Changeset 34559 for trunk/src/wp-includes/class-wp-xmlrpc-server.php

Timestamp:

09/25/2015 08:19:19 PM (9 years ago)

Author:

wonderboymusic

Message:

XML-RPC: Introduce the concept of unit testing to wp_xmlrpc_server::wp_newComment():

• Don't allow comments to be created for posts that have comment_status set to 'closed'
• Set some magic props on WP_User to vars before passing them to wp_xmlrpc_server::escape()

Props wonderboymusic, jesin.
Fixes #27471.

File:

• trunk/src/wp-includes/class-wp-xmlrpc-server.php (modified) (2 diffs)

trunk/src/wp-includes/class-wp-xmlrpc-server.php

@@ -3454 +3454 @@
             $post_id = url_to_postid($post);
 
-        if ( ! $post_id )
+        if ( ! $post_id ) {
             return new IXR_Error( 404, __( 'Invalid post ID.' ) );
-
-        if ( ! get_post($post_id) )
+        }
+
+        if ( ! get_post( $post_id ) ) {
             return new IXR_Error( 404, __( 'Invalid post ID.' ) );
+        }
+
+        if ( ! comments_open( $post_id ) ) {
+            return new IXR_Error( 403, __( 'Sorry, comments are closed for this item.' ) );
+        }
 
         $comment = array();
@@ -3464 +3470 @@
 
         if ( $logged_in ) {
-            $comment['comment_author'] = $this->escape( $user->display_name );
-            $comment['comment_author_email'] = $this->escape( $user->user_email );
-            $comment['comment_author_url'] = $this->escape( $user->user_url );
+            $display_name = $user->display_name;
+            $user_email = $user->user_email;
+            $user_url = $user->user_url;
+
+            $comment['comment_author'] = $this->escape( $display_name );
+            $comment['comment_author_email'] = $this->escape( $user_email );
+            $comment['comment_author_url'] = $this->escape( $user_url );
             $comment['user_ID'] = $user->ID;
         } else {