Context Navigation

← Previous Change
Next Change →

class-wp-rest-comments-controller.php

Timestamp:

11/21/2016 05:31:07 AM (10 years ago)

Author:

rmccue

Message:

REST API: Disable anonymous commenting by default.

Adding a brand new anonymous comment method is a potential conduit for spam. Since it's still useful functionality, we're now hiding it behind a filter to allow plugins and themes to turn it on if they do want it.

Props helen, rachelbaker, joehoyle.
Fixes #38855.

File:

: 1 edited

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php (modified) (1 diff)

Legend:

: Unmodified
: Added
: Removed

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

-              r39321
+              r39327
          */
         public function create_item_permissions_check( $request ) {
+                if ( ! is_user_logged_in() && get_option( 'comment_registration' ) ) {
+                        return new WP_Error( 'rest_comment_login_required', __( 'Sorry, you must be logged in to comment.' ), array( 'status' => 401 ) );
+                if ( ! is_user_logged_in() ) {
+                        if ( get_option( 'comment_registration' ) ) {
+                                return new WP_Error( 'rest_comment_login_required', __( 'Sorry, you must be logged in to comment.' ), array( 'status' => 401 ) );
+                        }
+                        /**
+                         * Filter whether comments can be created without authentication.
+                         *
+                         * Enables creating comments for anonymous users.
+                         *
+                         * @since 4.7.0
+                         *
+                         * @param bool $allow_anonymous Whether to allow anonymous comments to
+                         *                              be created. Default `false`.
+                         * @param WP_REST_Request $request Request used to generate the
+                         *                                 response.
+                         */
+                        $allow_anonymous = apply_filters( 'rest_allow_anonymous_comments', false, $request );
+                        if ( false === $allow_anonymous ) {
+                                return new WP_Error( 'rest_comment_login_required', __( 'Sorry, you must be logged in to comment.' ), array( 'status' => 401 ) );
+                        }
+                }

Note: See TracChangeset for help on using the changeset viewer.

Make WordPress Core

Context Navigation

Changeset 39327 for trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

Legend:

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

Download in other formats: