Changeset 59267

Timestamp:

10/21/2024 11:05:53 PM (3 months ago)

Author:

SergeyBiryukov

Message:

Comments: Validate new comments before and after comment data is filtered.

This ensures that a Disallowed Comment Keys match will consistently send the comment to the Trash, by checking both the original unmodified comment data and the final filtered comment data.

If the first check has already resulted in a trash or spam status, the second check is skipped as redundant.

Follow-up to [2894], [3851], [48121], [48575].

Props cfinke, kbrownkd, thompsonsj, mi5t4n, devspace, chaion07, engahmeds3ed, SergeyBiryukov.
Fixes #61827.

Location:

trunk

Files:

• src/wp-includes/comment.php (modified) (1 diff)
• tests/phpunit/tests/comment/wpHandleCommentSubmission.php (modified) (1 diff)

trunk/src/wp-includes/comment.php

@@ -2278 +2278 @@
     }
 
+    $commentdata['comment_approved'] = wp_allow_comment( $commentdata, $wp_error );
+
     $commentdata = wp_filter_comment( $commentdata );
 
-    $commentdata['comment_approved'] = wp_allow_comment( $commentdata, $wp_error );
+    if ( ! in_array( $commentdata['comment_approved'], array( 'trash', 'spam' ), true ) ) {
+        // Validate the comment again after filters are applied to comment data.
+        $commentdata['comment_approved'] = wp_allow_comment( $commentdata, $wp_error );
+    }
 
     if ( is_wp_error( $commentdata['comment_approved'] ) ) {

trunk/tests/phpunit/tests/comment/wpHandleCommentSubmission.php

@@ -977 +977 @@
         );
     }
+
+    public function test_disallowed_keys_match_gives_approved_status_of_trash() {
+        $data = array(
+            'comment_post_ID' => self::$post->ID,
+            'comment'         => 'Comment',
+            'author'          => 'Comment Author',
+            'email'           => 'comment@example.org',
+        );
+
+        update_option( 'disallowed_keys', "Comment\nfoo" );
+
+        $comment = wp_handle_comment_submission( $data );
+
+        $this->assertNotWPError( $comment );
+        $this->assertInstanceOf( 'WP_Comment', $comment );
+        $this->assertSame( 'trash', $comment->comment_approved );
+    }
+
+    /**
+     * @ticket 61827
+     */
+    public function test_disallowed_keys_html_match_gives_approved_status_of_trash() {
+        $data = array(
+            'comment_post_ID' => self::$post->ID,
+            'comment'         => '<a href=http://example.com/>example</a>',
+            'author'          => 'Comment Author',
+            'email'           => 'comment@example.org',
+        );
+
+        update_option( 'disallowed_keys', "href=http\nfoo" );
+
+        $comment = wp_handle_comment_submission( $data );
+
+        $this->assertNotWPError( $comment );
+        $this->assertInstanceOf( 'WP_Comment', $comment );
+        $this->assertSame( 'trash', $comment->comment_approved );
+    }
 }