[wp-trac] [WordPress Trac] #49956: Spammers able to share unmoderated comments

[WordPress Trac]

#49956: Spammers able to share unmoderated comments
--------------------------+------------------------------
 Reporter:  jonkolbert    |       Owner:  (none)
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  Comments      |     Version:  5.1
 Severity:  major         |  Resolution:
 Keywords:                |     Focuses:
--------------------------+------------------------------
Changes (by ayeshrajans):

 * severity:  normal => major


Comment:

 Welcome to WordPress trac @jonkolbert.
 This is pretty interesting issue, and this certainly looks like a clever
 way to spam any WordPress site!

 I suppose the fix would be two-fold:

  - When a comment is placed by a user/spammer, we need to verify it is the
 same user that placed the comment. A cookie is placed in the users browser
 (it's OK if it's the same cookie throughout the session). When the same
 user opens the comment URL of an un-approved comment, the cookie must be
 present too.

  - For admins, we don't check the cookie, but check a different hash
 value.

 I'd be happy to work on a prototype patch if others agree that this
 approach is ideal.

 Marking severity=major because it can circumvent the moderation queue in a
 way that benefits spammers.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/49956#comment:2>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform