From 57a80e2c841142026b6c99846241f8af26706a71 Mon Sep 17 00:00:00 2001 From: Rachel Baker Date: Thu, 6 Oct 2016 15:50:55 +0000 Subject: [PATCH] Comments: Improve check for previous comments for authenticated users in `check_comment()`. When the 'comment_whitelist' option is enabled and the commenter is an authenticated user, query for the existence of an approved comment with a matching `user_id`. This allows authenticated users that have changed their email address to bypass having their comment held for moderation. Props voldemortensen, rachelbaker. Fixes #28603. git-svn-id: https://develop.svn.wordpress.org/trunk@38738 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-includes/comment.php | 9 +++- tests/phpunit/tests/comment/checkComment.php | 43 ++++++++++++++++++++ 2 files changed, 50 insertions(+), 2 deletions(-) diff --git a/src/wp-includes/comment.php b/src/wp-includes/comment.php index 861ad6b802..4a3966824e 100644 --- a/src/wp-includes/comment.php +++ b/src/wp-includes/comment.php @@ -110,8 +110,13 @@ function check_comment($author, $email, $url, $comment, $user_ip, $user_agent, $ */ if ( 1 == get_option('comment_whitelist')) { if ( 'trackback' != $comment_type && 'pingback' != $comment_type && $author != '' && $email != '' ) { - // expected_slashed ($author, $email) - $ok_to_comment = $wpdb->get_var("SELECT comment_approved FROM $wpdb->comments WHERE comment_author = '$author' AND comment_author_email = '$email' and comment_approved = '1' LIMIT 1"); + $comment_user = get_user_by( 'email', wp_unslash( $email ) ); + if ( ! empty( $comment_user->ID ) ) { + $ok_to_comment = $wpdb->get_var( $wpdb->prepare( "SELECT comment_approved FROM $wpdb->comments WHERE user_id = %d AND comment_approved = '1' LIMIT 1", $comment_user->ID ) ); + } else { + // expected_slashed ($author, $email) + $ok_to_comment = $wpdb->get_var( $wpdb->prepare( "SELECT comment_approved FROM $wpdb->comments WHERE comment_author = %s AND comment_author_email = %s and comment_approved = '1' LIMIT 1", $author, $email ) ); + } if ( ( 1 == $ok_to_comment ) && ( empty($mod_keys) || false === strpos( $email, $mod_keys) ) ) return true; diff --git a/tests/phpunit/tests/comment/checkComment.php b/tests/phpunit/tests/comment/checkComment.php index 904d5c8399..0bedc4a919 100644 --- a/tests/phpunit/tests/comment/checkComment.php +++ b/tests/phpunit/tests/comment/checkComment.php @@ -127,4 +127,47 @@ class Tests_Comment_CheckComment extends WP_UnitTestCase { $results = check_comment( $author, $author_email, $author_url, $comment, $author_ip, $user_agent, $comment_type ); $this->assertTrue( $results ); } + + /** + * @ticket 28603 + */ + public function test_should_return_true_when_comment_whitelist_is_enabled_and_user_has_previously_approved_comments_with_different_email() { + $subscriber_id = $this->factory()->user->create( array( + 'role' => 'subscriber', + 'email' => 'sub@example.com', + ) ); + + // Make sure comment author has an approved comment. + $this->factory->comment->create( array( 'user_id' => $subscriber_id, 'comment_approved' => '1', 'comment_author' => 'foo', 'comment_author_email' => 'sub@example.com' ) ); + + $subscriber_user = new WP_User( $subscriber_id ); + $subscriber_user->user_email = 'newsub@example.com'; + + wp_update_user( $subscriber_user ); + + update_option( 'comment_whitelist', 1 ); + + $results = check_comment( 'foo', 'newsub@example.com', 'http://example.com', 'This is a comment.', '66.155.40.249', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:35.0) Gecko/20100101 Firefox/35.0', 'comment', 4 ); + $this->assertTrue( $results ); + } + + /** + * @ticket 28603 + */ + public function test_should_return_false_when_comment_whitelist_is_enabled_and_user_does_not_have_a_previously_approved_comment_with_any_email() { + $subscriber_id = $this->factory()->user->create( array( + 'role' => 'subscriber', + 'email' => 'zig@example.com', + ) ); + + $subscriber_user = new WP_User( $subscriber_id ); + $subscriber_user->user_email = 'zag@example.com'; + + wp_update_user( $subscriber_user ); + + update_option( 'comment_whitelist', 1 ); + + $results = check_comment( 'bar', 'zag@example.com', 'http://example.com', 'This is my first comment.', '66.155.40.249', 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:35.0) Gecko/20100101 Firefox/35.0', 'comment', 4 ); + $this->assertFalse( $results ); + } }