Changeset 63036 for trunk/tests/phpunit/tests/comment/checkComment.php

Timestamp:

08/06/2026 09:30:58 AM (2 months ago)

Author:

youknowriad

Message:

Pings/Trackbacks: Auto-approve pingbacks and trackbacks from the same site.

Pings carry no email address, so they never satisfy the
comment_previously_approved option, which is enabled by default. Every ping
is held for moderation indefinitely as a result, including the ones a site
sends to itself when a new post links to an older one.

Approve a ping whose source URL resolves to a published post on this site.
Existing moderation checks still take precedence, and the new
auto_approve_ping filter controls the decision.

Props annezazu, avcascade, chriscct7, desrosj, dshanske, eurello, matt,
mohkatz, SergeyBiryukov, stevegrunwell.
Fixes #65016.

File:

• trunk/tests/phpunit/tests/comment/checkComment.php (modified) (1 diff)

trunk/tests/phpunit/tests/comment/checkComment.php

@@ -206 +206 @@
                 $this->assertFalse( $results );
         }
+
+        /**
+         * @ticket 65016
+         */
+        public function test_should_return_true_for_a_pingback_from_this_site() {
+                update_option( 'comment_previously_approved', '1' );
+
+                $source_url = get_permalink( self::factory()->post->create() );
+
+                $this->assertTrue( check_comment( 'Site Title', '', $source_url, 'Excerpt.', '192.168.0.1', '', 'pingback' ) );
+        }
+
+        /**
+         * Trackbacks are never approved automatically.
+         *
+         * A trackback's source URL, title, and excerpt are unverified request data. Were
+         * they trusted, anyone could POST a trackback naming a local post as its source
+         * and have arbitrary content approved without moderation.
+         *
+         * @ticket 65016
+         */
+        public function test_should_return_false_for_a_trackback_claiming_a_local_source() {
+                update_option( 'comment_previously_approved', '1' );
+
+                $source_url = get_permalink( self::factory()->post->create() );
+
+                $this->assertFalse( check_comment( 'ForgedSite', '', $source_url, 'Spam.', '192.168.0.1', '', 'trackback' ) );
+        }
+
+        /**
+         * @ticket 65016
+         *
+         * @dataProvider data_ping_types
+         *
+         * @param string $comment_type The comment type.
+         */
+        public function test_should_return_false_for_a_ping_from_another_site( $comment_type ) {
+                update_option( 'comment_previously_approved', '1' );
+
+                $this->assertFalse( check_comment( 'Site Title', '', 'http://example.com/a-post/', 'Excerpt.', '192.168.0.1', '', $comment_type ) );
+        }
+
+        /**
+         * A URL is only local when its host matches, not when it merely contains the home URL.
+         *
+         * @ticket 65016
+         *
+         * @dataProvider data_ping_types
+         *
+         * @param string $comment_type The comment type.
+         */
+        public function test_should_return_false_for_a_ping_from_a_url_spoofing_this_site( $comment_type ) {
+                update_option( 'comment_previously_approved', '1' );
+
+                $post_id    = self::factory()->post->create();
+                $source_url = 'http://example.com/?ref=' . rawurlencode( get_permalink( $post_id ) );
+
+                $this->assertFalse( check_comment( 'Site Title', '', $source_url, 'Excerpt.', '192.168.0.1', '', $comment_type ) );
+        }
+
+        /**
+         * Manually approving every comment must not be bypassed by a self-pingback.
+         *
+         * @ticket 65016
+         */
+        public function test_should_return_false_for_a_pingback_from_this_site_when_comment_moderation_is_enabled() {
+                update_option( 'comment_moderation', '1' );
+
+                $source_url = get_permalink( self::factory()->post->create() );
+
+                $this->assertFalse( check_comment( 'Site Title', '', $source_url, 'Excerpt.', '192.168.0.1', '', 'pingback' ) );
+        }
+
+        /**
+         * The source post must be published, not a draft that happens to resolve.
+         *
+         * @ticket 65016
+         */
+        public function test_should_return_false_for_a_pingback_from_an_unpublished_post_on_this_site() {
+                update_option( 'comment_previously_approved', '1' );
+
+                $post_id    = self::factory()->post->create( array( 'post_status' => 'draft' ) );
+                $source_url = add_query_arg( 'p', $post_id, home_url( '/' ) );
+
+                $this->assertFalse( check_comment( 'Site Title', '', $source_url, 'Excerpt.', '192.168.0.1', '', 'pingback' ) );
+        }
+
+        /**
+         * Only pings are exempt. A regular comment linking to a local post is still moderated.
+         *
+         * @ticket 65016
+         */
+        public function test_should_return_false_for_a_comment_whose_author_url_is_a_post_on_this_site() {
+                update_option( 'comment_previously_approved', '1' );
+
+                $source_url = get_permalink( self::factory()->post->create() );
+
+                $this->assertFalse( check_comment( 'Bob', 'bob@example.com', $source_url, 'A comment.', '192.168.0.1', '', 'comment' ) );
+        }
+
+        /**
+         * @ticket 65016
+         */
+        public function test_auto_approve_pingback_should_be_able_to_hold_a_pingback_from_this_site() {
+                update_option( 'comment_previously_approved', '1' );
+
+                $source_url = get_permalink( self::factory()->post->create() );
+
+                add_filter( 'auto_approve_pingback', '__return_false' );
+
+                $this->assertFalse( check_comment( 'Site Title', '', $source_url, 'Excerpt.', '192.168.0.1', '', 'pingback' ) );
+        }
+
+        /**
+         * @ticket 65016
+         */
+        public function test_auto_approve_pingback_should_be_able_to_approve_a_pingback_from_another_site() {
+                update_option( 'comment_previously_approved', '1' );
+
+                add_filter( 'auto_approve_pingback', '__return_true' );
+
+                $this->assertTrue( check_comment( 'Site Title', '', 'http://example.com/a-post/', 'Excerpt.', '192.168.0.1', '', 'pingback' ) );
+        }
+
+        /**
+         * @ticket 65016
+         */
+        public function test_auto_approve_pingback_should_receive_the_source_post_id() {
+                update_option( 'comment_previously_approved', '1' );
+
+                $post_id    = self::factory()->post->create();
+                $source_url = get_permalink( $post_id );
+
+                $observed = null;
+                add_filter(
+                        'auto_approve_pingback',
+                        static function ( $approve, $source_id ) use ( &$observed ) {
+                                $observed = $source_id;
+                                return $approve;
+                        },
+                        10,
+                        2
+                );
+
+                check_comment( 'Site Title', '', $source_url, 'Excerpt.', '192.168.0.1', '', 'pingback' );
+
+                $this->assertSame( $post_id, $observed );
+        }
+
+        /**
+         * Data provider.
+         *
+         * @return array[]
+         */
+        public function data_ping_types() {
+                return array(
+                        'pingback'  => array( 'pingback' ),
+                        'trackback' => array( 'trackback' ),
+                );
+        }
 }