Ticket #39566: 39566.patch

wp-includes/comment.php

@@ -114 +114 @@
                 if ( 'trackback' != $comment_type && 'pingback' != $comment_type && $author != '' && $email != '' ) {
                         $comment_user = get_user_by( 'email', wp_unslash( $email ) );
                         if ( ! empty( $comment_user->ID ) ) {
-                                $ok_to_comment = $wpdb->get_var( $wpdb->prepare( "SELECT comment_approved FROM $wpdb->comments WHERE user_id = %d AND comment_approved = '1' LIMIT 1", $comment_user->ID ) );
+                                // expected_slashed ($author, $email)
+                                $ok_to_comment = $wpdb->get_var( $wpdb->prepare( "SELECT comment_approved FROM $wpdb->comments WHERE ( user_id = %d OR comment_author = %s AND comment_author_email = %s ) AND comment_approved = '1' LIMIT 1", $comment_user->ID, wp_unslash( $author ), wp_unslash( $email ) ) );
                         } else {
                                 // expected_slashed ($author, $email)
-                                $ok_to_comment = $wpdb->get_var( $wpdb->prepare( "SELECT comment_approved FROM $wpdb->comments WHERE comment_author = %s AND comment_author_email = %s and comment_approved = '1' LIMIT 1", $author, $email ) );
+                                $ok_to_comment = $wpdb->get_var( $wpdb->prepare( "SELECT comment_approved FROM $wpdb->comments WHERE comment_author = %s AND comment_author_email = %s and comment_approved = '1' LIMIT 1", wp_unslash( $author ), wp_unslash( $email ) ) );
                         }
                         if ( ( 1 == $ok_to_comment ) &&
                                 ( empty($mod_keys) || false === strpos( $email, $mod_keys) ) )
@@ -3005 +3006 @@
                  * @param int $comment_post_ID Post ID.
                  */
                 do_action( 'comment_on_draft', $comment_post_ID );
-                
+
                 if ( current_user_can( 'read_post', $comment_post_ID ) ) {
                         return new WP_Error( 'comment_on_draft', __( 'Sorry, comments are not allowed for this item.' ), 403 );
                 } else {