![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Opened 10 years ago
Last modified 9 years ago
#36058 reviewing defect (bug)
PHP notices and invalid "View Post" link on edit-comments.php when post type does not exist
| Reported by: | boonebgorges | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | Future Release |
| Component: | Comments | Version: | |
| Severity: | normal | Keywords: | |
| Cc: | Focuses: | administration |
Description
Steps to reproduce:
- Register a custom post type
- Create a post
- Create a comment on that post
- Stop registering the post type
- Visit wp-admin/edit-comments.php
The markup built in WP_Comments_List_Table::column_response() for the "In Response To" column requires a valid post permalink, as well as the post type label corresponding to "View Post". Since permalinks to non-existent CPT objects cannot be valid, and since non-existent CPTs don't have any post type labels, it seems to me that we can probably bail out of this method early if the post type doesn't exist.
Similarly, column_date() probably shouldn't attempt to link to the post if the post type doesn't exist.
Attachments (2)
Change History (10)
#3
in reply to: ↑ 2
@
10 years ago
Replying to SergeyBiryukov:
Yeah - #34918 and #16956 are about cap checks specifically, which, in addition to PHP notices and the like, can lead to privilege escalation in certain cases.
The current ticket is about whether various bits of the comment UX should be linked to the post permalink, when the post permalink can necessarily never be visited.
If we decide, as per #34918, that comments from non-existent post types should never be shown anywhere, then it will solve the current problem :) But if we decide to keep the rows, then we should fix/remove the links.
36058.diff is a suggested fix. It changes both the In Response To and Submitted On columns to plain, unlinked text when the post type doesn't exist.