WordPress/wp-includes
Peter Wilson a77704f1a3 Comments: Prevent replying to unapproved comments.
Introduces client and server side validation to ensure the `replytocom` query string parameter can not be exploited to reply to an unapproved comment or display the name of an unapproved commenter.

This only affects commenting via the front end of the site. Comment replies via the dashboard continue their current behaviour of logging the reply and approving the parent comment.

Introduces the `$post` parameter, defaulting to the current global post, to `get_cancel_comment_reply_link()` and `comment_form_title()`.

Introduces `_get_comment_reply_id()` for determining the comment reply ID based on the `replytocom` query string parameter.

Renames the parameter `$post_id` to `$post` in `get_comment_id_fields()` and `comment_id_fields()` to accept either a post ID or `WP_Post` object.

Adds a new `WP_Error` return state to `wp_handle_comment_submission()` to prevent replies to unapproved comments. The error code is `comment_reply_to_unapproved_comment` with the message `Sorry, replies to unapproved comments are not allowed.`.

Props costdev, jrf, hellofromtonya, fasuto, boniu91, milana_cap.
Fixes #53962.

Built from https://develop.svn.wordpress.org/trunk@55369


git-svn-id: http://core.svn.wordpress.org/trunk@54902 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2023-02-21 01:45:24 +00:00
..
assets Backport editor changes from Gutenberg for WordPress 6.2 Beta 3 2023-02-20 13:29:05 +00:00
block-patterns
block-supports Editor: svn add new files missed in [55285]. 2023-02-07 18:11:18 +00:00
blocks Block Editor: Updates the WordPress packages with all the fixes targetted for WP 6.2 beta1. 2023-02-07 13:00:09 +00:00
certificates
css Editor: Update @wordpress packages for 6.2 Beta 2. 2023-02-14 15:44:36 +00:00
customize I18N: Mark screen reader strings as such with translator comments. 2023-02-07 17:10:21 +00:00
fonts
html-api Docs: Replace short array syntax in WP_HTML_Tag_Processor documentation. 2023-02-10 10:59:25 +00:00
ID3 External Libraries: Update getID3 to version 1.9.22. 2022-10-04 02:08:11 +00:00
images
IXR Code Modernization: Use correct property in IXR_Message::tag_open(). 2023-01-20 01:36:10 +00:00
js Backport editor changes from Gutenberg for WordPress 6.2 Beta 3 2023-02-20 13:29:05 +00:00
php-compat Code Modernization: Rename parameters that use reserved keywords in wp-includes/php-compat/readonly.php. 2022-12-08 19:31:17 +00:00
PHPMailer External Libraries: Upgrade PHPMailer to version 6.7. 2022-12-06 12:19:15 +00:00
pomo Code Modernization: Rename parameters that use reserved keywords in wp-includes/pomo/streams.php. 2022-12-12 20:21:12 +00:00
random_compat
Requests HTTP API: Adds BC-layer /library/Requests.php file. 2022-12-19 15:12:11 +00:00
rest-api REST API: Normalize WP_REST_Server::dispatch() to return a response object. 2023-02-17 15:45:24 +00:00
SimplePie
sitemaps HTTP API: Fix request header inconsistencies. 2023-02-03 13:35:20 +00:00
sodium_compat Upgrade/Install: Update sodium_compat to v1.19.0. 2022-09-26 14:00:10 +00:00
style-engine Editor: Introduce minimum height dimensions block support. 2023-02-01 16:15:15 +00:00
Text
theme-compat Coding Standards: Various brace indentation corrections. 2022-11-26 21:01:17 +00:00
widgets I18N: Mark screen reader strings as such with translator comments. 2023-02-07 17:10:21 +00:00
admin-bar.php I18N: Mark screen reader strings as such with translator comments. 2023-02-07 17:10:21 +00:00
atomlib.php
author-template.php Users: Make wp_list_authors() and wp_list_users() filterable. 2022-09-20 16:26:10 +00:00
block-editor.php Editor: Fix 'wp-block-library-theme' style enqueue conditions. 2023-02-20 21:13:27 +00:00
block-i18n.json
block-patterns.php Editor: Support the block_types and viewport_width props for remote patterns fetched from Pattern Directory. 2023-02-06 19:40:16 +00:00
block-template-utils.php Editor: Remove need for template prefix in get_template_hierarchy. 2023-02-02 19:38:19 +00:00
block-template.php Themes: Use add_action for pre_get_posts hook in _add_template_loader_filters(). 2023-02-14 15:57:21 +00:00
blocks.php Code Modernization: Rename parameters that use reserved keywords in wp-includes/blocks.php. 2023-01-24 14:42:17 +00:00
bookmark-template.php
bookmark.php
cache-compat.php Cache API: Introduce wp_cache_supports() function. 2022-10-10 18:22:11 +00:00
cache.php Cache API: Introduce wp_cache_supports() function. 2022-10-10 18:22:11 +00:00
canonical.php Docs: Improve code comments in some sanitizing functions. 2023-02-15 13:06:21 +00:00
capabilities.php Coding Standards: Always use parentheses when instantiating an object. 2022-11-29 15:51:14 +00:00
category-template.php Docs: Use consistent format for the @return tags in _wp_object_name_sort_cb() and _wp_object_count_sort_cb(). 2023-02-04 15:18:16 +00:00
category.php
class-feed.php
class-http.php
class-IXR.php
class-json.php HTTP API: Fix request header inconsistencies. 2023-02-03 13:35:20 +00:00
class-oembed.php
class-phpass.php External Libraries: Prevent a PHP 8.1 deprecation notice in PasswordHash::gensalt_blowfish(). 2023-02-13 09:08:23 +00:00
class-phpmailer.php
class-pop3.php Mail: Check that set_time_limit() function is available before using it in class-pop3.php. 2023-02-11 12:43:22 +00:00
class-requests.php External Libraries: Update Requests library to version 2.0.0. 2022-12-15 21:32:17 +00:00
class-simplepie.php HTTP API: Fix request header inconsistencies. 2023-02-03 13:35:20 +00:00
class-smtp.php
class-snoopy.php HTTP API: Fix request header inconsistencies. 2023-02-03 13:35:20 +00:00
class-walker-category-dropdown.php
class-walker-category.php
class-walker-comment.php
class-walker-nav-menu.php Privacy: Add rel="privacy-policy" to the Privacy Policy link. 2023-02-07 14:05:20 +00:00
class-walker-page-dropdown.php
class-walker-page.php
class-wp-admin-bar.php Coding Standards: Always use parentheses when instantiating an object. 2022-11-29 15:51:14 +00:00
class-wp-ajax-response.php
class-wp-application-passwords.php
class-wp-block-editor-context.php
class-wp-block-list.php
class-wp-block-parser.php Block Editor: Updated the WordPress packages to include Gutenberg 15.1.0 changes. 2023-02-07 07:04:52 +00:00
class-wp-block-pattern-categories-registry.php
class-wp-block-patterns-registry.php Docs: Document the inserter property in WP_Block_Patterns_Registry::register(). 2023-02-01 15:29:13 +00:00
class-wp-block-styles-registry.php
class-wp-block-supports.php Block editor: Add ID support to block wrapper attributes. 2023-02-06 15:24:16 +00:00
class-wp-block-template.php
class-wp-block-type-registry.php
class-wp-block-type.php Coding Standards: Always use strict type check for in_array(). 2022-11-29 21:00:14 +00:00
class-wp-block.php Docs: Improve various globals documentation, as per documentation standards. 2022-11-23 21:30:13 +00:00
class-wp-comment-query.php
class-wp-comment.php
class-wp-customize-control.php I18N: Mark screen reader strings as such with translator comments. 2023-02-07 17:10:21 +00:00
class-wp-customize-manager.php I18N: Mark screen reader strings as such with translator comments. 2023-02-07 17:10:21 +00:00
class-wp-customize-nav-menus.php I18N: Mark screen reader strings as such with translator comments. 2023-02-07 17:10:21 +00:00
class-wp-customize-panel.php I18N: Mark screen reader strings as such with translator comments. 2023-02-07 17:10:21 +00:00
class-wp-customize-section.php I18N: Mark screen reader strings as such with translator comments. 2023-02-07 17:10:21 +00:00
class-wp-customize-setting.php Code Modernization: Add AllowDynamicProperties attribute to all (parent) classes. 2022-09-12 15:47:14 +00:00
class-wp-customize-widgets.php I18N: Mark screen reader strings as such with translator comments. 2023-02-07 17:10:21 +00:00
class-wp-date-query.php Docs: Document the usage of $wpdb global in WP_Date_Query methods. 2022-11-08 13:29:16 +00:00
class-wp-dependencies.php Docs: Correct the type for _WP_Dependency::$src property. 2022-11-25 15:12:16 +00:00
class-wp-dependency.php Docs: Correct the type for _WP_Dependency::$src property. 2022-11-25 15:12:16 +00:00
class-wp-editor.php I18N: Mark screen reader strings as such with translator comments. 2023-02-07 17:10:21 +00:00
class-wp-embed.php Coding Standards: Rename $post_ID variable to $post_id in various files. 2023-02-19 15:05:22 +00:00
class-wp-error.php
class-wp-fatal-error-handler.php
class-wp-feed-cache-transient.php
class-wp-feed-cache.php
class-wp-hook.php
class-wp-http-cookie.php
class-wp-http-curl.php
class-wp-http-encoding.php
class-wp-http-ixr-client.php
class-wp-http-proxy.php Docs: Align spelling with American English. 2022-10-21 21:12:14 +00:00
class-wp-http-requests-hooks.php External Libraries: Update Requests library to version 2.0.0. 2022-12-15 21:32:17 +00:00
class-wp-http-requests-response.php External Libraries: Update Requests library to version 2.0.0. 2022-12-15 21:32:17 +00:00
class-wp-http-response.php
class-wp-http-streams.php HTTP API: Correct the documentation for the https_ssl_verify and https_local_ssl_verify filters. 2023-01-13 14:22:12 +00:00
class-wp-http.php HTTP API: Correct the documentation for the https_ssl_verify and https_local_ssl_verify filters. 2023-01-13 14:22:12 +00:00
class-wp-image-editor-gd.php
class-wp-image-editor-imagick.php Media: Use strict comparison in make_subsize(). 2023-02-08 20:51:21 +00:00
class-wp-image-editor.php Media: ensure the wp_editor_set_quality filter consistently passes the correct output mime type. 2022-10-07 19:17:12 +00:00
class-wp-list-util.php Docs: Update various DocBlocks and inline comments per the documentation standards. 2022-11-17 18:15:19 +00:00
class-wp-locale-switcher.php Docs: Correct @since tag for WP_Locale_Switcher::$stack. 2023-02-08 17:08:21 +00:00
class-wp-locale.php I18N: Check that $wp_locale global is set before calling its methods. 2023-02-15 23:37:17 +00:00
class-wp-matchesmapregex.php
class-wp-meta-query.php Docs: Use third-person singular verbs for WP_Meta_Query related function descriptions, as per docblocks standards. 2023-02-13 09:21:18 +00:00
class-wp-metadata-lazyloader.php
class-wp-network-query.php Networks and Sites: Revert the use of the metadata API for *_network_options functions. 2022-10-18 18:16:16 +00:00
class-wp-network.php
class-wp-object-cache.php Docs: Increase the specificity of various property documentation. 2022-09-26 22:10:16 +00:00
class-wp-oembed-controller.php Docs: Document the usage of globals in some functions. 2022-11-13 13:51:20 +00:00
class-wp-oembed.php Embeds: Use documented mixcloud.com oembed endpoint. 2023-02-07 03:10:18 +00:00
class-wp-paused-extensions-storage.php
class-wp-post-type.php Docs: Increase the specificity of various property documentation. 2022-09-26 22:10:16 +00:00
class-wp-post.php
class-wp-query.php Taxonomy: Implement wp_cache_get_multiple in wp_queue_posts_for_term_meta_lazyload. 2023-02-07 12:10:18 +00:00
class-wp-recovery-mode-cookie-service.php Security: Additional translations of salt default phrase. 2022-10-04 03:59:13 +00:00
class-wp-recovery-mode-email-service.php I18N: Introduce switch_to_user_locale(). 2023-01-30 10:27:16 +00:00
class-wp-recovery-mode-key-service.php
class-wp-recovery-mode-link-service.php
class-wp-recovery-mode.php
class-wp-rewrite.php Docs: Various docblock fixes in WP_Rewrite class, as per documentation standards. 2022-10-04 23:01:13 +00:00
class-wp-role.php
class-wp-roles.php Role/Capability: Revert the newly added update_role function for 6.1. 2022-10-24 14:56:16 +00:00
class-wp-scripts.php I18N: Use correct default value for JavaScript translations path. 2022-09-28 22:19:10 +00:00
class-wp-session-tokens.php
class-wp-simplepie-file.php
class-wp-simplepie-sanitize-kses.php
class-wp-site-query.php Networks and Sites: Revert the use of the metadata API for *_network_options functions. 2022-10-18 18:16:16 +00:00
class-wp-site.php
class-wp-styles.php Script Loader: Prevent double space between attributes in WP_Styles class. 2022-09-28 14:59:10 +00:00
class-wp-tax-query.php Docs: Improve various globals documentation, as per documentation standards. 2022-11-23 21:30:13 +00:00
class-wp-taxonomy.php Docs: Improve various globals documentation, as per documentation standards. 2022-11-26 09:39:13 +00:00
class-wp-term-query.php Taxonomy: Remove placeholder from WP_Term_Query cache key. 2023-01-18 09:58:16 +00:00
class-wp-term.php
class-wp-text-diff-renderer-inline.php Code Modernization: Allow some parameters with reserved keywords in wp-includes/class-wp-text-diff-renderer-*.php. 2023-01-30 15:24:13 +00:00
class-wp-text-diff-renderer-table.php I18N: Mark screen reader strings as such with translator comments. 2023-02-07 17:10:21 +00:00
class-wp-textdomain-registry.php Docs: Use correct 6.2.0 @since version in multiple docblocks. 2023-02-15 22:56:20 +00:00
class-wp-theme-json-data.php Code Modernization: Add AllowDynamicProperties attribute to recently introduced classes. 2022-10-11 15:00:12 +00:00
class-wp-theme-json-resolver.php Themes: Revert appearance tools theme support. 2023-02-07 16:44:24 +00:00
class-wp-theme-json-schema.php
class-wp-theme-json.php Docs: Use correct 6.2.0 @since version in multiple docblocks. 2023-02-15 22:56:20 +00:00
class-wp-theme.php Docs: Add a @since note about Twenty Twenty-Three for WP_Theme::$default_themes. 2023-02-14 14:38:22 +00:00
class-wp-user-meta-session-tokens.php
class-wp-user-query.php Query: Don't attempt caching if running a WP_User_Query before plugins_loaded. 2022-11-08 17:31:13 +00:00
class-wp-user-request.php
class-wp-user.php Coding Standards: Always use parentheses when instantiating an object. 2022-11-29 15:51:14 +00:00
class-wp-walker.php
class-wp-widget-factory.php
class-wp-widget.php
class-wp-xmlrpc-server.php Coding Standards: Rename $post_ID variable to $post_id in various files. 2023-02-19 15:05:22 +00:00
class-wp.php Bootstrap/Load: Correct sending the X-Pingback header in WP::send_headers(). 2022-10-18 16:11:16 +00:00
class-wpdb.php Database: Replace substr_compare() usage with substr() in wpdb::prepare(). 2023-01-28 20:58:12 +00:00
class.wp-dependencies.php
class.wp-scripts.php
class.wp-styles.php
comment-template.php Comments: Prevent replying to unapproved comments. 2023-02-21 01:45:24 +00:00
comment.php Comments: Prevent replying to unapproved comments. 2023-02-21 01:45:24 +00:00
compat.php Coding Standards: Allow some parameters with reserved keywords in wp-includes/compat.php. 2023-01-25 01:40:12 +00:00
cron.php Docs: Miscellaneous improvements and corrections to docblocks. 2023-02-07 21:21:18 +00:00
date.php
default-constants.php
default-filters.php Widgets: Preserve classic sidebars when switching to a block theme. 2023-02-03 00:15:21 +00:00
default-widgets.php
deprecated.php Coding Standards: Rename $post_ID variable to $post_id in various files. 2023-02-19 15:05:22 +00:00
embed-template.php
embed.php
error-protection.php
feed-atom-comments.php Coding Standards: Various brace indentation corrections. 2022-11-26 21:01:17 +00:00
feed-atom.php
feed-rdf.php
feed-rss2-comments.php Coding Standards: Rename $comment_ID variable to $comment_id in various files. 2023-02-12 18:08:21 +00:00
feed-rss2.php
feed-rss.php
feed.php
formatting.php Docs: Improve code comments in some sanitizing functions. 2023-02-15 13:06:21 +00:00
functions.php Date/Time: Revert mysql2date changes in [55343]. 2023-02-15 02:02:16 +00:00
functions.wp-scripts.php Docs: Use third-person singular verbs for Script Loader related function descriptions, as per docblocks standards. 2023-01-15 14:57:13 +00:00
functions.wp-styles.php Docs: Use third-person singular verbs for Script Loader related function descriptions, as per docblocks standards. 2023-01-15 14:57:13 +00:00
general-template.php I18N: Mark screen reader strings as such with translator comments. 2023-02-07 17:10:21 +00:00
global-styles-and-settings.php Editor: Add support for custom CSS in global styles. 2023-02-02 18:52:17 +00:00
http.php External Libraries: Update Requests library to version 2.0.0. 2022-12-15 21:32:17 +00:00
https-detection.php
https-migration.php
kses.php Formatting: Add aspect-ratio as valid CSS property in KSES. 2023-02-13 08:47:21 +00:00
l10n.php I18N: Check that $wp_locale global is set before calling its methods. 2023-02-15 23:37:17 +00:00
link-template.php Coding Standards: Improve variables names in post and comment page link functions. 2023-02-18 15:09:18 +00:00
load.php Bootstrap/Load: Check that either mysqli_connect() or mysql_connect() is available. 2023-02-20 16:05:19 +00:00
locale.php
media-template.php I18N: Mark screen reader strings as such with translator comments. 2023-02-07 17:10:21 +00:00
media.php Media: Enhance logic to determine LCP image in block themes and avoid lazy-loading it. 2023-02-13 18:34:17 +00:00
meta.php Docs: Correct parameter name for deleted_{$meta_type}meta action. 2022-10-13 17:24:15 +00:00
ms-blogs.php Editor: Use a non-persistent object cache instead of transient in wp_get_global_stylesheet(). 2023-01-26 23:03:14 +00:00
ms-default-constants.php
ms-default-filters.php
ms-deprecated.php Docs: Improve various globals documentation, as per documentation standards. 2022-12-09 11:54:13 +00:00
ms-files.php
ms-functions.php I18N: Introduce switch_to_user_locale(). 2023-01-30 10:27:16 +00:00
ms-load.php Coding Standards: Always use parentheses when instantiating an object. 2022-11-29 15:51:14 +00:00
ms-network.php Networks and Sites: Revert the use of the metadata API for *_network_options functions. 2022-10-18 18:16:16 +00:00
ms-settings.php
ms-site.php Code Modernization: Rename parameters that use reserved keywords in wp-includes/ms-site.php. 2022-12-07 21:19:19 +00:00
nav-menu-template.php Coding Standards: Replace strval() with (string) type casting in wp_nav_menu(). 2023-02-16 00:04:21 +00:00
nav-menu.php Docs: Use correct 6.2.0 @since version in multiple docblocks. 2023-02-15 22:56:20 +00:00
option.php Options, Meta APIs: Add a filter to allow the shortcut return to wp_load_alloptions function. 2023-02-07 12:49:17 +00:00
pluggable-deprecated.php
pluggable.php Coding Standards: Rename $comment_ID variable to $comment_id in various files. 2023-02-12 18:08:21 +00:00
plugin.php
post-formats.php
post-template.php Media: Introduce wp_get_attachment_link_attributes filter. 2023-02-07 14:35:23 +00:00
post-thumbnail-template.php Media: Allow for customization of lazy-loading featured images. 2023-01-19 07:34:14 +00:00
post.php Coding Standards: Rename $post_ID variable to $post_id in various files. 2023-02-19 15:05:22 +00:00
query.php Code Modernization: Rename parameters that use reserved keywords in wp-includes/query.php. 2022-12-13 12:26:15 +00:00
registration-functions.php
registration.php
rest-api.php Docs: Miscellaneous improvements and corrections to docblocks. 2023-02-07 21:21:18 +00:00
revision.php Revisions: Add a way to filter the revisions considered for deletion. 2023-02-07 12:39:17 +00:00
rewrite.php Code Modernization: Rename parameters that use reserved keywords in wp-includes/rewrite.php. 2022-12-15 11:03:11 +00:00
robots-template.php
rss-functions.php
rss.php Feeds: Fix various typos in MagpieRSS. 2023-02-14 16:06:21 +00:00
script-loader.php Editor: Fix 'wp-block-library-theme' style enqueue conditions. 2023-02-20 21:13:27 +00:00
session.php
shortcodes.php Code Modernization: Rename parameters that use reserved keywords in phpunit/tests/shortcode.php. 2023-01-23 16:35:12 +00:00
sitemaps.php
spl-autoload-compat.php
style-engine.php
taxonomy.php Coding Standards: Rename the remaining $cat_ID variables to $cat_id. 2023-02-14 15:46:18 +00:00
template-canvas.php
template-loader.php
template.php Code Modernization: Rename parameters that use reserved keywords in wp-includes/template.php. 2022-12-22 11:08:19 +00:00
theme-i18n.json Editor: Introduce spacing presets in global style properties. 2022-09-21 11:43:13 +00:00
theme-templates.php Coding Standards: Rename $post_ID variable to $post_id in various files. 2023-02-19 15:05:22 +00:00
theme.json Themes: Add shadow presets support for theme.json. 2023-02-01 18:07:12 +00:00
theme.php Widgets: Preserve classic sidebars when switching to a block theme. 2023-02-03 00:15:21 +00:00
update.php Coding Standards: Always use parentheses when instantiating an object. 2022-11-29 15:51:14 +00:00
user.php Users: Correct the error code in wp_insert_user() when login matches an existing email. 2023-02-17 10:15:22 +00:00
vars.php
version.php Comments: Prevent replying to unapproved comments. 2023-02-21 01:45:24 +00:00
widgets.php Widgets: Preserve classic sidebars when switching to a block theme. 2023-02-03 00:15:21 +00:00
wlwmanifest.xml
wp-db.php
wp-diff.php