Changeset 34559 for trunk/src/wp-includes/class-wp-xmlrpc-server.php

Timestamp:

09/25/2015 08:19:19 PM (11 years ago)

Author:

wonderboymusic

Message:

XML-RPC: Introduce the concept of unit testing to wp_xmlrpc_server::wp_newComment():

• Don't allow comments to be created for posts that have comment_status set to 'closed'
• Set some magic props on WP_User to vars before passing them to wp_xmlrpc_server::escape()

Props wonderboymusic, jesin.
Fixes #27471.

File:

• trunk/src/wp-includes/class-wp-xmlrpc-server.php (modified) (2 diffs)

trunk/src/wp-includes/class-wp-xmlrpc-server.php

@@ -3454 +3454 @@
                         $post_id = url_to_postid($post);
 
-                if ( ! $post_id )
+                if ( ! $post_id ) {
                         return new IXR_Error( 404, __( 'Invalid post ID.' ) );
-
-                if ( ! get_post($post_id) )
+                }
+
+                if ( ! get_post( $post_id ) ) {
                         return new IXR_Error( 404, __( 'Invalid post ID.' ) );
+                }
+
+                if ( ! comments_open( $post_id ) ) {
+                        return new IXR_Error( 403, __( 'Sorry, comments are closed for this item.' ) );
+                }
 
                 $comment = array();
@@ -3464 +3470 @@
 
                 if ( $logged_in ) {
-                        $comment['comment_author'] = $this->escape( $user->display_name );
-                        $comment['comment_author_email'] = $this->escape( $user->user_email );
-                        $comment['comment_author_url'] = $this->escape( $user->user_url );
+                        $display_name = $user->display_name;
+                        $user_email = $user->user_email;
+                        $user_url = $user->user_url;
+
+                        $comment['comment_author'] = $this->escape( $display_name );
+                        $comment['comment_author_email'] = $this->escape( $user_email );
+                        $comment['comment_author_url'] = $this->escape( $user_url );
                         $comment['user_ID'] = $user->ID;
                 } else {