Skip to content

Commit 89c8f79

Browse files
audrasjbaudrasjb
committed
Comments: Apply kses when editing comments.
Props davidbaumwald, xknown, peterwilsoncc, paulkevan. git-svn-id: https://develop.svn.wordpress.org/trunk@54527 602fd350-edb4-49c9-b593-d223f7449a82
1 parent 2ca28e4 commit 89c8f79

File tree

3 files changed

+105
-0
lines changed

3 files changed

+105
-0
lines changed

‎src/wp-includes/comment.php‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2499,6 +2499,15 @@ function wp_update_comment( $commentarr, $wp_error = false ) {
24992499
}
25002500
}
25012501

2502+
$filter_comment = false;
2503+
if ( ! has_filter( 'pre_comment_content', 'wp_filter_kses' ) ) {
2504+
$filter_comment = ! user_can( isset( $comment['user_id'] ) ? $comment['user_id'] : 0, 'unfiltered_html' );
2505+
}
2506+
2507+
if ( $filter_comment ) {
2508+
add_filter( 'pre_comment_content', 'wp_filter_kses' );
2509+
}
2510+
25022511
// Escape data pulled from DB.
25032512
$comment = wp_slash( $comment );
25042513

@@ -2509,6 +2518,10 @@ function wp_update_comment( $commentarr, $wp_error = false ) {
25092518

25102519
$commentarr = wp_filter_comment( $commentarr );
25112520

2521+
if ( $filter_comment ) {
2522+
remove_filter( 'pre_comment_content', 'wp_filter_kses' );
2523+
}
2524+
25122525
// Now extract the merged array.
25132526
$data = wp_unslash( $commentarr );
25142527

‎tests/phpunit/tests/comment.php‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,90 @@ public function test_wp_update_comment() {
8181
$this->assertEquals( $post2->ID, $comment->comment_post_ID );
8282
}
8383

84+
public function test_update_comment_from_privileged_user_by_privileged_user() {
85+
$admin_id_1 = self::factory()->user->create( array( 'role' => 'administrator' ) );
86+
wp_set_current_user( $admin_id_1 );
87+
88+
$comment_id = wp_new_comment(
89+
array(
90+
'comment_post_ID' => self::$post_id,
91+
'comment_author' => 'Author',
92+
'comment_author_url' => 'http://example.localhost/',
93+
'comment_author_email' => '[email protected]',
94+
'user_id' => $admin_id_1,
95+
'comment_content' => 'This is a comment',
96+
)
97+
);
98+
99+
wp_set_current_user( 0 );
100+
101+
$admin_id_2 = self::factory()->user->create(
102+
array(
103+
'role' => 'administrator',
104+
'user_login' => 'test_wp_admin_get',
105+
'user_pass' => 'password',
106+
'user_email' => '[email protected]',
107+
)
108+
);
109+
110+
wp_set_current_user( $admin_id_2 );
111+
112+
wp_update_comment(
113+
array(
114+
'comment_ID' => $comment_id,
115+
'comment_content' => 'new comment <img onerror=demo src=x>',
116+
)
117+
);
118+
119+
$comment = get_comment( $comment_id );
120+
$expected_content = is_multisite()
121+
? 'new comment '
122+
: 'new comment <img onerror=demo src=x>';
123+
124+
$this->assertSame( $expected_content, $comment->comment_content );
125+
126+
wp_set_current_user( 0 );
127+
}
128+
129+
public function test_update_comment_from_unprivileged_user_by_privileged_user() {
130+
wp_set_current_user( self::$user_id );
131+
132+
$comment_id = wp_new_comment(
133+
array(
134+
'comment_post_ID' => self::$post_id,
135+
'comment_author' => 'Author',
136+
'comment_author_url' => 'http://example.localhost/',
137+
'comment_author_email' => '[email protected]',
138+
'user_id' => self::$user_id,
139+
'comment_content' => '<a href="http://example.localhost/something.html">click</a>',
140+
)
141+
);
142+
143+
wp_set_current_user( 0 );
144+
145+
$admin_id = self::factory()->user->create(
146+
array(
147+
'role' => 'administrator',
148+
'user_login' => 'test_wp_admin_get',
149+
'user_pass' => 'password',
150+
'user_email' => '[email protected]',
151+
)
152+
);
153+
154+
wp_set_current_user( $admin_id );
155+
156+
wp_update_comment(
157+
array(
158+
'comment_ID' => $comment_id,
159+
'comment_content' => '<a href="http://example.localhost/something.html" disallowed=attribute>click</a>',
160+
)
161+
);
162+
163+
$comment = get_comment( $comment_id );
164+
$this->assertEquals( '<a href="http://example.localhost/something.html" rel="nofollow ugc">click</a>', $comment->comment_content, 'Comment: ' . $comment->comment_content );
165+
wp_set_current_user( 0 );
166+
}
167+
84168
/**
85169
* @ticket 30627
86170
*

‎tests/phpunit/tests/rest-api/rest-comments-controller.php‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2972,6 +2972,7 @@ public function test_comment_roundtrip_as_editor_unfiltered_html() {
29722972
'content' => '<div>div</div> <strong>strong</strong> <script>oh noes</script>',
29732973
'author_name' => '<div>div</div> <strong>strong</strong> <script>oh noes</script>',
29742974
'author_user_agent' => '<div>div</div> <strong>strong</strong> <script>oh noes</script>',
2975+
'author' => self::$editor_id,
29752976
),
29762977
array(
29772978
'content' => array(
@@ -2980,6 +2981,7 @@ public function test_comment_roundtrip_as_editor_unfiltered_html() {
29802981
),
29812982
'author_name' => 'div strong',
29822983
'author_user_agent' => 'div strong',
2984+
'author' => self::$editor_id,
29832985
)
29842986
);
29852987
} else {
@@ -2989,6 +2991,7 @@ public function test_comment_roundtrip_as_editor_unfiltered_html() {
29892991
'content' => '<div>div</div> <strong>strong</strong> <script>oh noes</script>',
29902992
'author_name' => '<div>div</div> <strong>strong</strong> <script>oh noes</script>',
29912993
'author_user_agent' => '<div>div</div> <strong>strong</strong> <script>oh noes</script>',
2994+
'author' => self::$editor_id,
29922995
),
29932996
array(
29942997
'content' => array(
@@ -2997,6 +3000,7 @@ public function test_comment_roundtrip_as_editor_unfiltered_html() {
29973000
),
29983001
'author_name' => 'div strong',
29993002
'author_user_agent' => 'div strong',
3003+
'author' => self::$editor_id,
30003004
)
30013005
);
30023006
}
@@ -3011,6 +3015,7 @@ public function test_comment_roundtrip_as_superadmin() {
30113015
'content' => '\\\&\\\ &amp; &invalid; < &lt; &amp;lt;',
30123016
'author_name' => '\\\&\\\ &amp; &invalid; < &lt; &amp;lt;',
30133017
'author_user_agent' => '\\\&\\\ &amp; &invalid; < &lt; &amp;lt;',
3018+
'author' => self::$superadmin_id,
30143019
),
30153020
array(
30163021
'content' => array(
@@ -3019,6 +3024,7 @@ public function test_comment_roundtrip_as_superadmin() {
30193024
),
30203025
'author_name' => '\\\&amp;\\\ &amp; &amp;invalid; &lt; &lt; &amp;lt;',
30213026
'author_user_agent' => '\\\&\\\ &amp; &invalid; &lt; &lt; &amp;lt;',
3027+
'author' => self::$superadmin_id,
30223028
)
30233029
);
30243030
}
@@ -3032,6 +3038,7 @@ public function test_comment_roundtrip_as_superadmin_unfiltered_html() {
30323038
'content' => '<div>div</div> <strong>strong</strong> <script>oh noes</script>',
30333039
'author_name' => '<div>div</div> <strong>strong</strong> <script>oh noes</script>',
30343040
'author_user_agent' => '<div>div</div> <strong>strong</strong> <script>oh noes</script>',
3041+
'author' => self::$superadmin_id,
30353042
),
30363043
array(
30373044
'content' => array(
@@ -3040,6 +3047,7 @@ public function test_comment_roundtrip_as_superadmin_unfiltered_html() {
30403047
),
30413048
'author_name' => 'div strong',
30423049
'author_user_agent' => 'div strong',
3050+
'author' => self::$superadmin_id,
30433051
)
30443052
);
30453053
}

0 commit comments

Comments
 (0)