XML-RPC wp_newComment should return an error when a field exceeds the maximum length

[rachelbaker]

We return a WP_Error in wp_handle_comment_submission() when the comment content, author name, author email, or author url exceeds the maximum length of its respective database column. See #10377.

We should do the same in the XML-RPC wp_newComment() method.

[rachelbaker]

Related #38477

[desrosj]

Marking this as good first bug, but a lower priority.

[kingkero]

Added max lengths check via the wp_check_comment_data_max_lengths() function. Respect the $avoid_die flag with the same logic that wp_allow_comment() uses

<!--
Hi there! Thanks for contributing to WordPress!

Pull Requests in this GitHub repository must be linked to a ticket in the WordPress Core Trac instance (​https://core.trac.wordpress.org), and are only used for code review. No pull requests will be merged on GitHub.

See the WordPress Handbook page on using PRs for Code Review more information: ​https://make.wordpress.org/core/handbook/contribute/git/github-pull-requests-for-code-review/

If this is your first time contributing, you may also find reviewing these guides first to be helpful:

• FAQs for New Contributors: ​https://make.wordpress.org/core/handbook/tutorials/faq-for-new-contributors/
• Contributing with Code Guide: ​https://make.wordpress.org/core/handbook/contribute/
• WordPress Coding Standards: ​https://make.wordpress.org/core/handbook/best-practices/coding-standards/
• Inline Documentation Standards: ​https://make.wordpress.org/core/handbook/best-practices/inline-documentation-standards/
• Browser Support Policies: ​https://make.wordpress.org/core/handbook/best-practices/browser-support/
• Proper spelling and grammar related best practices: ​https://make.wordpress.org/core/handbook/best-practices/spelling/

-->

I have applied the patch from this ticket and fixed at bug when posting a comment via xmlrpc. Anon posting was missing the content_type which resulted in an error.

Trac ticket: https://core.trac.wordpress.org/ticket/38622

<!--
Hi there! Thanks for contributing to WordPress!

Pull Requests in this GitHub repository must be linked to a ticket in the WordPress Core Trac instance (​https://core.trac.wordpress.org), and are only used for code review. No pull requests will be merged on GitHub.

See the WordPress Handbook page on using PRs for Code Review more information: ​https://make.wordpress.org/core/handbook/contribute/git/github-pull-requests-for-code-review/

If this is your first time contributing, you may also find reviewing these guides first to be helpful:

• FAQs for New Contributors: ​https://make.wordpress.org/core/handbook/tutorials/faq-for-new-contributors/
• Contributing with Code Guide: ​https://make.wordpress.org/core/handbook/contribute/
• WordPress Coding Standards: ​https://make.wordpress.org/core/handbook/best-practices/coding-standards/
• Inline Documentation Standards: ​https://make.wordpress.org/core/handbook/best-practices/inline-documentation-standards/
• Browser Support Policies: ​https://make.wordpress.org/core/handbook/best-practices/browser-support/
• Proper spelling and grammar related best practices: ​https://make.wordpress.org/core/handbook/best-practices/spelling/

-->

I have applied the patch from this ticket and fixed at bug when posting a comment via xmlrpc. Anon posting was missing the content_type which resulted in an error. Fixed phpcs issues also.

Trac ticket: https://core.trac.wordpress.org/ticket/38622

<!--
Hi there! Thanks for contributing to WordPress!

Pull Requests in this GitHub repository must be linked to a ticket in the WordPress Core Trac instance (​https://core.trac.wordpress.org), and are only used for code review. No pull requests will be merged on GitHub.

See the WordPress Handbook page on using PRs for Code Review more information: ​https://make.wordpress.org/core/handbook/contribute/git/github-pull-requests-for-code-review/

If this is your first time contributing, you may also find reviewing these guides first to be helpful:

• FAQs for New Contributors: ​https://make.wordpress.org/core/handbook/tutorials/faq-for-new-contributors/
• Contributing with Code Guide: ​https://make.wordpress.org/core/handbook/contribute/
• WordPress Coding Standards: ​https://make.wordpress.org/core/handbook/best-practices/coding-standards/
• Inline Documentation Standards: ​https://make.wordpress.org/core/handbook/best-practices/inline-documentation-standards/
• Browser Support Policies: ​https://make.wordpress.org/core/handbook/best-practices/browser-support/
• Proper spelling and grammar related best practices: ​https://make.wordpress.org/core/handbook/best-practices/spelling/

-->

I have applied the patch from this ticket and fixed at bug when posting a comment via xmlrpc. Anon posting was missing the content_type which resulted in an error. Fixed phpcs issues also.

Trac ticket: https://core.trac.wordpress.org/ticket/38622

[sorenbronsted]

Sorry that my PR messed up the this comment section. PR #180 state says 'undefined' but on ​https://github.com/WordPress/wordpress-develop/pull/180 it says 'all checks has passed' so the state on this ticket is not reflected correctly.

[sorenbronsted]

I incorrectly set wrong keywords

Applied patch
Trac ticket: https://core.trac.wordpress.org/ticket/38622

[hellofromTonya]

Merge conflicts exist in the PR. Marking for refresh.

## What

wp_xmlrpc_server::wp_newComment() now validates the assembled comment with wp_check_comment_data_max_lengths() — after both the logged-in and anonymous flows have filled in the author fields, and before wp_new_comment() runs — and returns an IXR_Error 413 when any field exceeds its column limit (author 245, author email 100, author URL 200, content 65525 bytes).

## Why

The comment form (wp_handle_comment_submission(), #10377) and the REST API comments controller both perform this validation; the XML-RPC path never did. Because wpdb strips strict SQL modes, over-long fields were silently truncated at the database layer and the client received a success response with a comment ID.

Design notes:

• The error message reuses the REST controller's existing string (Comment field exceeds maximum length allowed.) instead of the form-path messages, which embed <strong> markup unsuitable for an XML-RPC fault string. No new translatable strings.
• Fault code 413 follows the ticket's original 2019/2020 patches (this PR supersedes PRs #178/#179/#180/#194 and 38622.diff, which no longer apply cleanly).
• The check runs on slashed data, matching how the form path validates wp_magic_quotes()-slashed $_POST.
• @since 7.2.0 assumes a post-7.1 landing; adjust on commit if milestoned differently.

## Tests

tests/phpunit/tests/xmlrpc/wp/newComment.php:

• test_new_comment_with_field_exceeding_max_length (data provider: author 246 / email 101 / URL 201 / content 65526) — red on trunk without the src change: each call returns a comment ID and the field is silently truncated.
• test_new_comment_with_content_exceeding_max_length_logged_in — same symptom via the authenticated flow.
• test_new_comment_with_fields_at_max_length — all fields exactly at their limits are still accepted.

npm run test:php -- tests/phpunit/tests/xmlrpc/wp/newComment.php   # 28 tests, 50 assertions, OK
npm run test:php -- --group xmlrpc                                 # 324 tests, 1258 assertions, OK

PHPCS reports no issues on either changed file.

🤖 Generated with ​Claude Code