Changeset 63036 for trunk/src/wp-includes/comment.php

Timestamp:

08/06/2026 09:30:58 AM (2 months ago)

Author:

youknowriad

Message:

Pings/Trackbacks: Auto-approve pingbacks and trackbacks from the same site.

Pings carry no email address, so they never satisfy the
comment_previously_approved option, which is enabled by default. Every ping
is held for moderation indefinitely as a result, including the ones a site
sends to itself when a new post links to an older one.

Approve a ping whose source URL resolves to a published post on this site.
Existing moderation checks still take precedence, and the new
auto_approve_ping filter controls the decision.

Props annezazu, avcascade, chriscct7, desrosj, dshanske, eurello, matt,
mohkatz, SergeyBiryukov, stevegrunwell.
Fixes #65016.

File:

• trunk/src/wp-includes/comment.php (modified) (2 diffs)

trunk/src/wp-includes/comment.php

@@ -21 +21 @@
  * approved.
  *
+ * Pingbacks originating from this site are automatically approved, as the link
+ * they report was created by someone who can already publish here.
+ *
  * If all checks pass, the function will return true.
  *
  * @since 1.2.0
+ * @since 7.2.0 Pingbacks from this site are no longer held for moderation.
  *
  * @global wpdb $wpdb WordPress database abstraction object.
@@ -162 +166 @@
                                 return false;
                         }
+                } elseif ( 'pingback' === $comment_type ) {
+                        /*
+                         * Only pingbacks are considered. A pingback is verified before it reaches
+                         * this point: the source page is fetched, it must link to the target, and
+                         * the comment is built from that fetched page. A trackback carries no such
+                         * proof. Its source URL, title, and excerpt are unverified request data, so
+                         * a forged trackback naming a local post as its source would be approved.
+                         */
+
+                        // url_to_postid() compares hostnames, so it returns 0 for any URL that only appears to be local.
+                        $source_id = url_to_postid( wp_unslash( $url ) );
+
+                        // Approve pingbacks reporting a link that someone who can already publish here created.
+                        $approve_pingback = $source_id > 0 && 'publish' === get_post_status( $source_id );
+
+                        /**
+                         * Filters whether a pingback is approved without being held for moderation.
+                         *
+                         * Defaults to true for pingbacks originating from a published post on this
+                         * site, and false for every other pingback. Trackbacks are never considered,
+                         * as they cannot be verified.
+                         *
+                         * @since 7.2.0
+                         *
+                         * @param bool   $approve_pingback Whether to approve the pingback.
+                         * @param int    $source_id        ID of the post on this site the pingback
+                         *                                 originated from, or 0 if it came from elsewhere.
+                         * @param string $url              The URL the pingback was sent from.
+                         */
+                        return (bool) apply_filters( 'auto_approve_pingback', $approve_pingback, $source_id, $url );
                 } else {
                         return false;