WordPress.org

Make WordPress Core

Opened 4 years ago

Last modified 10 months ago

#14601 new enhancement

wp_new_comment method doesn't allow passed in values for IP and user-agent

Reported by: mrutz Owned by:
Milestone: Future Release Priority: normal
Severity: normal Version: 3.0.1
Component: Comments Keywords: has-patch 3.2-early
Focuses: Cc:

Description (last modified by ocean90)

In a scenario where you have a client that receives comments from the internet and pre-processes those comments before feeding them into wordpress through xmlrpc the ip and user-agent of the commenting internet user gets lost because there is no way of passing those values into the wp_new_comment function.

$_SERVER['REMOTE_ADDR'] and $_SERVER['HTTP_USER_AGENT'] are hard-coded, which in the above mentioned scenario will always have the IP and user-agent from the client that feeds the comments into wp through xmlrpc.

The attached patch will used passed in values and only fall back to $_SERVER['REMOTE_ADDR'] and $_SERVER['HTTP_USER_AGENT'] if not passed in.

Attachments (3)

comments_ip_agent.patch (1.3 KB) - added by mrutz 4 years ago.
14601.diff (1.5 KB) - added by wonderboymusic 18 months ago.
14601.2.diff (1.4 KB) - added by wonderboymusic 12 months ago.

Download all attachments as: .zip

Change History (16)

mrutz4 years ago

comment:1 scribu4 years ago

  • Keywords has-patch added

comment:2 Denis-de-Bernardy4 years ago

  • Milestone changed from Awaiting Review to 3.1

comment:3 nacin4 years ago

  • Keywords 3.2-early added
  • Milestone changed from 3.1 to Future Release

It also doesn't allow you to modify the date of the comment.

wonderboymusic18 months ago

comment:4 wonderboymusic18 months ago

  • Milestone changed from Future Release to 3.6

Refreshed against trunk plus added the date thing

comment:5 follow-up: ericlewis15 months ago

Should we validate this data on the way in?

comment:6 in reply to: ↑ 5 DrewAPicture15 months ago

14601.diff works as expected for me.

Replying to ericlewis:

Should we validate this data on the way in?

I suppose we could use FILTER_VALIDATE_IP to validate on the way in.

Last edited 15 months ago by DrewAPicture (previous) (diff)

comment:7 follow-up: DrewAPicture15 months ago

Yeah, it's 5:30 am, and I wasn't thinking. I meant to say in comment:6 that we could probably use filter_var() and FILTER_VALIDATE_IP to check $commentdata['comment_author_IP'] on the way in. Something like

if ( ! isset( $commentdata['comment_author_IP'] ) && filter_var( $commentdata['comment_author_IP'], FILTER_VALIDATE_IP ) )

comment:8 in reply to: ↑ 7 ocean9015 months ago

Replying to DrewAPicture:

we could probably use filter_var() and FILTER_VALIDATE_IP

If it's available yes, but comment:7:ticket:16867.

comment:9 ocean9015 months ago

  • Description modified (diff)

comment:10 ocean9014 months ago

  • Milestone changed from 3.6 to Future Release

wonderboymusic12 months ago

comment:11 wonderboymusic12 months ago

  • Milestone changed from Future Release to 3.7

Refreshed

comment:12 nacin10 months ago

Is there a situation where $commentdata is actually just $_POST data? Is it unreasonable for a plugin to have done that? We need to make sure users can't control these values.

comment:13 jeremyfelt10 months ago

  • Milestone changed from 3.7 to Future Release

Punting to the future. More discussion should probably happen around the data coming in and how it should be handled.

Note: See TracTickets for help on using tickets.