Changeset 59322 for branches/6.7/tests/phpunit/tests/comment/wpHandleCommentSubmission.php

Timestamp:

10/29/2024 04:33:51 PM (2 years ago)

Author:

SergeyBiryukov

Message:

Comments: Use a more precise check for disallowed keys on filtered comment data.

The previous approach of running wp_allow_comment() twice could have unintended consequences, e.g. the check_comment_flood action was also triggered twice, which might lead to false-positive identification of comment flood in case there is some custom callback hooked to it, which is not expecting identical data seeing twice.

This commit introduces a new function, wp_check_comment_data(), to specifically check for disallowed content before and after comment data is filtered.

Follow-up to [59267].

Reviewed by davidbaumwald.
Merges [59319] to the 6.7 branch.

Props david.binda, SergeyBiryukov.
Fixes #61827.

Location:

branches/6.7

Files:

• . (modified) (1 prop)
• tests/phpunit/tests/comment/wpHandleCommentSubmission.php (modified) (2 diffs)

branches/6.7/tests/phpunit/tests/comment/wpHandleCommentSubmission.php

@@ -990 +990 @@
                 $comment = wp_handle_comment_submission( $data );
 
-                $this->assertNotWPError( $comment );
-                $this->assertInstanceOf( 'WP_Comment', $comment );
-                $this->assertSame( 'trash', $comment->comment_approved );
+                $this->assertInstanceOf( 'WP_Comment', $comment, 'The comment was not submitted.' );
+                $this->assertSame( 'trash', $comment->comment_approved, 'The wrong approved status was returned.' );
         }
 
@@ -1010 +1009 @@
                 $comment = wp_handle_comment_submission( $data );
 
-                $this->assertNotWPError( $comment );
-                $this->assertInstanceOf( 'WP_Comment', $comment );
-                $this->assertSame( 'trash', $comment->comment_approved );
+                $this->assertInstanceOf( 'WP_Comment', $comment, 'The comment was not submitted.' );
+                $this->assertSame( 'trash', $comment->comment_approved, 'The wrong approved status was returned.' );
+        }
+
+        /**
+         * @ticket 61827
+         */
+        public function test_disallowed_keys_filtered_html_match_does_not_call_check_comment_flood_action_twice() {
+                $data = array(
+                        'comment_post_ID' => self::$post->ID,
+                        'comment'         => '<a href=http://example.com/>example</a>',
+                        'author'          => 'Comment Author',
+                        'email'           => 'comment@example.org',
+                );
+
+                update_option( 'disallowed_keys', "href=\\\"http\nfoo" );
+
+                $pre_comment_approved = new MockAction();
+                $check_comment_flood  = new MockAction();
+                add_filter( 'pre_comment_approved', array( $pre_comment_approved, 'filter' ), 10, 2 );
+                add_action( 'check_comment_flood', array( $check_comment_flood, 'action' ), 10, 4 );
+
+                $comment = wp_handle_comment_submission( $data );
+
+                $this->assertInstanceOf( 'WP_Comment', $comment, 'The comment was not submitted.' );
+                $this->assertSame( 'trash', $comment->comment_approved, 'The wrong approved status was returned.' );
+
+                $this->assertSame( 2, $pre_comment_approved->get_call_count(), 'The `pre_comment_approved` filter was not called twice.' );
+                $this->assertSame( 1, $check_comment_flood->get_call_count(), 'The `check_comment_flood` action was not called exactly once.' );
         }
 }