Ticket #43857: 43857.9.diff

src/wp-comments-post.php

@@ -57 +57 @@
 $location = empty( $_POST['redirect_to'] ) ? get_comment_link( $comment ) : $_POST['redirect_to'] . '#comment-' . $comment->comment_ID;
 
 /**
+ * Add specific query arguments to display the awaiting moderation message
+ * to users who refused to use comment cookies.
+ */
+if ( 'unapproved' === wp_get_comment_status( $comment ) && ! empty( $comment->comment_author_email ) ) {
+        $location = add_query_arg(
+                array(
+                        'unapproved'      => $comment->comment_ID,
+                        'moderation-hash' => wp_hash( $comment->comment_date_gmt ),
+                ),
+                $location
+        );
+}
+
+/**
  * Filters the location URI to send the commenter after posting.
  *
  * @since 2.0.5

src/wp-includes/comment-template.php

@@ -1372 +1372 @@
 
         if ( $user_ID ) {
                 $comment_args['include_unapproved'] = array( $user_ID );
-        } elseif ( ! empty( $comment_author_email ) ) {
-                $comment_args['include_unapproved'] = array( $comment_author_email );
+        } else {
+                $unapproved_email = wp_get_unapproved_comment_author_email();
+
+                if ( ! empty( $unapproved_email ) ) {
+                        $comment_args['include_unapproved'] = array( $unapproved_email );
+                }
         }
 
         $per_page = 0;
@@ -1691 +1695 @@
                 $link = sprintf(
                         "<a rel='nofollow' class='comment-reply-link' href='%s' %s aria-label='%s'>%s</a>",
                         esc_url( add_query_arg( 'replytocom', $comment->comment_ID ) ) . '#' . $args['respond_id'],
+                        esc_url(
+                                add_query_arg(
+                                        array(
+                                                'replytocom'      => $comment->comment_ID,
+                                                'unapproved'      => false,
+                                                'moderation-hash' => false,
+                                        )
+                                )
+                        ) . '#' . $args['respond_id'],
                         $data_attribute_string,
                         esc_attr( sprintf( $args['reply_to_text'], $comment->comment_author ) ),
                         $args['reply_text']
@@ -2055 +2068 @@
                                 if ( is_user_logged_in() ) {
                                         $comment_args['include_unapproved'] = get_current_user_id();
                                 } else {
-                                        $commenter = wp_get_current_commenter();
-                                        if ( $commenter['comment_author_email'] ) {
-                                                $comment_args['include_unapproved'] = $commenter['comment_author_email'];
+                                        $unapproved_email = wp_get_unapproved_comment_author_email();
+
+                                        if ( ! empty( $unapproved_email ) ) {
+                                                $comment_args['include_unapproved'] = array( $unapproved_email );
                                         }
                                 }
 

src/wp-includes/comment.php

@@ -1769 +1769 @@
 }
 
 /**
+ * Get unapproved comment author's email.
+ *
+ * Used to allow the commenter to see their pending comment.
+ *
+ * @since 5.1.0
+ *
+ * @return string The unapproved comment author's email (when supplied).
+ */
+function wp_get_unapproved_comment_author_email() {
+        $commenter_email = '';
+
+        if ( ! empty( $_GET['unapproved'] ) && ! empty( $_GET['moderation-hash'] ) ) {
+                $comment_id = (int) $_GET['unapproved'];
+                $comment = get_comment( $comment_id );
+
+                if ( $comment && hash_equals( $_GET['moderation-hash'], wp_hash( $comment->comment_date_gmt ) ) ) {
+                        $commenter_email = $comment->comment_author_email;
+                }
+        }
+
+        return $commenter_email;
+}
+
+/**
  * Inserts a comment into the database.
  *
  * @since 2.0.0

tests/phpunit/tests/comment/commentsTemplate.php

@@ -832 +832 @@
         }
 
         /**
+         * @ticket 43857
+         */
+        public function test_comments_list_should_include_just_posted_unapproved_comment() {
+                $now = time();
+                $p   = self::factory()->post->create();
+                $c   = self::factory()->comment->create(
+                        array(
+                                'comment_post_ID'  => $p,
+                                'comment_content'  => '1',
+                                'comment_approved' => '0',
+                                'comment_date_gmt' => date( 'Y-m-d H:i:s', $now ),
+                                'comment_author_email' => 'foo@bar.mail',
+                        )
+                );
+                $comment = get_comment( $c );
+
+                $this->go_to( add_query_arg(
+                        array(
+                                'unapproved'      => $comment->comment_ID,
+                                'moderation-hash' => wp_hash( $comment->comment_date_gmt ),
+                        ),
+                        get_comment_link( $comment )
+                ) );
+
+                $found = get_echo( 'comments_template' );
+
+                // Find the found comment in the markup.
+                preg_match( '|id="comment-([0-9]+)|', $found, $matches );
+
+                $found_cid = (int) $matches[1];
+                $this->assertSame( $c, $found_cid );
+        }
+
+        /**
          * @ticket 35378
          */
         public function test_hierarchy_should_be_ignored_when_threading_is_disabled() {