WordPress.org

Make WordPress Core

Opened 12 years ago

Closed 12 years ago

Last modified 11 years ago

#7821 closed defect (bug) (fixed)

Automatic links in comments should not bypass "Hold a comment in the queue if it contains x or more links"

Reported by: lloydbudd Owned by: tott
Milestone: 2.7 Priority: normal
Severity: normal Version: 2.7
Component: General Keywords: spam, moderation, has-patch
Focuses: Cc:

Description

Automatic links in comments should not bypass "Hold a comment in the queue if it contains x or more links"

ENV: WP trunk r9039 (2.7-hemorrhage)

WordPress will automatically link domains like 'www.example.com' in comments. Currently, those automatically link domains are not counted towards "Hold a comment in the queue if it contains x or more links", and so a comment with only automatically linked domains will not end up in moderation.

This seems to be ripe for abuse by spammers, if they are not already taking advantage of it.

Attachments (2)

patch_comment_moderation_link_count.diff (748 bytes) - added by tott 12 years ago.
patch wp-includes/comment.php against rev:9196
patch_comment_moderation_link_count.2.diff (780 bytes) - added by tott 12 years ago.
revised patch against current trunk rev 10383

Download all attachments as: .zip

Change History (15)

#1 @tott
12 years ago

  • Owner changed from anonymous to tott

@tott
12 years ago

patch wp-includes/comment.php against rev:9196

#2 @tott
12 years ago

  • Keywords has-patch added

#3 follow-up: @westi
12 years ago

  • Keywords has-patch removed

I can't see that this patch achieves anything worthwhile.

The make_clickable function which makes those unlinked urls into links in run on display not save of the comment.

I understand that the current link counter will not count links which have no http on the front so we need a fix for that issue.

#4 in reply to: ↑ 3 @lloydbudd
12 years ago

  • Keywords has-patch added
  • Version set to 2.7

Replying to westi:

I can't see that this patch achieves anything worthwhile.

The make_clickable function which makes those unlinked urls into links in run on display not save of the comment.

The scenario is whether or not the comments go into moderation, not whether the links are clickable. I just tested latest trunk (r9266) without and then with the patch, and with the patch the comments with unlinked domains are correctly are put in moderation.

#5 @markjaquith
12 years ago

  • Resolution set to fixed
  • Status changed from new to closed

(In [9782]) Count links in comments after performing automatic linking. props tott. fixes #7821

#6 @mtdewvirus
12 years ago

  • Resolution fixed deleted
  • Status changed from closed to reopened

Causes problems with emoticons. #8627

#7 @thee17
12 years ago

  • Resolution set to fixed
  • Status changed from reopened to closed

Create new patch for 2.8 if need be but since this was fixxed in 2.7 it should remain closed

@tott
12 years ago

revised patch against current trunk rev 10383

#8 @tott
12 years ago

  • Resolution fixed deleted
  • Status changed from closed to reopened

double checked attachment:ticket:7821:patch_comment_moderation_link_count.2.diff against current trunk. neither the problems mentioned in #8627 nor the effect mentioned in #7268 appear.

please reconsider applying this revised version of the original patch.

#9 follow-up: @DD32
12 years ago

[Aa][^>]*[Hh][Rr][Ee][Ff]

Err... Wouldnt just setting the i flag be much cleaner.... (i = PCRE case insensitive)

#10 in reply to: ↑ 9 @tott
12 years ago

Replying to DD32:

[Aa][^>]*[Hh][Rr][Ee][Ff]

Err... Wouldnt just setting the i flag be much cleaner.... (i = PCRE case insensitive)

indeed... that's right. /i should do the job, too

#11 @ryan
12 years ago

  • Resolution set to fixed
  • Status changed from reopened to closed

(In [10453]) Don't count emoticons toward link total. Props tott. fixes #8627 #7821 for trunk

#12 @ryan
12 years ago

(In [10454]) Don't count emoticons toward link total. Props tott. fixes #8627 #7821 for 2.7

#13 @miqrogroove
11 years ago

This was reopened and therefore not fixed in 2.7. Can the milestone be updated so that we know which version is working?

Note: See TracTickets for help on using tickets.