Changeset 49273

Timestamp:

10/22/2020 02:45:47 AM (4 years ago)

Author:

peterwilsoncc

Message:

XML-RPC: Fix length validation of anonymous commenter's email address.

Fix the first step of validating an anonymous commenters in which the length is checked prior to running regular expressions.

Follow up to [47808].
Merges [49271] to the 5.5 branch.
Fixes #51595.

Location:

branches/5.5

Files:

• . (modified) (1 prop)
• src/wp-includes/class-wp-xmlrpc-server.php (modified) (1 diff)
• tests/phpunit/tests/xmlrpc/wp/newComment.php (modified) (1 diff)

branches/5.5/src/wp-includes/class-wp-xmlrpc-server.php

@@ -3913 +3913 @@
 
             if ( get_option( 'require_name_email' ) ) {
-                if ( strlen( $comment['comment_author_email'] < 6 ) || '' === $comment['comment_author'] ) {
+                if ( strlen( $comment['comment_author_email'] ) < 6 || '' === $comment['comment_author'] ) {
                     return new IXR_Error( 403, __( 'Comment author name and email are required.' ) );
                 } elseif ( ! is_email( $comment['comment_author_email'] ) ) {

branches/5.5/tests/phpunit/tests/xmlrpc/wp/newComment.php

@@ -96 +96 @@
     }
 
+    /**
+     * Ensure anonymous comments can be made via XML-RPC.
+     *
+     * @ticket 51595
+     */
+    function test_allowed_anon_comments() {
+        add_filter( 'xmlrpc_allow_anonymous_comments', '__return_true' );
+        $this->make_user_by_role( 'administrator' );
+        $post = self::factory()->post->create_and_get();
+
+        $comment_args = array(
+            1,
+            '',
+            '',
+            $post->ID,
+            array(
+                'author'       => 'WordPress',
+                'author_email' => 'noreply@wordpress.org',
+                'content'      => 'Test Anon Comments',
+            ),
+        );
+
+        $result = $this->myxmlrpcserver->wp_newComment( $comment_args );
+        $this->assertNotIXRError( $result );
+        $this->assertInternalType( 'int', $result );
+    }
+
+    /**
+     * Ensure anonymous XML-RPC comments require a valid email.
+     *
+     * @ticket 51595
+     */
+    function test_anon_comments_require_email() {
+        add_filter( 'xmlrpc_allow_anonymous_comments', '__return_true' );
+        $this->make_user_by_role( 'administrator' );
+        $post = self::factory()->post->create_and_get();
+
+        $comment_args = array(
+            1,
+            '',
+            '',
+            $post->ID,
+            array(
+                'author'       => 'WordPress',
+                'author_email' => 'noreply at wordpress.org',
+                'content'      => 'Test Anon Comments',
+            ),
+        );
+
+        $result = $this->myxmlrpcserver->wp_newComment( $comment_args );
+        $this->assertIXRError( $result );
+        $this->assertSame( 403, $result->code );
+    }
+
+    /**
+     * Ensure valid users don't use the anon flow.
+     *
+     * @ticket 51595
+     */
+    function test_username_avoids_anon_flow() {
+        add_filter( 'xmlrpc_allow_anonymous_comments', '__return_true' );
+        $this->make_user_by_role( 'administrator' );
+        $post = self::factory()->post->create_and_get();
+
+        $comment_args = array(
+            1,
+            'administrator',
+            'administrator',
+            $post->ID,
+            array(
+                'author'       => 'WordPress',
+                'author_email' => 'noreply at wordpress.org',
+                'content'      => 'Test Anon Comments',
+            ),
+        );
+
+        $result  = $this->myxmlrpcserver->wp_newComment( $comment_args );
+        $comment = get_comment( $result );
+        $user_id = get_user_by( 'login', 'administrator' )->ID;
+
+        $this->assertSame( $user_id, (int) $comment->user_id );
+    }
 }