Allow Plugins Access to Pingback Source HTML

[dshanske]

This came up as I was looking at trying to close #3491.

This is a 9 year old ticket that proposes that hooks be added to allow plugins access to trackback and pingback data.

@markjaquith had pointed out that the best solution is to use the preprocess comment hook, but this doesn't allow the data to be saved into the comment.

The simplest solution is to modify wp_insert_comment to save anything not in an existing field into comment meta and then modify pingbacks and trackbacks to save that data into the meta.

[dshanske]

So, the scope of this proposal is as follows.

1. Pingback pass data on in $commentdata.
2. Extra fields in $commentdata get saved by wp_insert_comment into $commentmeta or support this by plugin by passing the full $commentdata to the action hook comment_post.

[dshanske]

The diff I added uses the easier option of passing the entire $commentdata to the comment_post hook. This would allow any plugin to get access to the data.

[dshanske]

Alternate Implementation

[dshanske]

Correction - Should be Array_Diff_key

[dshanske]

Added the second option for implementation that takes anything in $commentdata that isn't a standard field and saves it in meta.

[dshanske]

There was concern expressed in Slack that allowing the stored HTML to be stored could be a security issue. However, looking at the pingback code, it strips all tags. Assuming it must predate wp_kses_post which strips only certain tags, but that was before my time.

Think this needs to be addressed as well, as currently, it occurs to me the concern is somewhat moot as all tags have already been stripped except links before it is saved...but on the other hand, that would strip any other type of markup if a plugin wanted to use it...

The best way to address that part of it may be to close this ticket by coming up with the code to pass the data, and address the presentation issue on the opened #32653.

[dshanske]

Tried to go a step further by a proposal on Ticket #32653.

[DrewAPicture]

@SergeyBiryukov: Best suggestion on moving forward with this?

[wonderboymusic]

I think meta adds should go against a whitelist

[dshanske]

The question is what is on the whitelist.

[SergeyBiryukov]

I think 34141.diff​ would be the preferred approach here.

In 34141.3.diff​:

• Rename $linea to $remote_source for clarity.
• Add 'remote_source' to comment data, so it's available to the 'preprocess_comment' filter.
• Pass comment data to the 'comment_post' filter.

[westi]

Replying to SergeyBiryukov:

I think 34141.diff​ would be the preferred approach here.

In 34141.3.diff​:

• Rename $linea to $remote_source for clarity.
• Add 'remote_source' to comment data, so it's available to the 'preprocess_comment' filter.
• Pass comment data to the 'comment_post' filter.

This looks like a sane solution to me.

I don't think we should auto-persist the remote-source but making it available for plugins to use seems like a reasonable idea.

[dshanske]

The only change I was thinking of proposing was that it should be the raw, not the completely altered remote source passed in. The point of resolving this update to a nine year old issue is that a plugin could offer a pingback that is less useless in its display than the default.

[SergeyBiryukov]

Replying to dshanske:

The only change I was thinking of proposing was that it should be the raw, not the completely altered remote source passed in. The point of resolving this update to a nine year old issue is that a plugin could offer a pingback that is less useless in its display than the default.

34141.4.diff​ stores the original response in $remote_source_original and passes it to preprocess_comment and comment_post filters as well.

[dshanske]

I think that addresses everything.

[SergeyBiryukov]

In 36660:

Comments: Pass comment data to the comment_post filter.

Props dshanske.
See #34141.

[SergeyBiryukov]

In 36661:

Comments: In wp_xmlrpc_server::pingback_ping():

• Rename $linea to $remote_source for clarity.
• Add remote_source to comment data, so it's available to preprocess_comment and comment_post filters.
• Pass the original (unfiltered) response source to the filters too (as remote_source_original in comment data).

Props dshanske for the original patch.
Fixes #34141.