Changeset 63036 for trunk

Timestamp:

08/06/2026 09:30:58 AM (4 days ago)

Author:

youknowriad

Message:

Pings/Trackbacks: Auto-approve pingbacks and trackbacks from the same site.

Pings carry no email address, so they never satisfy the
comment_previously_approved option, which is enabled by default. Every ping
is held for moderation indefinitely as a result, including the ones a site
sends to itself when a new post links to an older one.

Approve a ping whose source URL resolves to a published post on this site.
Existing moderation checks still take precedence, and the new
auto_approve_ping filter controls the decision.

Props annezazu, avcascade, chriscct7, desrosj, dshanske, eurello, matt,
mohkatz, SergeyBiryukov, stevegrunwell.
Fixes #65016.

Location:

trunk

Files:

• src/wp-includes/comment.php (modified) (2 diffs)
• tests/phpunit/tests/comment/checkComment.php (modified) (1 diff)
• tests/phpunit/tests/comment/wpAllowComment.php (modified) (1 diff)

trunk/src/wp-includes/comment.php

@@ -21 +21 @@
  * approved.
  *
+ * Pingbacks originating from this site are automatically approved, as the link
+ * they report was created by someone who can already publish here.
+ *
  * If all checks pass, the function will return true.
  *
  * @since 1.2.0
+ * @since 7.2.0 Pingbacks from this site are no longer held for moderation.
  *
  * @global wpdb $wpdb WordPress database abstraction object.
@@ -162 +166 @@
                                 return false;
                         }
+                } elseif ( 'pingback' === $comment_type ) {
+                        /*
+                         * Only pingbacks are considered. A pingback is verified before it reaches
+                         * this point: the source page is fetched, it must link to the target, and
+                         * the comment is built from that fetched page. A trackback carries no such
+                         * proof. Its source URL, title, and excerpt are unverified request data, so
+                         * a forged trackback naming a local post as its source would be approved.
+                         */
+
+                        // url_to_postid() compares hostnames, so it returns 0 for any URL that only appears to be local.
+                        $source_id = url_to_postid( wp_unslash( $url ) );
+
+                        // Approve pingbacks reporting a link that someone who can already publish here created.
+                        $approve_pingback = $source_id > 0 && 'publish' === get_post_status( $source_id );
+
+                        /**
+                         * Filters whether a pingback is approved without being held for moderation.
+                         *
+                         * Defaults to true for pingbacks originating from a published post on this
+                         * site, and false for every other pingback. Trackbacks are never considered,
+                         * as they cannot be verified.
+                         *
+                         * @since 7.2.0
+                         *
+                         * @param bool   $approve_pingback Whether to approve the pingback.
+                         * @param int    $source_id        ID of the post on this site the pingback
+                         *                                 originated from, or 0 if it came from elsewhere.
+                         * @param string $url              The URL the pingback was sent from.
+                         */
+                        return (bool) apply_filters( 'auto_approve_pingback', $approve_pingback, $source_id, $url );
                 } else {
                         return false;

trunk/tests/phpunit/tests/comment/checkComment.php

@@ -206 +206 @@
                 $this->assertFalse( $results );
         }
+
+        /**
+         * @ticket 65016
+         */
+        public function test_should_return_true_for_a_pingback_from_this_site() {
+                update_option( 'comment_previously_approved', '1' );
+
+                $source_url = get_permalink( self::factory()->post->create() );
+
+                $this->assertTrue( check_comment( 'Site Title', '', $source_url, 'Excerpt.', '192.168.0.1', '', 'pingback' ) );
+        }
+
+        /**
+         * Trackbacks are never approved automatically.
+         *
+         * A trackback's source URL, title, and excerpt are unverified request data. Were
+         * they trusted, anyone could POST a trackback naming a local post as its source
+         * and have arbitrary content approved without moderation.
+         *
+         * @ticket 65016
+         */
+        public function test_should_return_false_for_a_trackback_claiming_a_local_source() {
+                update_option( 'comment_previously_approved', '1' );
+
+                $source_url = get_permalink( self::factory()->post->create() );
+
+                $this->assertFalse( check_comment( 'ForgedSite', '', $source_url, 'Spam.', '192.168.0.1', '', 'trackback' ) );
+        }
+
+        /**
+         * @ticket 65016
+         *
+         * @dataProvider data_ping_types
+         *
+         * @param string $comment_type The comment type.
+         */
+        public function test_should_return_false_for_a_ping_from_another_site( $comment_type ) {
+                update_option( 'comment_previously_approved', '1' );
+
+                $this->assertFalse( check_comment( 'Site Title', '', 'http://example.com/a-post/', 'Excerpt.', '192.168.0.1', '', $comment_type ) );
+        }
+
+        /**
+         * A URL is only local when its host matches, not when it merely contains the home URL.
+         *
+         * @ticket 65016
+         *
+         * @dataProvider data_ping_types
+         *
+         * @param string $comment_type The comment type.
+         */
+        public function test_should_return_false_for_a_ping_from_a_url_spoofing_this_site( $comment_type ) {
+                update_option( 'comment_previously_approved', '1' );
+
+                $post_id    = self::factory()->post->create();
+                $source_url = 'http://example.com/?ref=' . rawurlencode( get_permalink( $post_id ) );
+
+                $this->assertFalse( check_comment( 'Site Title', '', $source_url, 'Excerpt.', '192.168.0.1', '', $comment_type ) );
+        }
+
+        /**
+         * Manually approving every comment must not be bypassed by a self-pingback.
+         *
+         * @ticket 65016
+         */
+        public function test_should_return_false_for_a_pingback_from_this_site_when_comment_moderation_is_enabled() {
+                update_option( 'comment_moderation', '1' );
+
+                $source_url = get_permalink( self::factory()->post->create() );
+
+                $this->assertFalse( check_comment( 'Site Title', '', $source_url, 'Excerpt.', '192.168.0.1', '', 'pingback' ) );
+        }
+
+        /**
+         * The source post must be published, not a draft that happens to resolve.
+         *
+         * @ticket 65016
+         */
+        public function test_should_return_false_for_a_pingback_from_an_unpublished_post_on_this_site() {
+                update_option( 'comment_previously_approved', '1' );
+
+                $post_id    = self::factory()->post->create( array( 'post_status' => 'draft' ) );
+                $source_url = add_query_arg( 'p', $post_id, home_url( '/' ) );
+
+                $this->assertFalse( check_comment( 'Site Title', '', $source_url, 'Excerpt.', '192.168.0.1', '', 'pingback' ) );
+        }
+
+        /**
+         * Only pings are exempt. A regular comment linking to a local post is still moderated.
+         *
+         * @ticket 65016
+         */
+        public function test_should_return_false_for_a_comment_whose_author_url_is_a_post_on_this_site() {
+                update_option( 'comment_previously_approved', '1' );
+
+                $source_url = get_permalink( self::factory()->post->create() );
+
+                $this->assertFalse( check_comment( 'Bob', 'bob@example.com', $source_url, 'A comment.', '192.168.0.1', '', 'comment' ) );
+        }
+
+        /**
+         * @ticket 65016
+         */
+        public function test_auto_approve_pingback_should_be_able_to_hold_a_pingback_from_this_site() {
+                update_option( 'comment_previously_approved', '1' );
+
+                $source_url = get_permalink( self::factory()->post->create() );
+
+                add_filter( 'auto_approve_pingback', '__return_false' );
+
+                $this->assertFalse( check_comment( 'Site Title', '', $source_url, 'Excerpt.', '192.168.0.1', '', 'pingback' ) );
+        }
+
+        /**
+         * @ticket 65016
+         */
+        public function test_auto_approve_pingback_should_be_able_to_approve_a_pingback_from_another_site() {
+                update_option( 'comment_previously_approved', '1' );
+
+                add_filter( 'auto_approve_pingback', '__return_true' );
+
+                $this->assertTrue( check_comment( 'Site Title', '', 'http://example.com/a-post/', 'Excerpt.', '192.168.0.1', '', 'pingback' ) );
+        }
+
+        /**
+         * @ticket 65016
+         */
+        public function test_auto_approve_pingback_should_receive_the_source_post_id() {
+                update_option( 'comment_previously_approved', '1' );
+
+                $post_id    = self::factory()->post->create();
+                $source_url = get_permalink( $post_id );
+
+                $observed = null;
+                add_filter(
+                        'auto_approve_pingback',
+                        static function ( $approve, $source_id ) use ( &$observed ) {
+                                $observed = $source_id;
+                                return $approve;
+                        },
+                        10,
+                        2
+                );
+
+                check_comment( 'Site Title', '', $source_url, 'Excerpt.', '192.168.0.1', '', 'pingback' );
+
+                $this->assertSame( $post_id, $observed );
+        }
+
+        /**
+         * Data provider.
+         *
+         * @return array[]
+         */
+        public function data_ping_types() {
+                return array(
+                        'pingback'  => array( 'pingback' ),
+                        'trackback' => array( 'trackback' ),
+                );
+        }
 }

trunk/tests/phpunit/tests/comment/wpAllowComment.php

@@ -72 +72 @@
                 $result = wp_allow_comment( $comment_data );
         }
+
+        /**
+         * @ticket 65016
+         *
+         * @dataProvider data_should_approve_a_pingback_only_when_it_comes_from_this_site
+         *
+         * @param bool $is_self_ping Whether the pingback should come from this site.
+         * @param int  $expected     The expected approval status.
+         */
+        public function test_should_approve_a_pingback_only_when_it_comes_from_this_site( $is_self_ping, $expected ) {
+                update_option( 'comment_previously_approved', '1' );
+
+                $source_url = $is_self_ping
+                        ? get_permalink( self::factory()->post->create() )
+                        : 'http://example.com/their-post/';
+
+                $comment_data = array(
+                        'comment_post_ID'      => self::$post_id,
+                        'comment_author'       => 'The Linking Post',
+                        'comment_author_email' => '',
+                        'comment_author_url'   => $source_url,
+                        'comment_content'      => '[…] an earlier post of mine […]',
+                        'comment_author_IP'    => '192.168.0.1',
+                        'comment_parent'       => 0,
+                        'comment_date_gmt'     => gmdate( 'Y-m-d H:i:s' ),
+                        'comment_agent'        => 'WordPress/6.8',
+                        'comment_type'         => 'pingback',
+                );
+
+                $this->assertSame( $expected, wp_allow_comment( $comment_data ) );
+        }
+
+        /**
+         * Data provider.
+         *
+         * @return array[]
+         */
+        public function data_should_approve_a_pingback_only_when_it_comes_from_this_site() {
+                return array(
+                        'a pingback from this site'    => array( true, 1 ),
+                        'a pingback from another site' => array( false, 0 ),
+                );
+        }
 }