diff --git a/src/wp-includes/class-wp-xmlrpc-server.php b/src/wp-includes/class-wp-xmlrpc-server.php index 7d64d3f46c019..6d83f3fed3799 100644 --- a/src/wp-includes/class-wp-xmlrpc-server.php +++ b/src/wp-includes/class-wp-xmlrpc-server.php @@ -3902,6 +3902,7 @@ public function wp_editComment( $args ) { * Creates a new comment. * * @since 2.7.0 + * @since 7.2.0 Returns an error if a comment field exceeds its maximum length. * * @param array $args { * Method arguments. Note: arguments must be ordered as documented. @@ -4028,6 +4029,12 @@ public function wp_newComment( $args ) { return new IXR_Error( 403, __( 'Comment is required.' ) ); } + $check_max_lengths = wp_check_comment_data_max_lengths( $comment ); + + if ( is_wp_error( $check_max_lengths ) ) { + return new IXR_Error( 413, __( 'Comment field exceeds maximum length allowed.' ) ); + } + /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */ do_action( 'xmlrpc_call', 'wp.newComment', $args, $this ); diff --git a/tests/phpunit/tests/xmlrpc/wp/newComment.php b/tests/phpunit/tests/xmlrpc/wp/newComment.php index 00b0617f53839..c1c76e44cf028 100644 --- a/tests/phpunit/tests/xmlrpc/wp/newComment.php +++ b/tests/phpunit/tests/xmlrpc/wp/newComment.php @@ -389,4 +389,107 @@ public function data_comments_observe_post_permissions() { ), ); } + + /** + * Ensure an error is returned when a comment field exceeds its maximum length. + * + * @ticket 38622 + * + * @dataProvider data_new_comment_with_field_exceeding_max_length + * + * @param array $content_struct Content struct with one field exceeding its maximum length. + */ + public function test_new_comment_with_field_exceeding_max_length( $content_struct ) { + add_filter( 'xmlrpc_allow_anonymous_comments', '__return_true' ); + + $result = $this->myxmlrpcserver->wp_newComment( + array( + 1, + '', + '', + self::$posts['publish']->ID, + $content_struct, + ) + ); + + $this->assertIXRError( $result ); + $this->assertSame( 413, $result->code ); + } + + /** + * Data provider for test_new_comment_with_field_exceeding_max_length. + * + * @return array[] + */ + public function data_new_comment_with_field_exceeding_max_length() { + $defaults = array( + 'author' => 'WordPress', + 'author_email' => 'noreply@wordpress.org', + 'content' => 'Test Comment', + ); + + return array( + 'author of 246 characters' => array( + array_merge( $defaults, array( 'author' => str_repeat( 'a', 246 ) ) ), + ), + 'author email of 101 characters' => array( + array_merge( $defaults, array( 'author_email' => str_repeat( 'a', 89 ) . '@example.com' ) ), + ), + 'author URL of 201 characters' => array( + array_merge( $defaults, array( 'author_url' => 'https://example.com/' . str_repeat( 'a', 181 ) ) ), + ), + 'content of 65526 characters' => array( + array_merge( $defaults, array( 'content' => str_repeat( 'a', 65526 ) ) ), + ), + ); + } + + /** + * Ensure an error is returned when a logged-in user's comment content exceeds its maximum length. + * + * @ticket 38622 + */ + public function test_new_comment_with_content_exceeding_max_length_logged_in() { + $result = $this->myxmlrpcserver->wp_newComment( + array( + 1, + 'administrator', + 'administrator', + self::$posts['publish']->ID, + array( + 'content' => str_repeat( 'a', 65526 ), + ), + ) + ); + + $this->assertIXRError( $result ); + $this->assertSame( 413, $result->code ); + } + + /** + * Ensure a comment with all fields at their maximum length is accepted. + * + * @ticket 38622 + */ + public function test_new_comment_with_fields_at_max_length() { + add_filter( 'xmlrpc_allow_anonymous_comments', '__return_true' ); + + $result = $this->myxmlrpcserver->wp_newComment( + array( + 1, + '', + '', + self::$posts['publish']->ID, + array( + 'author' => str_repeat( 'a', 245 ), + 'author_email' => str_repeat( 'a', 88 ) . '@example.com', + 'author_url' => 'https://example.com/' . str_repeat( 'a', 180 ), + 'content' => str_repeat( 'a', 65525 ), + ), + ) + ); + + $this->assertNotIXRError( $result ); + $this->assertIsInt( $result ); + } }