Changeset 55369 for trunk/src/wp-includes/comment-template.php

Timestamp:

02/21/2023 01:43:33 AM (22 months ago)

Author:

peterwilsoncc

Message:

Comments: Prevent replying to unapproved comments.

Introduces client and server side validation to ensure the replytocom query string parameter can not be exploited to reply to an unapproved comment or display the name of an unapproved commenter.

This only affects commenting via the front end of the site. Comment replies via the dashboard continue their current behaviour of logging the reply and approving the parent comment.

Introduces the $post parameter, defaulting to the current global post, to get_cancel_comment_reply_link() and comment_form_title().

Introduces _get_comment_reply_id() for determining the comment reply ID based on the replytocom query string parameter.

Renames the parameter $post_id to $post in get_comment_id_fields() and comment_id_fields() to accept either a post ID or WP_Post object.

Adds a new WP_Error return state to wp_handle_comment_submission() to prevent replies to unapproved comments. The error code is comment_reply_to_unapproved_comment with the message Sorry, replies to unapproved comments are not allowed..

Props costdev, jrf, hellofromtonya, fasuto, boniu91, milana_cap.
Fixes #53962.

File:

• trunk/src/wp-includes/comment-template.php (modified) (6 diffs)

trunk/src/wp-includes/comment-template.php

@@ -1927 +1927 @@
  *
  * @since 2.7.0
- *
- * @param string $text Optional. Text to display for cancel reply link. If empty,
- *                     defaults to 'Click here to cancel reply'. Default empty.
+ * @since 6.2.0 Added the `$post` parameter.
+ *
+ * @param string           $text Optional. Text to display for cancel reply link. If empty,
+ *                               defaults to 'Click here to cancel reply'. Default empty.
+ * @param int|WP_Post|null $post Optional. The post the comment thread is being
+ *                               displayed for. Defaults to the current global post.
  * @return string
  */
-function get_cancel_comment_reply_link( $text = '' ) {
+function get_cancel_comment_reply_link( $text = '', $post = null ) {
     if ( empty( $text ) ) {
         $text = __( 'Click here to cancel reply.' );
     }
 
-    $style = isset( $_GET['replytocom'] ) ? '' : ' style="display:none;"';
-    $link  = esc_html( remove_query_arg( array( 'replytocom', 'unapproved', 'moderation-hash' ) ) ) . '#respond';
+    $post        = get_post( $post );
+    $reply_to_id = $post ? _get_comment_reply_id( $post->ID ) : 0;
+    $style       = 0 !== $reply_to_id ? '' : ' style="display:none;"';
+    $link        = esc_html( remove_query_arg( array( 'replytocom', 'unapproved', 'moderation-hash' ) ) ) . '#respond';
 
     $formatted_link = '<a rel="nofollow" id="cancel-comment-reply-link" href="' . $link . '"' . $style . '>' . $text . '</a>';
@@ -1970 +1975 @@
  *
  * @since 3.0.0
- *
- * @param int $post_id Optional. Post ID. Defaults to the current post ID.
+ * @since 6.2.0 Renamed `$post_id` to `$post` and added WP_Post support.
+ *
+ * @param int|WP_Post|null $post Optional. The post the comment is being displayed for.
+ *                               Defaults to the current global post.
  * @return string Hidden input HTML for replying to comments.
  */
-function get_comment_id_fields( $post_id = 0 ) {
-    if ( empty( $post_id ) ) {
-        $post_id = get_the_ID();
-    }
-
-    $reply_to_id = isset( $_GET['replytocom'] ) ? (int) $_GET['replytocom'] : 0;
+function get_comment_id_fields( $post = null ) {
+    $post = get_post( $post );
+    if ( ! $post ) {
+        return '';
+    }
+
+    $post_id     = $post->ID;
+    $reply_to_id = _get_comment_reply_id( $post_id );
     $result      = "<input type='hidden' name='comment_post_ID' value='$post_id' id='comment_post_ID' />\n";
     $result     .= "<input type='hidden' name='comment_parent' id='comment_parent' value='$reply_to_id' />\n";
@@ -2004 +2013 @@
  *
  * @since 2.7.0
+ * @since 6.2.0 Renamed `$post_id` to `$post` and added WP_Post support.
  *
  * @see get_comment_id_fields()
  *
- * @param int $post_id Optional. Post ID. Defaults to the current post ID.
- */
-function comment_id_fields( $post_id = 0 ) {
-    echo get_comment_id_fields( $post_id );
+ * @param int|WP_Post|null $post Optional. The post the comment is being displayed for.
+ *                               Defaults to the current global post.
+ */
+function comment_id_fields( $post = null ) {
+    echo get_comment_id_fields( $post );
 }
 
@@ -2022 +2033 @@
  *
  * @since 2.7.0
- *
- * @global WP_Comment $comment Global comment object.
- *
- * @param string|false $no_reply_text  Optional. Text to display when not replying to a comment.
- *                                     Default false.
- * @param string|false $reply_text     Optional. Text to display when replying to a comment.
- *                                     Default false. Accepts "%s" for the author of the comment
- *                                     being replied to.
- * @param bool         $link_to_parent Optional. Boolean to control making the author's name a link
- *                                     to their comment. Default true.
- */
-function comment_form_title( $no_reply_text = false, $reply_text = false, $link_to_parent = true ) {
-    global $comment;
-
+ * @since 6.2.0 Added the `$post` parameter.
+ *
+ * @param string|false      $no_reply_text  Optional. Text to display when not replying to a comment.
+ *                                          Default false.
+ * @param string|false      $reply_text     Optional. Text to display when replying to a comment.
+ *                                          Default false. Accepts "%s" for the author of the comment
+ *                                          being replied to.
+ * @param bool              $link_to_parent Optional. Boolean to control making the author's name a link
+ *                                          to their comment. Default true.
+ * @param int|WP_Post|null  $post           Optional. The post that the comment form is being displayed for.
+ *                                          Defaults to the current global post.
+ */
+function comment_form_title( $no_reply_text = false, $reply_text = false, $link_to_parent = true, $post = null ) {
     if ( false === $no_reply_text ) {
         $no_reply_text = __( 'Leave a Reply' );
@@ -2045 +2055 @@
     }
 
-    $reply_to_id = isset( $_GET['replytocom'] ) ? (int) $_GET['replytocom'] : 0;
-
-    if ( 0 == $reply_to_id ) {
+    $post = get_post( $post );
+    if ( ! $post ) {
         echo $no_reply_text;
+        return;
+    }
+
+    $reply_to_id = _get_comment_reply_id( $post->ID );
+
+    if ( 0 === $reply_to_id ) {
+        echo $no_reply_text;
+        return;
+    }
+
+    if ( $link_to_parent ) {
+        $author = '<a href="#comment-' . get_comment_ID() . '">' . get_comment_author( $reply_to_id ) . '</a>';
     } else {
-        // Sets the global so that template tags can be used in the comment form.
-        $comment = get_comment( $reply_to_id );
-
-        if ( $link_to_parent ) {
-            $author = '<a href="#comment-' . get_comment_ID() . '">' . get_comment_author( $comment ) . '</a>';
-        } else {
-            $author = get_comment_author( $comment );
-        }
-
-        printf( $reply_text, $author );
-    }
+        $author = get_comment_author( $reply_to_id );
+    }
+
+    printf( $reply_text, $author );
+}
+
+/**
+ * Gets the comment's reply to ID from the $_GET['replytocom'].
+ *
+ * @since 6.2.0
+ *
+ * @access private
+ *
+ * @param int|WP_Post $post The post the comment is being displayed for.
+ *                          Defaults to the current global post.
+ * @return int Comment's reply to ID.
+ */
+function _get_comment_reply_id( $post = null ) {
+    $post = get_post( $post );
+
+    if ( ! $post || ! isset( $_GET['replytocom'] ) || ! is_numeric( $_GET['replytocom'] ) ) {
+        return 0;
+    }
+
+    $reply_to_id = (int) $_GET['replytocom'];
+
+    /*
+     * Validate the comment.
+     * Bail out if it does not exist, is not approved, or its
+     * `comment_post_ID` does not match the given post ID.
+     */
+    $comment = get_comment( $reply_to_id );
+
+    if (
+        ! $comment instanceof WP_Comment ||
+        0 === (int) $comment->comment_approved ||
+        $post->ID !== (int) $comment->comment_post_ID
+    ) {
+        return 0;
+    }
+
+    return $reply_to_id;
 }
 
@@ -2571 +2623 @@
         echo $args['title_reply_before'];
 
-        comment_form_title( $args['title_reply'], $args['title_reply_to'] );
+        comment_form_title( $args['title_reply'], $args['title_reply_to'], true, $post_id );
 
         if ( get_option( 'thread_comments' ) ) {