Changeset 54537 for branches/6.0/tests/phpunit/tests/comment.php

Timestamp:

10/17/2022 12:31:51 PM (2 years ago)

Author:

audrasjb

Message:

Comments: Apply kses when editing comments.

Props davidbaumwald, xknown, peterwilsoncc, paulkevan.
Merges [54527] to the 6.0 branch.

Location:

branches/6.0

Files:

• . (modified) (1 prop)
• tests/phpunit/tests/comment.php (modified) (1 diff)

branches/6.0/tests/phpunit/tests/comment.php

@@ -75 +75 @@
         $comment = get_comment( $comments[0] );
         $this->assertEquals( $post2->ID, $comment->comment_post_ID );
+    }
+
+    public function test_update_comment_from_privileged_user_by_privileged_user() {
+        $admin_id_1 = self::factory()->user->create( array( 'role' => 'administrator' ) );
+        wp_set_current_user( $admin_id_1 );
+
+        $comment_id = wp_new_comment(
+            array(
+                'comment_post_ID'      => self::$post_id,
+                'comment_author'       => 'Author',
+                'comment_author_url'   => 'http://example.localhost/',
+                'comment_author_email' => 'test@test.com',
+                'user_id'              => $admin_id_1,
+                'comment_content'      => 'This is a comment',
+            )
+        );
+
+        wp_set_current_user( 0 );
+
+        $admin_id_2 = self::factory()->user->create(
+            array(
+                'role'       => 'administrator',
+                'user_login' => 'test_wp_admin_get',
+                'user_pass'  => 'password',
+                'user_email' => 'testadmin@test.com',
+            )
+        );
+
+        wp_set_current_user( $admin_id_2 );
+
+        wp_update_comment(
+            array(
+                'comment_ID'      => $comment_id,
+                'comment_content' => 'new comment <img onerror=demo src=x>',
+            )
+        );
+
+        $comment          = get_comment( $comment_id );
+        $expected_content = is_multisite()
+            ? 'new comment '
+            : 'new comment <img onerror=demo src=x>';
+
+        $this->assertSame( $expected_content, $comment->comment_content );
+
+        wp_set_current_user( 0 );
+    }
+
+    public function test_update_comment_from_unprivileged_user_by_privileged_user() {
+        wp_set_current_user( self::$user_id );
+
+        $comment_id = wp_new_comment(
+            array(
+                'comment_post_ID'      => self::$post_id,
+                'comment_author'       => 'Author',
+                'comment_author_url'   => 'http://example.localhost/',
+                'comment_author_email' => 'test@test.com',
+                'user_id'              => self::$user_id,
+                'comment_content'      => '<a href="http://example.localhost/something.html">click</a>',
+            )
+        );
+
+        wp_set_current_user( 0 );
+
+        $admin_id = self::factory()->user->create(
+            array(
+                'role'       => 'administrator',
+                'user_login' => 'test_wp_admin_get',
+                'user_pass'  => 'password',
+                'user_email' => 'testadmin@test.com',
+            )
+        );
+
+        wp_set_current_user( $admin_id );
+
+        wp_update_comment(
+            array(
+                'comment_ID'      => $comment_id,
+                'comment_content' => '<a href="http://example.localhost/something.html" disallowed=attribute>click</a>',
+            )
+        );
+
+        $comment = get_comment( $comment_id );
+        $this->assertEquals( '<a href="http://example.localhost/something.html" rel="nofollow ugc">click</a>', $comment->comment_content, 'Comment: ' . $comment->comment_content );
+        wp_set_current_user( 0 );
     }