[wp-trac] [WordPress Trac] #14601: wp_new_comment method doesn't allow passed in values for IP and user-agent

[WordPress Trac]

#14601: wp_new_comment method doesn't allow passed in values for IP and user-agent
--------------------------------+--------------------------
 Reporter:  mrutz               |       Owner:  rachelbaker
     Type:  enhancement         |      Status:  accepted
 Priority:  normal              |   Milestone:  4.3
Component:  Comments            |     Version:  3.0.1
 Severity:  normal              |  Resolution:
 Keywords:  rest-api has-patch  |     Focuses:
--------------------------------+--------------------------

Comment (by dd32):

 Replying to [comment:32 boonebgorges]:
 > I reviewed all the plugins in the repo that use `wp_new_comment()`
 (there are about 100 of them). The vast majority pass a `$commentdata`
 array to `wp_new_comment()` that doesn't include either a `comment_agent`
 or `comment_author_IP` key. A small handful do include these values, but
 they are fetched from `$_SERVER`. The proposed change wouldn't affect
 these plugins at all.

 Based on that I think it should be safe to add the parameters, and a new
 function shouldn't be needed.

 > I found just two plugins for which the proposed change may introduce
 security issues:

 These two plugins have very few users, however should update their plugins
 to only pass the fields they expect (FYI @Shelob9 & @charlie73)

--
Ticket URL: <https://core.trac.wordpress.org/ticket/14601#comment:35>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform