Make WordPress Core

Opened 16 years ago

Closed 15 years ago

Last modified 15 years ago

#7821 closed defect (bug) (fixed)

Automatic links in comments should not bypass "Hold a comment in the queue if it contains x or more links"

Reported by: lloydbudd's profile lloydbudd Owned by: tott's profile tott
Milestone: 2.7 Priority: normal
Severity: normal Version: 2.7
Component: General Keywords: spam, moderation, has-patch
Focuses: Cc:

Description

Automatic links in comments should not bypass "Hold a comment in the queue if it contains x or more links"

ENV: WP trunk r9039 (2.7-hemorrhage)

WordPress will automatically link domains like 'www.example.com' in comments. Currently, those automatically link domains are not counted towards "Hold a comment in the queue if it contains x or more links", and so a comment with only automatically linked domains will not end up in moderation.

This seems to be ripe for abuse by spammers, if they are not already taking advantage of it.

Attachments (2)

patch_comment_moderation_link_count.diff (748 bytes) - added by tott 16 years ago.
patch wp-includes/comment.php against rev:9196
patch_comment_moderation_link_count.2.diff (780 bytes) - added by tott 15 years ago.
revised patch against current trunk rev 10383

Download all attachments as: .zip

Change History (15)

#1 @tott
16 years ago

  • Owner changed from anonymous to tott

@tott
16 years ago

patch wp-includes/comment.php against rev:9196

#2 @tott
16 years ago

  • Keywords has-patch added

#3 follow-up: @westi
15 years ago

  • Keywords has-patch removed

I can't see that this patch achieves anything worthwhile.

The make_clickable function which makes those unlinked urls into links in run on display not save of the comment.

I understand that the current link counter will not count links which have no http on the front so we need a fix for that issue.

#4 in reply to: ↑ 3 @lloydbudd
15 years ago

  • Keywords has-patch added
  • Version set to 2.7

Replying to westi:

I can't see that this patch achieves anything worthwhile.

The make_clickable function which makes those unlinked urls into links in run on display not save of the comment.

The scenario is whether or not the comments go into moderation, not whether the links are clickable. I just tested latest trunk (r9266) without and then with the patch, and with the patch the comments with unlinked domains are correctly are put in moderation.

#5 @markjaquith
15 years ago

  • Resolution set to fixed
  • Status changed from new to closed

(In [9782]) Count links in comments after performing automatic linking. props tott. fixes #7821

#6 @mtdewvirus
15 years ago

  • Resolution fixed deleted
  • Status changed from closed to reopened

Causes problems with emoticons. #8627

#7 @thee17
15 years ago

  • Resolution set to fixed
  • Status changed from reopened to closed

Create new patch for 2.8 if need be but since this was fixxed in 2.7 it should remain closed

@tott
15 years ago

revised patch against current trunk rev 10383

#8 @tott
15 years ago

  • Resolution fixed deleted
  • Status changed from closed to reopened

double checked attachment:ticket:7821:patch_comment_moderation_link_count.2.diff against current trunk. neither the problems mentioned in #8627 nor the effect mentioned in #7268 appear.

please reconsider applying this revised version of the original patch.

#9 follow-up: @DD32
15 years ago

[Aa][^>]*[Hh][Rr][Ee][Ff]

Err... Wouldnt just setting the i flag be much cleaner.... (i = PCRE case insensitive)

#10 in reply to: ↑ 9 @tott
15 years ago

Replying to DD32:

[Aa][^>]*[Hh][Rr][Ee][Ff]

Err... Wouldnt just setting the i flag be much cleaner.... (i = PCRE case insensitive)

indeed... that's right. /i should do the job, too

#11 @ryan
15 years ago

  • Resolution set to fixed
  • Status changed from reopened to closed

(In [10453]) Don't count emoticons toward link total. Props tott. fixes #8627 #7821 for trunk

#12 @ryan
15 years ago

(In [10454]) Don't count emoticons toward link total. Props tott. fixes #8627 #7821 for 2.7

#13 @miqrogroove
15 years ago

This was reopened and therefore not fixed in 2.7. Can the milestone be updated so that we know which version is working?

Note: See TracTickets for help on using tickets.