sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Comments: Improve check for previous comments for authenticated users in check_comment().

Browse Source 
When the 'comment_whitelist' option is enabled and the commenter is an authenticated user, query for the existence of an approved comment with a matching `user_id`.  This allows authenticated users that have changed their email address to bypass having their comment held for moderation.

Props voldemortensen, rachelbaker.
Fixes #28603.

git-svn-id: https://develop.svn.wordpress.org/trunk@38738 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Rachel Baker 2016-10-06 15:50:55 +00:00
parent b8ddcea510
commit 57a80e2c84
2 changed files with 50 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/wp-includes/comment.php
View File

@ -110,8 +110,13 @@ function check_comment($author, $email, $url, $comment, $user_ip, $user_agent, $
*/
if ( 1 == get_option('comment_whitelist')) {
if ( 'trackback' != $comment_type && 'pingback' != $comment_type && $author != '' && $email != '' ) {
// expected_slashed ($author, $email)
$ok_to_comment = $wpdb->get_var("SELECT comment_approved FROM $wpdb->comments WHERE comment_author = '$author' AND comment_author_email = '$email' and comment_approved = '1' LIMIT 1");
$comment_user = get_user_by( 'email', wp_unslash( $email ) );
if ( ! empty( $comment_user->ID ) ) {
$ok_to_comment = $wpdb->get_var( $wpdb->prepare( "SELECT comment_approved FROM $wpdb->comments WHERE user_id = %d AND comment_approved = '1' LIMIT 1", $comment_user->ID ) );
} else {
// expected_slashed ($author, $email)
$ok_to_comment = $wpdb->get_var( $wpdb->prepare( "SELECT comment_approved FROM $wpdb->comments WHERE comment_author = %s AND comment_author_email = %s and comment_approved = '1' LIMIT 1", $author, $email ) );
}
if ( ( 1 == $ok_to_comment ) &&
( empty($mod_keys) || false === strpos( $email, $mod_keys) ) )
return true;

43
tests/phpunit/tests/comment/checkComment.php
View File

@ -127,4 +127,47 @@ class Tests_Comment_CheckComment extends WP_UnitTestCase {
$results = check_comment( $author, $author_email, $author_url, $comment, $author_ip, $user_agent, $comment_type );
$this->assertTrue( $results );
}
/**
* @ticket 28603
*/
public function test_should_return_true_when_comment_whitelist_is_enabled_and_user_has_previously_approved_comments_with_different_email() {
$subscriber_id = $this->factory()->user->create( array(
'role' => 'subscriber',
'email' => 'sub@example.com',
) );
// Make sure comment author has an approved comment.
$this->factory->comment->create( array( 'user_id' => $subscriber_id, 'comment_approved' => '1', 'comment_author' => 'foo', 'comment_author_email' => 'sub@example.com' ) );
$subscriber_user = new WP_User( $subscriber_id );
$subscriber_user->user_email = 'newsub@example.com';
wp_update_user( $subscriber_user );
update_option( 'comment_whitelist', 1 );
$results = check_comment( 'foo', 'newsub@example.com', 'http://example.com', 'This is a comment.', '66.155.40.249', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:35.0) Gecko/20100101 Firefox/35.0', 'comment', 4 );
$this->assertTrue( $results );
}
/**
* @ticket 28603
*/
public function test_should_return_false_when_comment_whitelist_is_enabled_and_user_does_not_have_a_previously_approved_comment_with_any_email() {
$subscriber_id = $this->factory()->user->create( array(
'role' => 'subscriber',
'email' => 'zig@example.com',
) );
$subscriber_user = new WP_User( $subscriber_id );
$subscriber_user->user_email = 'zag@example.com';
wp_update_user( $subscriber_user );
update_option( 'comment_whitelist', 1 );
$results = check_comment( 'bar', 'zag@example.com', 'http://example.com', 'This is my first comment.', '66.155.40.249', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:35.0) Gecko/20100101 Firefox/35.0', 'comment', 4 );
$this->assertFalse( $results );
}
}