WordPress.org

Make WordPress Core

Ticket #39732: 39732.9.patch

File 39732.9.patch, 11.1 KB (added by imath, 21 months ago)
  • src/wp-admin/comment.php

    diff --git src/wp-admin/comment.php src/wp-admin/comment.php
    index 145cd7a5ea..127bda61e1 100644
    switch ( $action ) { 
    335335
    336336                check_admin_referer( 'update-comment_' . $comment_id );
    337337
    338                 edit_comment();
     338                $updated = edit_comment();
     339                if ( is_wp_error( $updated ) ) {
     340                        wp_die( $updated->get_error_message() );
     341                }
    339342
    340343                $location = ( empty( $_POST['referredby'] ) ? "edit-comments.php?p=$comment_post_id" : $_POST['referredby'] ) . '#comment-' . $comment_id;
    341344
  • src/wp-admin/includes/ajax-actions.php

    diff --git src/wp-admin/includes/ajax-actions.php src/wp-admin/includes/ajax-actions.php
    index 495693c313..e7a5a4c69f 100644
    function wp_ajax_edit_comment() { 
    14071407        if ( isset( $_POST['status'] ) ) {
    14081408                $_POST['comment_status'] = $_POST['status'];
    14091409        }
    1410         edit_comment();
     1410
     1411        $updated = edit_comment();
     1412        if ( is_wp_error( $updated ) ) {
     1413                wp_die( $updated->get_error_message() );
     1414        }
    14111415
    14121416        $position      = ( isset( $_POST['position'] ) && (int) $_POST['position'] ) ? (int) $_POST['position'] : '-1';
    14131417        $checkbox      = ( isset( $_POST['checkbox'] ) && true == $_POST['checkbox'] ) ? 1 : 0;
  • src/wp-admin/includes/comment.php

    diff --git src/wp-admin/includes/comment.php src/wp-admin/includes/comment.php
    index e99f8a6a50..f75f294199 100644
    function edit_comment() { 
    9292                $_POST['comment_date'] = "$aa-$mm-$jj $hh:$mn:$ss";
    9393        }
    9494
    95         wp_update_comment( $_POST );
     95        return wp_update_comment( $_POST, true );
    9696}
    9797
    9898/**
  • src/wp-includes/class-wp-xmlrpc-server.php

    diff --git src/wp-includes/class-wp-xmlrpc-server.php src/wp-includes/class-wp-xmlrpc-server.php
    index 1eea9465b4..8dc2cdbd03 100644
    class wp_xmlrpc_server extends IXR_Server { 
    37863786                        $comment['comment_author_email'] = $content_struct['author_email'];
    37873787                }
    37883788
    3789                 $result = wp_update_comment( $comment );
    3790                 if ( is_wp_error( $result ) ) {
     3789                $result = wp_update_comment( $comment, true );
     3790                if ( is_wp_error( $result ) || false === $result ) {
    37913791                        return new IXR_Error( 500, $result->get_error_message() );
    37923792                }
    37933793
  • src/wp-includes/comment.php

    diff --git src/wp-includes/comment.php src/wp-includes/comment.php
    index fca5ab9db4..2e1afe6f9a 100644
    function wp_set_comment_status( $comment_id, $comment_status, $wp_error = false 
    23122312 *
    23132313 * @since 2.0.0
    23142314 * @since 4.9.0 Add updating comment meta during comment update.
     2315 * @since 5.4.0 Allow returning a WP_Error object on failure.
    23152316 *
    23162317 * @global wpdb $wpdb WordPress database abstraction object.
    23172318 *
    23182319 * @param array $commentarr Contains information on the comment.
    2319  * @return int The value 1 if the comment was updated, 0 if not updated.
     2320 * @param bool  $wp_error   Optional. Whether to return a WP_Error on failure. Default false.
     2321 * @return int|bool|WP_Error Comment was updated if value is 1, or was not updated if value is 0, false, or a WP_Error object.
    23202322 */
    2321 function wp_update_comment( $commentarr ) {
     2323function wp_update_comment( $commentarr, $wp_error = false ) {
    23222324        global $wpdb;
    23232325
    23242326        // First, get all of the original fields
    23252327        $comment = get_comment( $commentarr['comment_ID'], ARRAY_A );
    23262328        if ( empty( $comment ) ) {
    2327                 return 0;
     2329                if ( ! $wp_error ) {
     2330                        return 0;
     2331                }
     2332
     2333                return new WP_Error( 'invalid_comment_id', __( 'Invalid comment ID.' ) );
    23282334        }
    23292335
    23302336        // Make sure that the comment post ID is valid (if specified).
    23312337        if ( ! empty( $commentarr['comment_post_ID'] ) && ! get_post( $commentarr['comment_post_ID'] ) ) {
    2332                 return 0;
     2338                if ( ! $wp_error ) {
     2339                        return 0;
     2340                }
     2341
     2342                return new WP_Error( 'invalid_post_id', __( 'Invalid post ID.' ) );
    23332343        }
    23342344
    23352345        // Escape data pulled from DB.
    function wp_update_comment( $commentarr ) { 
    23702380        /**
    23712381         * Filters the comment data immediately before it is updated in the database.
    23722382         *
    2373          * Note: data being passed to the filter is already unslashed.
     2383         * Note: data being passed to the filter is already unslashed. Returning 0 or a
     2384         * WP_Error object is preventing the comment to be updated.
    23742385         *
    23752386         * @since 4.7.0
     2387         * @since 5.4.0 Allow returning a WP_Error object on failure.
    23762388         *
    23772389         * @param array $data       The new, processed comment data.
    23782390         * @param array $comment    The old, unslashed comment data.
    23792391         * @param array $commentarr The new, raw comment data.
     2392         * @param bool  $wp_error   Optional. Whether to return a WP_Error on failure. Default false.
    23802393         */
    2381         $data = apply_filters( 'wp_update_comment_data', $data, $comment, $commentarr );
     2394        $data = apply_filters( 'wp_update_comment_data', $data, $comment, $commentarr, $wp_error );
     2395
     2396        // Do not carry on on failure.
     2397        if ( is_wp_error( $data ) || 0 === $data ) {
     2398                return $data;
     2399        }
    23822400
    23832401        $keys = array( 'comment_post_ID', 'comment_content', 'comment_author', 'comment_author_email', 'comment_approved', 'comment_karma', 'comment_author_url', 'comment_date', 'comment_date_gmt', 'comment_type', 'comment_parent', 'user_id', 'comment_agent', 'comment_author_IP' );
    23842402        $data = wp_array_slice_assoc( $data, $keys );
    function wp_update_comment( $commentarr ) { 
    23942412
    23952413        clean_comment_cache( $comment_ID );
    23962414        wp_update_comment_count( $comment_post_ID );
     2415
    23972416        /**
    23982417         * Fires immediately after a comment is updated in the database.
    23992418         *
  • src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

    diff --git src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php
    index e05f9802ea..c69f0c086f 100644
    class WP_REST_Comments_Controller extends WP_REST_Controller { 
    739739                                return new WP_Error( $error_code, __( 'Comment field exceeds maximum length allowed.' ), array( 'status' => 400 ) );
    740740                        }
    741741
    742                         $updated = wp_update_comment( wp_slash( (array) $prepared_args ) );
     742                        $updated = wp_update_comment( wp_slash( (array) $prepared_args ), true );
    743743
    744                         if ( false === $updated ) {
     744                        if ( is_wp_error( $updated ) || false === $updated ) {
    745745                                return new WP_Error( 'rest_comment_failed_edit', __( 'Updating comment failed.' ), array( 'status' => 500 ) );
    746746                        }
    747747
  • tests/phpunit/tests/ajax/EditComment.php

    diff --git tests/phpunit/tests/ajax/EditComment.php tests/phpunit/tests/ajax/EditComment.php
    index 7fb58eff57..41d1af8a24 100644
    class Tests_Ajax_EditComment extends WP_Ajax_UnitTestCase { 
    3232                $this->_comment_post = get_post( $post_id );
    3333        }
    3434
     35        public function tearDown() {
     36                remove_filter( 'wp_update_comment_data', array( $this, '_wp_update_comment_data_filter' ), 10, 3 );
     37                parent::tearDown();
     38        }
     39
    3540        /**
    3641         * Get comments as a privilged user (administrator)
    3742         * Expects test to pass
    class Tests_Ajax_EditComment extends WP_Ajax_UnitTestCase { 
    126131                $this->assertEmpty( (string) $xml->response[0]->edit_comment[0]->supplemental );
    127132        }
    128133
     134        /**
     135         * @ticket 39732
     136         */
     137        public function test_wp_update_comment_data_is_wp_error () {
     138                // Become an administrator
     139                $this->_setRole( 'administrator' );
     140
     141                // Get a comment
     142                $comments = get_comments( array(
     143                        'post_id' => $this->_comment_post->ID
     144                ) );
     145                $comment = array_pop( $comments );
     146
     147                // Set up a default request
     148                $_POST['_ajax_nonce-replyto-comment'] = wp_create_nonce( 'replyto-comment' );
     149                $_POST['comment_ID']                  = $comment->comment_ID;
     150                $_POST['content']                     = 'Lorem ipsum dolor sit amet, consectetur adipiscing elit.';
     151
     152                // Simulate filter check error
     153                add_filter( 'wp_update_comment_data', array( $this, '_wp_update_comment_data_filter' ), 10, 3 );
     154
     155                // Make the request
     156                $this->setExpectedException( 'WPAjaxDieStopException', 'wp_update_comment_data filter fails for this comment.' );
     157                $this->_handleAjax( 'edit-comment' );
     158        }
     159
     160        /**
     161         *  Block comments from being updated by returning WP_Error
     162         */
     163        public function _wp_update_comment_data_filter ( $data, $comment, $commentarr ) {
     164                return new WP_Error( 'comment_wrong', __( 'wp_update_comment_data filter fails for this comment.' ), 500 );
     165        }
     166
    129167        /**
    130168         * Get comments as a non-privileged user (subscriber)
    131169         * Expects test to fail
  • tests/phpunit/tests/comment.php

    diff --git tests/phpunit/tests/comment.php tests/phpunit/tests/comment.php
    index 720a805062..0e57616e31 100644
    class Tests_Comment extends WP_UnitTestCase { 
    141141                $this->assertEquals( $updated_comment_text, $comment->comment_content );
    142142        }
    143143
     144        /**
     145         * @ticket 39732
     146         */
     147        public function test_wp_update_comment_is_wp_error() {
     148                $comment_id = self::factory()->comment->create( array( 'comment_post_ID' => self::$post_id ) );
     149
     150                add_filter( 'wp_update_comment_data', array( $this, '_wp_update_comment_data_filter' ), 10, 3 );
     151                $result = wp_update_comment( array( 'comment_ID' => $comment_id, 'comment_type' => 'pingback' ), true );
     152                $this->assertWPError( $result );
     153                remove_filter( 'wp_update_comment_data', array( $this, '_wp_update_comment_data_filter' ), 10, 3 );
     154        }
     155
     156        /**
     157         *  Block comments from being updated by returning WP_Error
     158         */
     159        public function _wp_update_comment_data_filter( $data, $comment, $commentarr ) {
     160                return new WP_Error( 'comment_wrong', __( 'wp_update_comment_data filter fails for this comment.' ), 500 );
     161        }
     162
    144163        public function test_get_approved_comments() {
    145164                $ca1 = self::factory()->comment->create(
    146165                        array(
  • tests/phpunit/tests/rest-api/rest-comments-controller.php

    diff --git tests/phpunit/tests/rest-api/rest-comments-controller.php tests/phpunit/tests/rest-api/rest-comments-controller.php
    index 46738edc72..1357c49ff4 100644
    class WP_Test_REST_Comments_Controller extends WP_Test_REST_Controller_Testcase 
    27922792                $this->assertErrorResponse( 'comment_content_column_length', $response, 400 );
    27932793        }
    27942794
     2795        /**
     2796         * @ticket 39732
     2797         */
     2798        public function test_update_comment_is_wp_error() {
     2799                wp_set_current_user( self::$admin_id );
     2800
     2801                $params = array(
     2802                        'content' => 'This isn\'t a saxophone. It\'s an umbrella.',
     2803                );
     2804
     2805                add_filter( 'wp_update_comment_data', array( $this, '_wp_update_comment_data_filter' ), 10, 3 );
     2806
     2807                $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/comments/%d', self::$approved_id ) );
     2808
     2809                $request->add_header( 'content-type', 'application/json' );
     2810                $request->set_body( wp_json_encode( $params ) );
     2811                $response = rest_get_server()->dispatch( $request );
     2812
     2813                $this->assertErrorResponse( 'rest_comment_failed_edit', $response, 500 );
     2814
     2815                remove_filter( 'wp_update_comment_data', array( $this, '_wp_update_comment_data_filter' ), 10, 3 );
     2816        }
     2817
     2818        /**
     2819         *  Block comments from being updated by returning WP_Error
     2820         */
     2821        public function _wp_update_comment_data_filter ( $data, $comment, $commentarr ) {
     2822                return new WP_Error( 'comment_wrong', __( 'wp_update_comment_data filter fails for this comment.' ), array( 'status' => 500 ) );
     2823        }
     2824
    27952825        public function verify_comment_roundtrip( $input = array(), $expected_output = array() ) {
    27962826                // Create the comment
    27972827                $request = new WP_REST_Request( 'POST', '/wp/v2/comments' );