XML-RPC: Return an error when a comment field exceeds the maximum length - #12822
XML-RPC: Return an error when a comment field exceeds the maximum length#12822amanawasthi2025 wants to merge 1 commit into
Conversation
…gth. The comment form (`wp_handle_comment_submission()`) and the REST API comments controller both validate comment fields against `wp_check_comment_data_max_lengths()` before inserting, but the XML-RPC `wp.newComment` path never called the validator, so over-long fields were silently truncated at the database layer instead of the client receiving an error. Validate the fully assembled comment in `wp_xmlrpc_server::wp_newComment()` — covering both the logged-in and anonymous flows — and return an `IXR_Error` 413, reusing the REST API's existing error string. Includes tests for each over-long field (author, author email, author URL, content) in both flows, plus an at-the-limit acceptance case. Fixes #38622. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
Test using WordPress PlaygroundThe changes in this pull request can previewed and tested using a WordPress Playground instance. WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser. Some things to be aware of
For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation. |
1 participant
Trac ticket: https://core.trac.wordpress.org/ticket/38622
What
wp_xmlrpc_server::wp_newComment()now validates the assembled comment withwp_check_comment_data_max_lengths()— after both the logged-in and anonymous flows have filled in the author fields, and beforewp_new_comment()runs — and returns anIXR_Error413 when any field exceeds its column limit (author 245, author email 100, author URL 200, content 65525 bytes).Why
The comment form (
wp_handle_comment_submission(), #10377) and the REST API comments controller both perform this validation; the XML-RPC path never did. Becausewpdbstrips strict SQL modes, over-long fields were silently truncated at the database layer and the client received a success response with a comment ID.Design notes:
Comment field exceeds maximum length allowed.) instead of the form-path messages, which embed<strong>markup unsuitable for an XML-RPC fault string. No new translatable strings.38622.diff, which no longer apply cleanly).wp_magic_quotes()-slashed$_POST.@since 7.2.0assumes a post-7.1 landing; adjust on commit if milestoned differently.Tests
tests/phpunit/tests/xmlrpc/wp/newComment.php:test_new_comment_with_field_exceeding_max_length(data provider: author 246 / email 101 / URL 201 / content 65526) — red on trunk without the src change: each call returns a comment ID and the field is silently truncated.test_new_comment_with_content_exceeding_max_length_logged_in— same symptom via the authenticated flow.test_new_comment_with_fields_at_max_length— all fields exactly at their limits are still accepted.PHPCS reports no issues on either changed file.
🤖 Generated with Claude Code