Changeset 59322 for branches/6.7/tests/phpunit/tests/comment/wpHandleCommentSubmission.php

Timestamp:

10/29/2024 04:33:51 PM (5 weeks ago)

Author:

SergeyBiryukov

Message:

Comments: Use a more precise check for disallowed keys on filtered comment data.

The previous approach of running wp_allow_comment() twice could have unintended consequences, e.g. the check_comment_flood action was also triggered twice, which might lead to false-positive identification of comment flood in case there is some custom callback hooked to it, which is not expecting identical data seeing twice.

This commit introduces a new function, wp_check_comment_data(), to specifically check for disallowed content before and after comment data is filtered.

Follow-up to [59267].

Reviewed by davidbaumwald.
Merges [59319] to the 6.7 branch.

Props david.binda, SergeyBiryukov.
Fixes #61827.

Location:

branches/6.7

Files:

• . (modified) (1 prop)
• tests/phpunit/tests/comment/wpHandleCommentSubmission.php (modified) (2 diffs)

branches/6.7/tests/phpunit/tests/comment/wpHandleCommentSubmission.php

@@ -990 +990 @@
         $comment = wp_handle_comment_submission( $data );
 
-        $this->assertNotWPError( $comment );
-        $this->assertInstanceOf( 'WP_Comment', $comment );
-        $this->assertSame( 'trash', $comment->comment_approved );
+        $this->assertInstanceOf( 'WP_Comment', $comment, 'The comment was not submitted.' );
+        $this->assertSame( 'trash', $comment->comment_approved, 'The wrong approved status was returned.' );
     }
 
@@ -1010 +1009 @@
         $comment = wp_handle_comment_submission( $data );
 
-        $this->assertNotWPError( $comment );
-        $this->assertInstanceOf( 'WP_Comment', $comment );
-        $this->assertSame( 'trash', $comment->comment_approved );
+        $this->assertInstanceOf( 'WP_Comment', $comment, 'The comment was not submitted.' );
+        $this->assertSame( 'trash', $comment->comment_approved, 'The wrong approved status was returned.' );
+    }
+
+    /**
+     * @ticket 61827
+     */
+    public function test_disallowed_keys_filtered_html_match_does_not_call_check_comment_flood_action_twice() {
+        $data = array(
+            'comment_post_ID' => self::$post->ID,
+            'comment'         => '<a href=http://example.com/>example</a>',
+            'author'          => 'Comment Author',
+            'email'           => 'comment@example.org',
+        );
+
+        update_option( 'disallowed_keys', "href=\\\"http\nfoo" );
+
+        $pre_comment_approved = new MockAction();
+        $check_comment_flood  = new MockAction();
+        add_filter( 'pre_comment_approved', array( $pre_comment_approved, 'filter' ), 10, 2 );
+        add_action( 'check_comment_flood', array( $check_comment_flood, 'action' ), 10, 4 );
+
+        $comment = wp_handle_comment_submission( $data );
+
+        $this->assertInstanceOf( 'WP_Comment', $comment, 'The comment was not submitted.' );
+        $this->assertSame( 'trash', $comment->comment_approved, 'The wrong approved status was returned.' );
+
+        $this->assertSame( 2, $pre_comment_approved->get_call_count(), 'The `pre_comment_approved` filter was not called twice.' );
+        $this->assertSame( 1, $check_comment_flood->get_call_count(), 'The `check_comment_flood` action was not called exactly once.' );
     }
 }