Make WordPress Core

Opened 4 months ago

Last modified 4 months ago

#62066 assigned defect (bug)

Weird ability to modify comments to be empty

Reported by: lbones's profile lbones Owned by: lela-bones's profile Lela Bones
Milestone: Awaiting Review Priority: normal
Severity: minor Version:
Component: Comments Keywords:
Focuses: rest-api Cc:

Description (last modified by sabernhardt)

When I was viewing ticket #61244, I originally misinterpreted the issue. I thought that the user wanted to avoid exporting comments that have no content, but I realized that isn't actually allowed through the WordPress editor.

However, I was trying to recreate the empty comment issue, and realized that users are able to edit comments to be empty.

I did some initial digging and WP_REST_Comments_Controller has a create_item that contains this check:

		// Do not allow comments to be created with a non-default type.
		if ( ! empty( $request['type'] ) && 'comment' !== $request['type'] ) {
			return new WP_Error(
				'rest_invalid_comment_type',
				__( 'Cannot create a comment with that type.' ),
				array( 'status' => 400 )
			);
		}

and an update_item() function. I think that adding this or something similar to the update_item function would resolve this issue.

Attachments (1)

Screen Shot 2024-09-17 at 3.22.52 PM.png (272.8 KB) - added by lbones 4 months ago.
This is in PHP 8.2 and WP 6.6.2, and it shows that you can edit comments to be null.

Download all attachments as: .zip

Change History (4)

@lbones
4 months ago

This is in PHP 8.2 and WP 6.6.2, and it shows that you can edit comments to be null.

#1 @sabernhardt
4 months ago

  • Component changed from Posts, Post Types to Comments
  • Description modified (diff)
  • Focuses rest-api added
  • Keywords changes-requested removed

#2 @sabernhardt
4 months ago

  • Keywords needs-patch removed

Hi and welcome to WordPress Core Trac!

There are reasons to allow empty comments, especially when removing something, but the allow_empty_comment hook is false by default.

Related: #16979, r49303, ticket:58168#comment:4

#3 @hellofromTonya
4 months ago

  • Version 6.6.2 deleted

Doing triage today for tickets flagging 6.6.x as the version that introduced the reported issue. Tested with 6.3 and can edit to remove the comment's content. Removing the Version, as it predates 6.6.

Note: See TracTickets for help on using tickets.