Changeset 55369 for trunk/tests/phpunit/tests/comment/wpHandleCommentSubmission.php

Timestamp:

02/21/2023 01:43:33 AM (22 months ago)

Author:

peterwilsoncc

Message:

Comments: Prevent replying to unapproved comments.

Introduces client and server side validation to ensure the replytocom query string parameter can not be exploited to reply to an unapproved comment or display the name of an unapproved commenter.

This only affects commenting via the front end of the site. Comment replies via the dashboard continue their current behaviour of logging the reply and approving the parent comment.

Introduces the $post parameter, defaulting to the current global post, to get_cancel_comment_reply_link() and comment_form_title().

Introduces _get_comment_reply_id() for determining the comment reply ID based on the replytocom query string parameter.

Renames the parameter $post_id to $post in get_comment_id_fields() and comment_id_fields() to accept either a post ID or WP_Post object.

Adds a new WP_Error return state to wp_handle_comment_submission() to prevent replies to unapproved comments. The error code is comment_reply_to_unapproved_comment with the message Sorry, replies to unapproved comments are not allowed..

Props costdev, jrf, hellofromtonya, fasuto, boniu91, milana_cap.
Fixes #53962.

File:

• trunk/tests/phpunit/tests/comment/wpHandleCommentSubmission.php (modified) (1 diff)

trunk/tests/phpunit/tests/comment/wpHandleCommentSubmission.php

@@ -883 +883 @@
         $this->assertEquals( self::$post->ID, $second_comment->comment_post_ID );
     }
+
+    /**
+     * Tests that wp_handle_comment_submission() only allows replying to
+     * an approved parent comment.
+     *
+     * @ticket 53962
+     *
+     * @dataProvider data_should_only_allow_replying_to_an_approved_parent_comment
+     *
+     * @param int $approved Whether the parent comment is approved.
+     */
+    public function test_should_only_allow_replying_to_an_approved_parent_comment( $approved ) {
+        wp_set_current_user( self::$editor_id );
+
+        $comment_parent = self::factory()->comment->create(
+            array(
+                'comment_post_ID'  => self::$post->ID,
+                'comment_approved' => $approved,
+            )
+        );
+
+        $comment = wp_handle_comment_submission(
+            array(
+                'comment_post_ID'      => self::$post->ID,
+                'comment_author'       => 'A comment author',
+                'comment_author_email' => 'comment_author@example.org',
+                'comment'              => 'Howdy, comment!',
+                'comment_parent'       => $comment_parent,
+            )
+        );
+
+        if ( $approved ) {
+            $this->assertInstanceOf(
+                'WP_Comment',
+                $comment,
+                'The comment was not submitted.'
+            );
+        } else {
+            $this->assertWPError( $comment, 'The comment was submitted.' );
+            $this->assertSame(
+                'comment_reply_to_unapproved_comment',
+                $comment->get_error_code(),
+                'The wrong error code was returned.'
+            );
+        }
+    }
+
+    /**
+     * Data provider.
+     *
+     * @return array[]
+     */
+    public function data_should_only_allow_replying_to_an_approved_parent_comment() {
+        return array(
+            'an approved parent comment'   => array( 'approved' => 1 ),
+            'an unapproved parent comment' => array( 'approved' => 0 ),
+        );
+    }
+
+    /**
+     * Tests that wp_handle_comment_submission() only allows replying to
+     * an existing parent comment.
+     *
+     * @ticket 53962
+     *
+     * @dataProvider data_should_only_allow_replying_to_an_existing_parent_comment
+     *
+     * @param bool $exists Whether the parent comment exists.
+     */
+    public function test_should_only_allow_replying_to_an_existing_parent_comment( $exists ) {
+        wp_set_current_user( self::$editor_id );
+
+        $parent_comment = -99999;
+
+        if ( $exists ) {
+            $parent_comment = self::factory()->comment->create(
+                array(
+                    'comment_post_ID'  => self::$post->ID,
+                    'comment_approved' => 1,
+                )
+            );
+        }
+
+        $comment = wp_handle_comment_submission(
+            array(
+                'comment_post_ID'      => self::$post->ID,
+                'comment_author'       => 'A comment author',
+                'comment_author_email' => 'comment_author@example.org',
+                'comment'              => 'Howdy, comment!',
+                'comment_parent'       => $parent_comment,
+            )
+        );
+
+        if ( $exists ) {
+            $this->assertInstanceOf(
+                'WP_Comment',
+                $comment,
+                'The comment was not submitted.'
+            );
+        } else {
+            $this->assertWPError( $comment, 'The comment was submitted.' );
+            $this->assertSame(
+                'comment_reply_to_unapproved_comment',
+                $comment->get_error_code(),
+                'The wrong error code was returned.'
+            );
+        }
+    }
+
+    /**
+     * Data provider.
+     *
+     * @return array[]
+     */
+    public function data_should_only_allow_replying_to_an_existing_parent_comment() {
+        return array(
+            'an existing parent comment'    => array( 'exists' => true ),
+            'a non-existent parent comment' => array( 'exists' => false ),
+        );
+    }
 }