WordPress.org

Make WordPress Core

Opened 4 years ago

Last modified 7 months ago

#14601 new enhancement

wp_new_comment method doesn't allow passed in values for IP and user-agent — at Version 9

Reported by: mrutz Owned by:
Milestone: Future Release Priority: normal
Severity: normal Version: 3.0.1
Component: Comments Keywords: has-patch 3.2-early
Focuses: Cc:

Description (last modified by ocean90)

In a scenario where you have a client that receives comments from the internet and pre-processes those comments before feeding them into wordpress through xmlrpc the ip and user-agent of the commenting internet user gets lost because there is no way of passing those values into the wp_new_comment function.

$_SERVER['REMOTE_ADDR'] and $_SERVER['HTTP_USER_AGENT'] are hard-coded, which in the above mentioned scenario will always have the IP and user-agent from the client that feeds the comments into wp through xmlrpc.

The attached patch will used passed in values and only fall back to $_SERVER['REMOTE_ADDR'] and $_SERVER['HTTP_USER_AGENT'] if not passed in.

Change History (11)

mrutz4 years ago

comment:1 scribu4 years ago

  • Keywords has-patch added

comment:2 Denis-de-Bernardy4 years ago

  • Milestone changed from Awaiting Review to 3.1

comment:3 nacin3 years ago

  • Keywords 3.2-early added
  • Milestone changed from 3.1 to Future Release

It also doesn't allow you to modify the date of the comment.

wonderboymusic15 months ago

comment:4 wonderboymusic15 months ago

  • Milestone changed from Future Release to 3.6

Refreshed against trunk plus added the date thing

comment:5 follow-up: ericlewis12 months ago

Should we validate this data on the way in?

comment:6 in reply to: ↑ 5 DrewAPicture12 months ago

14601.diff works as expected for me.

Replying to ericlewis:

Should we validate this data on the way in?

I suppose we could use FILTER_VALIDATE_IP to validate on the way in.

Last edited 12 months ago by DrewAPicture (previous) (diff)

comment:7 follow-up: DrewAPicture12 months ago

Yeah, it's 5:30 am, and I wasn't thinking. I meant to say in comment:6 that we could probably use filter_var() and FILTER_VALIDATE_IP to check $commentdata['comment_author_IP'] on the way in. Something like

if ( ! isset( $commentdata['comment_author_IP'] ) && filter_var( $commentdata['comment_author_IP'], FILTER_VALIDATE_IP ) )

comment:8 in reply to: ↑ 7 ocean9012 months ago

Replying to DrewAPicture:

we could probably use filter_var() and FILTER_VALIDATE_IP

If it's available yes, but comment:7:ticket:16867.

comment:9 ocean9012 months ago

  • Description modified (diff)
Note: See TracTickets for help on using tickets.