Changeset 41980

Timestamp:

10/23/2017 10:11:11 PM (9 years ago)

Author:

peterwilsoncc

Message:

Comments: Check if wp_new_comment() returns an error.

Adds checks throughout to allow for wp_new_comment() returning a WP_Error instance.

Updates the docs for the pre_comment_approved filter to include that it can be passed an error.

Props enrico.sorcinelli, ryotsun.
Fixes #39730.

Location:

trunk

Files:

• src/wp-admin/includes/ajax-actions.php (modified) (1 diff)
• src/wp-includes/class-wp-xmlrpc-server.php (modified) (1 diff)
• src/wp-includes/comment.php (modified) (1 diff)
• src/wp-trackback.php (modified) (1 diff)
• tests/phpunit/tests/ajax/ReplytoComment.php (modified) (1 diff)

trunk/src/wp-admin/includes/ajax-actions.php

@@ -1101 +1101 @@
 
         $comment_id = wp_new_comment( $commentdata );
+
+        if ( is_wp_error( $comment_id ) ) {
+                wp_die( $comment_id->get_error_message() );
+        }
+
         $comment = get_comment($comment_id);
         if ( ! $comment ) wp_die( 1 );

trunk/src/wp-includes/class-wp-xmlrpc-server.php

@@ -6488 +6488 @@
                 $comment_ID = wp_new_comment($commentdata);
 
+                if ( is_wp_error( $comment_ID ) ) {
+                        return $this->pingback_error( 0, $comment_ID->get_error_message() );
+                }
+
                 /**
                  * Fires after a post pingback has been sent.

trunk/src/wp-includes/comment.php

@@ -770 +770 @@
          *
          * @since 2.1.0
-         *
-         * @param bool|string $approved    The approval status. Accepts 1, 0, or 'spam'.
-         * @param array       $commentdata Comment data.
+         * @since 4.9.0 Returning a WP_Error value from the filter will shortcircuit comment insertion and
+         *              allow skipping further processing.
+         *
+         * @param bool|string|WP_Error $approved    The approval status. Accepts 1, 0, 'spam' or WP_Error.
+         * @param array                $commentdata Comment data.
          */
         $approved = apply_filters( 'pre_comment_approved', $approved, $commentdata );

trunk/src/wp-trackback.php

@@ -127 +127 @@
         $commentdata = compact('comment_post_ID', 'comment_author', 'comment_author_email', 'comment_author_url', 'comment_content', 'comment_type');
 
-        wp_new_comment($commentdata);
+        $result = wp_new_comment( $commentdata );
+
+        if ( is_wp_error( $result ) ) {
+                trackback_response( 1, $result->get_error_message() );
+        }
+
         $trackback_id = $wpdb->insert_id;
 

trunk/tests/phpunit/tests/ajax/ReplytoComment.php

@@ -223 +223 @@
                 return $sql;
         }
+
+        /**
+         * Raises WP_Error after Posted a new pre comment
+         * @ticket 39730
+         * @return void
+         */
+        public function test_pre_comments_approved() {
+
+                // Become an administrator
+                $this->_setRole( 'administrator' );
+
+                // Set up a default request
+                $_POST['_ajax_nonce-replyto-comment'] = wp_create_nonce( 'replyto-comment' );
+                $_POST['content']                     = 'Lorem ipsum dolor sit amet, consectetur adipiscing elit.';
+                $_POST['comment_post_ID']             = self::$comment_post->ID;
+
+                // Simulate filter check error
+                add_filter( 'pre_comment_approved', array( $this, '_pre_comment_approved_filter' ), 10, 2 );
+
+                // Make the request
+                $this->setExpectedException( 'WPAjaxDieStopException', 'pre_comment_approved filter fails for new comment' );
+                $this->_handleAjax( 'replyto-comment' );
+        }
+
+        /**
+         *  Block comments from being saved 'pre_comment_approved', by returning WP_Error
+         */
+        function _pre_comment_approved_filter( $approved, $commentdata ) {
+                return new WP_Error( 'comment_wrong', 'pre_comment_approved filter fails for new comment', 403 );
+        }
 }