Changeset 39045

Timestamp:

10/31/2016 01:26:10 AM (8 years ago)

Author:

johnbillion

Message:

XML-RPC: Correctly handle empty and duplicate comments.

This prevents wp_die() being sent in response to an XML-RPC call that attempts to submit a duplicate comment, and correctly returns an error in response to an attempt to submit an empty comment.

Props markoheijnen, websupporter.
Fixes #14452, #38466.
See #36901

Location:

trunk

Files:

• src/wp-includes/class-wp-xmlrpc-server.php (modified) (2 diffs)
• tests/phpunit/tests/xmlrpc/wp/newComment.php (modified) (2 diffs)

trunk/src/wp-includes/class-wp-xmlrpc-server.php

@@ -3554 +3554 @@
         }
 
-        $comment = array();
-        $comment['comment_post_ID'] = $post_id;
+        if ( empty( $content_struct['content'] ) ) {
+            return new IXR_Error( 403, __( 'Comment is required.' ) );
+        }
+
+        $comment = array(
+            'comment_post_ID' => $post_id,
+            'comment_content' => $content_struct['content'],
+        );
 
         if ( $logged_in ) {
@@ -3591 +3597 @@
         $comment['comment_parent'] = isset($content_struct['comment_parent']) ? absint($content_struct['comment_parent']) : 0;
 
-        $comment['comment_content'] =  isset($content_struct['content']) ? $content_struct['content'] : null;
-
         /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
         do_action( 'xmlrpc_call', 'wp.newComment' );
 
-        $comment_ID = wp_new_comment( $comment );
+        $comment_ID = wp_new_comment( $comment, true );
+        if ( is_wp_error( $comment_ID ) ) {
+            return new IXR_Error( 403, $comment_ID->get_error_message() );
+        }
+
+        if ( ! $comment_ID ) {
+            return new IXR_Error( 403, __( 'An unknown error occurred' ) );
+        }
 
         /**

trunk/tests/phpunit/tests/xmlrpc/wp/newComment.php

@@ -5 +5 @@
  */
 class Tests_XMLRPC_wp_newComment extends WP_XMLRPC_UnitTestCase {
+
+    function test_valid_comment() {
+        $this->make_user_by_role( 'administrator' );
+        $post = self::factory()->post->create_and_get();
+ 
+        $result = $this->myxmlrpcserver->wp_newComment( array( 1, 'administrator', 'administrator', $post->ID, array(
+            'content' => rand_str( 100 )
+        ) ) );
+ 
+        $this->assertNotInstanceOf( 'IXR_Error', $result );
+    }
+ 
+    function test_empty_comment() {
+        $this->make_user_by_role( 'administrator' );
+        $post = self::factory()->post->create_and_get();
+ 
+        $result = $this->myxmlrpcserver->wp_newComment( array( 1, 'administrator', 'administrator', $post->ID, array(
+            'content' => ''
+        ) ) );
+ 
+        $this->assertInstanceOf( 'IXR_Error', $result );
+        $this->assertEquals( 403, $result->code );
+    }
+
     function test_new_comment_post_closed() {
         $this->make_user_by_role( 'administrator' );
@@ -20 +44 @@
         $this->assertEquals( 403, $result->code );
     }
+
+    function test_new_comment_duplicated() {
+        $this->make_user_by_role( 'administrator' );
+        $post = self::factory()->post->create_and_get();
+
+        $comment_args = array( 1, 'administrator', 'administrator', $post->ID, array(
+            'content' => rand_str( 100 ),
+        ) );
+
+        // First time it's a valid comment
+        $result = $this->myxmlrpcserver->wp_newComment( $comment_args  );
+        $this->assertNotInstanceOf( 'IXR_Error', $result );
+
+        // Run second time for duplication error
+        $result = $this->myxmlrpcserver->wp_newComment( $comment_args );
+
+        $this->assertInstanceOf( 'IXR_Error', $result );
+        $this->assertEquals( 403, $result->code );
+    }
+
 }