Changeset 59267 for trunk/src/wp-includes/comment.php

Timestamp:

10/21/2024 11:05:53 PM (7 weeks ago)

Author:

SergeyBiryukov

Message:

Comments: Validate new comments before and after comment data is filtered.

This ensures that a Disallowed Comment Keys match will consistently send the comment to the Trash, by checking both the original unmodified comment data and the final filtered comment data.

If the first check has already resulted in a trash or spam status, the second check is skipped as redundant.

Follow-up to [2894], [3851], [48121], [48575].

Props cfinke, kbrownkd, thompsonsj, mi5t4n, devspace, chaion07, engahmeds3ed, SergeyBiryukov.
Fixes #61827.

File:

• trunk/src/wp-includes/comment.php (modified) (1 diff)

trunk/src/wp-includes/comment.php

@@ -2278 +2278 @@
     }
 
+    $commentdata['comment_approved'] = wp_allow_comment( $commentdata, $wp_error );
+
     $commentdata = wp_filter_comment( $commentdata );
 
-    $commentdata['comment_approved'] = wp_allow_comment( $commentdata, $wp_error );
+    if ( ! in_array( $commentdata['comment_approved'], array( 'trash', 'spam' ), true ) ) {
+        // Validate the comment again after filters are applied to comment data.
+        $commentdata['comment_approved'] = wp_allow_comment( $commentdata, $wp_error );
+    }
 
     if ( is_wp_error( $commentdata['comment_approved'] ) ) {