WordPress.org

Make WordPress Core

Opened 6 years ago

Last modified 13 months ago

#14601 closed enhancement

wp_new_comment method doesn't allow passed in values for IP and user-agent — at Version 9

Reported by: mrutz Owned by:
Milestone: 4.3 Priority: normal
Severity: normal Version: 3.0.1
Component: Comments Keywords: rest-api has-patch
Focuses: Cc:

Description (last modified by ocean90)

In a scenario where you have a client that receives comments from the internet and pre-processes those comments before feeding them into wordpress through xmlrpc the ip and user-agent of the commenting internet user gets lost because there is no way of passing those values into the wp_new_comment function.

$_SERVER['REMOTE_ADDR'] and $_SERVER['HTTP_USER_AGENT'] are hard-coded, which in the above mentioned scenario will always have the IP and user-agent from the client that feeds the comments into wp through xmlrpc.

The attached patch will used passed in values and only fall back to $_SERVER['REMOTE_ADDR'] and $_SERVER['HTTP_USER_AGENT'] if not passed in.

Change History (11)

#1 @scribu
6 years ago

  • Keywords has-patch added

#2 @Denis-de-Bernardy
6 years ago

  • Milestone changed from Awaiting Review to 3.1

#3 @nacin
6 years ago

  • Keywords 3.2-early added
  • Milestone changed from 3.1 to Future Release

It also doesn't allow you to modify the date of the comment.

@wonderboymusic
4 years ago

#4 @wonderboymusic
4 years ago

  • Milestone changed from Future Release to 3.6

Refreshed against trunk plus added the date thing

#5 follow-up: @ericlewis
3 years ago

Should we validate this data on the way in?

#6 in reply to: ↑ 5 @DrewAPicture
3 years ago

14601.diff works as expected for me.

Replying to ericlewis:

Should we validate this data on the way in?

I suppose we could use FILTER_VALIDATE_IP to validate on the way in.

Last edited 3 years ago by DrewAPicture (previous) (diff)

#7 follow-up: @DrewAPicture
3 years ago

Yeah, it's 5:30 am, and I wasn't thinking. I meant to say in comment:6 that we could probably use filter_var() and FILTER_VALIDATE_IP to check $commentdata['comment_author_IP'] on the way in. Something like

if ( ! isset( $commentdata['comment_author_IP'] ) && filter_var( $commentdata['comment_author_IP'], FILTER_VALIDATE_IP ) )

#8 in reply to: ↑ 7 @ocean90
3 years ago

Replying to DrewAPicture:

we could probably use filter_var() and FILTER_VALIDATE_IP

If it's available yes, but comment:7:ticket:16867.

#9 @ocean90
3 years ago

  • Description modified (diff)
Note: See TracTickets for help on using tickets.