Make WordPress Core

Opened 5 years ago

Last modified 2 months ago

#14601 closed enhancement

wp_new_comment method doesn't allow passed in values for IP and user-agent — at Version 9

Reported by: mrutz Owned by:
Milestone: 4.3 Priority: normal
Severity: normal Version: 3.0.1
Component: Comments Keywords: rest-api has-patch
Focuses: Cc:

Description (last modified by ocean90)

In a scenario where you have a client that receives comments from the internet and pre-processes those comments before feeding them into wordpress through xmlrpc the ip and user-agent of the commenting internet user gets lost because there is no way of passing those values into the wp_new_comment function.

$_SERVER['REMOTE_ADDR'] and $_SERVER['HTTP_USER_AGENT'] are hard-coded, which in the above mentioned scenario will always have the IP and user-agent from the client that feeds the comments into wp through xmlrpc.

The attached patch will used passed in values and only fall back to $_SERVER['REMOTE_ADDR'] and $_SERVER['HTTP_USER_AGENT'] if not passed in.

Change History (11)

@mrutz5 years ago

comment:1 @scribu5 years ago

  • Keywords has-patch added

comment:2 @Denis-de-Bernardy5 years ago

  • Milestone changed from Awaiting Review to 3.1

comment:3 @nacin5 years ago

  • Keywords 3.2-early added
  • Milestone changed from 3.1 to Future Release

It also doesn't allow you to modify the date of the comment.

@wonderboymusic3 years ago

comment:4 @wonderboymusic3 years ago

  • Milestone changed from Future Release to 3.6

Refreshed against trunk plus added the date thing

comment:5 follow-up: @ericlewis2 years ago

Should we validate this data on the way in?

comment:6 in reply to: ↑ 5 @DrewAPicture2 years ago

14601.diff works as expected for me.

Replying to ericlewis:

Should we validate this data on the way in?

I suppose we could use FILTER_VALIDATE_IP to validate on the way in.

Last edited 2 years ago by DrewAPicture (previous) (diff)

comment:7 follow-up: @DrewAPicture2 years ago

Yeah, it's 5:30 am, and I wasn't thinking. I meant to say in comment:6 that we could probably use filter_var() and FILTER_VALIDATE_IP to check $commentdata['comment_author_IP'] on the way in. Something like

if ( ! isset( $commentdata['comment_author_IP'] ) && filter_var( $commentdata['comment_author_IP'], FILTER_VALIDATE_IP ) )

comment:8 in reply to: ↑ 7 @ocean902 years ago

Replying to DrewAPicture:

we could probably use filter_var() and FILTER_VALIDATE_IP

If it's available yes, but comment:7:ticket:16867.

comment:9 @ocean902 years ago

  • Description modified (diff)
Note: See TracTickets for help on using tickets.