php

@@ -3553 +3553 @@
                         return new IXR_Error( 403, __( 'Sorry, comments are closed for this item.' ) );
                 }
 
-                $comment = array();
-                $comment['comment_post_ID'] = $post_id;
+                if ( empty( $content_struct['content'] ) ) {
+                        return new IXR_Error( 403, __( 'Comment is required.' ) );
+                }
+
+                $comment = array(
+                        'comment_post_ID' => $post_id,
+                        'comment_content' => $content_struct['content'],
+                );
 
                 if ( $logged_in ) {
                         $display_name = $user->display_name;
@@ -3590 +3596 @@
 
                 $comment['comment_parent'] = isset($content_struct['comment_parent']) ? absint($content_struct['comment_parent']) : 0;
 
-                $comment['comment_content'] =  isset($content_struct['content']) ? $content_struct['content'] : null;
-
                 /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
                 do_action( 'xmlrpc_call', 'wp.newComment' );
 

tests/phpunit/tests/xmlrpc/wp/newComment.php

@@ -4 +4 @@
  * @group xmlrpc
  */
 class Tests_XMLRPC_wp_newComment extends WP_XMLRPC_UnitTestCase {
+
+        function test_valid_comment() {
+                $this->make_user_by_role( 'administrator' );
+                $post = self::factory()->post->create_and_get();
+
+                $result = $this->myxmlrpcserver->wp_newComment( array( 1, 'administrator', 'administrator', $post->ID, array(
+                        'content' => rand_str( 100 )
+                ) ) );
+
+                $this->assertNotInstanceOf( 'IXR_Error', $result );
+        }
+
+        function test_empty_comment() {
+                $this->make_user_by_role( 'administrator' );
+                $post = self::factory()->post->create_and_get();
+
+                $result = $this->myxmlrpcserver->wp_newComment( array( 1, 'administrator', 'administrator', $post->ID, array(
+                        'comment_content' => ''
+                ) ) );
+
+                $this->assertInstanceOf( 'IXR_Error', $result );
+                $this->assertEquals( 403, $result->code );
+        }
+
         function test_new_comment_post_closed() {
                 $this->make_user_by_role( 'administrator' );
                 $post = self::factory()->post->create_and_get( array(