Changeset 25433

Timestamp:

09/13/2013 10:17:51 PM (11 years ago)

Author:

wonderboymusic

Message:

Fix some undefined index notices related to Comment unit tests:

• There are several places where a $_POST index was unchecked before setting a variable
• In wp_notify_postauthor(), $comment was being returned null, but its properties were being accessed.
• In check_ajax_referer(), 3 different values can be checked for nonce on $_REQUEST, but only 1 had an isset()

See #25282.

Location:

trunk

Files:

• src/wp-admin/includes/ajax-actions.php (modified) (6 diffs)
• src/wp-admin/includes/comment.php (modified) (1 diff)
• src/wp-includes/pluggable.php (modified) (2 diffs)
• tests/phpunit/tests/ajax/ReplytoComment.php (modified) (1 diff)

trunk/src/wp-admin/includes/ajax-actions.php

@@ -548 +548 @@
 
     $current = wp_get_comment_status( $comment->comment_ID );
-    if ( $_POST['new'] == $current )
+    if ( isset( $_POST['new'] ) && $_POST['new'] == $current )
         wp_die( time() );
 
@@ -752 +752 @@
         $comment_content      = trim($_POST['content']);
         if ( current_user_can( 'unfiltered_html' ) ) {
+            if ( ! isset( $_POST['_wp_unfiltered_html_comment'] ) )
+                $_POST['_wp_unfiltered_html_comment'] = '';
+
             if ( wp_create_nonce( 'unfiltered-html-comment' ) != $_POST['_wp_unfiltered_html_comment'] ) {
                 kses_remove_filters(); // start with a clean slate
@@ -764 +767 @@
         wp_die( __( 'ERROR: please type a comment.' ) );
 
-    $comment_parent = absint($_POST['comment_ID']);
+    $comment_parent = 0;
+    if ( isset( $_POST['comment_ID'] ) )
+        $comment_parent = absint( $_POST['comment_ID'] );
     $comment_auto_approved = false;
     $commentdata = compact('comment_post_ID', 'comment_author', 'comment_author_email', 'comment_author_url', 'comment_content', 'comment_type', 'comment_parent', 'user_ID');
@@ -785 +790 @@
 
     ob_start();
-        if ( 'dashboard' == $_REQUEST['mode'] ) {
-            require_once( ABSPATH . 'wp-admin/includes/dashboard.php' );
-            _wp_dashboard_recent_comments_row( $comment );
+    if ( isset( $_REQUEST['mode'] ) && 'dashboard' == $_REQUEST['mode'] ) {
+        require_once( ABSPATH . 'wp-admin/includes/dashboard.php' );
+        _wp_dashboard_recent_comments_row( $comment );
+    } else {
+        if ( isset( $_REQUEST['mode'] ) && 'single' == $_REQUEST['mode'] ) {
+            $wp_list_table = _get_list_table('WP_Post_Comments_List_Table', array( 'screen' => 'edit-comments' ) );
         } else {
-            if ( 'single' == $_REQUEST['mode'] ) {
-                $wp_list_table = _get_list_table('WP_Post_Comments_List_Table', array( 'screen' => 'edit-comments' ) );
-            } else {
-                $wp_list_table = _get_list_table('WP_Comments_List_Table', array( 'screen' => 'edit-comments' ) );
-            }
-            $wp_list_table->single_row( $comment );
+            $wp_list_table = _get_list_table('WP_Comments_List_Table', array( 'screen' => 'edit-comments' ) );
         }
-        $comment_list_item = ob_get_contents();
-    ob_end_clean();
+        $wp_list_table->single_row( $comment );
+    }
+    $comment_list_item = ob_get_clean();
 
     $response =  array(
@@ -826 +830 @@
         wp_die( __( 'ERROR: please type a comment.' ) );
 
-    $_POST['comment_status'] = $_POST['status'];
+    if ( isset( $_POST['status'] ) )
+        $_POST['comment_status'] = $_POST['status'];
     edit_comment();
 
@@ -838 +843 @@
 
     ob_start();
-        $wp_list_table->single_row( $comment );
-        $comment_list_item = ob_get_contents();
-    ob_end_clean();
+    $wp_list_table->single_row( $comment );
+    $comment_list_item = ob_get_clean();
 
     $x = new WP_Ajax_Response();

trunk/src/wp-admin/includes/comment.php

@@ -37 +37 @@
         wp_die ( __( 'You are not allowed to edit comments on this post.' ) );
 
-    $_POST['comment_author'] = $_POST['newcomment_author'];
-    $_POST['comment_author_email'] = $_POST['newcomment_author_email'];
-    $_POST['comment_author_url'] = $_POST['newcomment_author_url'];
-    $_POST['comment_approved'] = $_POST['comment_status'];
-    $_POST['comment_content'] = $_POST['content'];
-    $_POST['comment_ID'] = (int) $_POST['comment_ID'];
+    if ( isset( $_POST['newcomment_author'] ) )
+        $_POST['comment_author'] = $_POST['newcomment_author'];
+    if ( isset( $_POST['newcomment_author_email'] ) )
+        $_POST['comment_author_email'] = $_POST['newcomment_author_email'];
+    if ( isset( $_POST['newcomment_author_url'] ) )
+        $_POST['comment_author_url'] = $_POST['newcomment_author_url'];
+    if ( isset( $_POST['comment_status'] ) )
+        $_POST['comment_approved'] = $_POST['comment_status'];
+    if ( isset( $_POST['content'] ) )
+        $_POST['comment_content'] = $_POST['content'];
+    if ( isset( $_POST['comment_ID'] ) )
+        $_POST['comment_ID'] = (int) $_POST['comment_ID'];
 
     foreach ( array ('aa', 'mm', 'jj', 'hh', 'mn') as $timeunit ) {

trunk/src/wp-includes/pluggable.php

@@ -831 +831 @@
  */
 function check_ajax_referer( $action = -1, $query_arg = false, $die = true ) {
-    if ( $query_arg )
+    $nonce = '';
+
+    if ( $query_arg && isset( $_REQUEST[$query_arg] ) )
         $nonce = $_REQUEST[$query_arg];
-    else
-        $nonce = isset($_REQUEST['_ajax_nonce']) ? $_REQUEST['_ajax_nonce'] : $_REQUEST['_wpnonce'];
+
+    if ( isset( $_REQUEST['_ajax_nonce'] ) )
+        $nonce = $_REQUEST['_ajax_nonce'];
+
+    if ( isset( $_REQUEST['_wpnonce'] ) )
+        $nonce = $_REQUEST['_wpnonce'];
 
     $result = wp_verify_nonce( $nonce, $action );
@@ -1010 +1016 @@
 function wp_notify_postauthor( $comment_id, $comment_type = '' ) {
     $comment = get_comment( $comment_id );
+    if ( empty( $comment ) )
+        return false;
+
     $post    = get_post( $comment->comment_post_ID );
     $author  = get_userdata( $post->post_author );

trunk/tests/phpunit/tests/ajax/ReplytoComment.php

@@ -39 +39 @@
         $post_id = $this->factory->post->create( array( 'post_status' => 'draft' ) );
         $this->_draft_post = get_post( $post_id );
+
+        $_SERVER['REMOTE_ADDR'] = '';
     }