From 56d3ae0d16b016be37cde3052411e5c42713d701 Mon Sep 17 00:00:00 2001 From: Peter Wilson Date: Fri, 7 Aug 2026 12:03:27 +1000 Subject: [PATCH 1/6] Self ping auto-approve: update since annotations. --- src/wp-includes/comment.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/wp-includes/comment.php b/src/wp-includes/comment.php index 4ad7d5bbcbcee..dd046578a52e2 100644 --- a/src/wp-includes/comment.php +++ b/src/wp-includes/comment.php @@ -26,7 +26,7 @@ * If all checks pass, the function will return true. * * @since 1.2.0 - * @since 7.2.0 Pingbacks from this site are no longer held for moderation. + * @since 7.1.0 Pingbacks from this site are no longer held for moderation. * * @global wpdb $wpdb WordPress database abstraction object. * @@ -187,7 +187,7 @@ function check_comment( $author, $email, $url, $comment, $user_ip, $user_agent, * site, and false for every other pingback. Trackbacks are never considered, * as they cannot be verified. * - * @since 7.2.0 + * @since 7.1.0 * * @param bool $approve_pingback Whether to approve the pingback. * @param int $source_id ID of the post on this site the pingback From e7bdfaf72fa7744d7a4b058613531db7945ff510 Mon Sep 17 00:00:00 2001 From: Peter Wilson Date: Fri, 7 Aug 2026 12:14:11 +1000 Subject: [PATCH 2/6] Clarify docs. --- src/wp-includes/comment.php | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/wp-includes/comment.php b/src/wp-includes/comment.php index dd046578a52e2..29d5017e64c47 100644 --- a/src/wp-includes/comment.php +++ b/src/wp-includes/comment.php @@ -20,13 +20,13 @@ * If the comment author was approved before, then the comment is automatically * approved. * - * Pingbacks originating from this site are automatically approved, as the link - * they report was created by someone who can already publish here. + * Pingbacks originating from the same site are automatically approved, as the + * link they report was created by someone who can already publish here. * * If all checks pass, the function will return true. * * @since 1.2.0 - * @since 7.1.0 Pingbacks from this site are no longer held for moderation. + * @since 7.1.0 Pingbacks from the same site are no longer held for moderation. * * @global wpdb $wpdb WordPress database abstraction object. * @@ -183,13 +183,13 @@ function check_comment( $author, $email, $url, $comment, $user_ip, $user_agent, /** * Filters whether a pingback is approved without being held for moderation. * - * Defaults to true for pingbacks originating from a published post on this + * Defaults to true for pingbacks originating from a published post on the same * site, and false for every other pingback. Trackbacks are never considered, * as they cannot be verified. * * @since 7.1.0 * - * @param bool $approve_pingback Whether to approve the pingback. + * @param bool $approve_pingback Whether to auto-approve the pingback. * @param int $source_id ID of the post on this site the pingback * originated from, or 0 if it came from elsewhere. * @param string $url The URL the pingback was sent from. From 6740f04be24b40205132e034b004a680743f2cc8 Mon Sep 17 00:00:00 2001 From: Peter Wilson Date: Fri, 7 Aug 2026 12:17:45 +1000 Subject: [PATCH 3/6] Prefix all the things. --- src/wp-includes/comment.php | 2 +- tests/phpunit/tests/comment/checkComment.php | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/wp-includes/comment.php b/src/wp-includes/comment.php index 29d5017e64c47..73289f7959fd7 100644 --- a/src/wp-includes/comment.php +++ b/src/wp-includes/comment.php @@ -194,7 +194,7 @@ function check_comment( $author, $email, $url, $comment, $user_ip, $user_agent, * originated from, or 0 if it came from elsewhere. * @param string $url The URL the pingback was sent from. */ - return (bool) apply_filters( 'auto_approve_pingback', $approve_pingback, $source_id, $url ); + return (bool) apply_filters( 'wp_auto_approve_pingback', $approve_pingback, $source_id, $url ); } else { return false; } diff --git a/tests/phpunit/tests/comment/checkComment.php b/tests/phpunit/tests/comment/checkComment.php index f67efa739f6c1..409a37e12d29d 100644 --- a/tests/phpunit/tests/comment/checkComment.php +++ b/tests/phpunit/tests/comment/checkComment.php @@ -313,7 +313,7 @@ public function test_auto_approve_pingback_should_be_able_to_hold_a_pingback_fro $source_url = get_permalink( self::factory()->post->create() ); - add_filter( 'auto_approve_pingback', '__return_false' ); + add_filter( 'wp_auto_approve_pingback', '__return_false' ); $this->assertFalse( check_comment( 'Site Title', '', $source_url, 'Excerpt.', '192.168.0.1', '', 'pingback' ) ); } @@ -324,7 +324,7 @@ public function test_auto_approve_pingback_should_be_able_to_hold_a_pingback_fro public function test_auto_approve_pingback_should_be_able_to_approve_a_pingback_from_another_site() { update_option( 'comment_previously_approved', '1' ); - add_filter( 'auto_approve_pingback', '__return_true' ); + add_filter( 'wp_auto_approve_pingback', '__return_true' ); $this->assertTrue( check_comment( 'Site Title', '', 'http://example.com/a-post/', 'Excerpt.', '192.168.0.1', '', 'pingback' ) ); } @@ -340,7 +340,7 @@ public function test_auto_approve_pingback_should_receive_the_source_post_id() { $observed = null; add_filter( - 'auto_approve_pingback', + 'wp_auto_approve_pingback', static function ( $approve, $source_id ) use ( &$observed ) { $observed = $source_id; return $approve; From 8723447ea5fae42e9b2227b8ee07748e83cc2fef Mon Sep 17 00:00:00 2001 From: Peter Wilson Date: Fri, 7 Aug 2026 13:11:42 +1000 Subject: [PATCH 4/6] Ensure pingbacks from Multisite sub-sites are not auto approved. --- tests/phpunit/tests/comment/checkComment.php | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/tests/phpunit/tests/comment/checkComment.php b/tests/phpunit/tests/comment/checkComment.php index 409a37e12d29d..862b4841d67b2 100644 --- a/tests/phpunit/tests/comment/checkComment.php +++ b/tests/phpunit/tests/comment/checkComment.php @@ -329,6 +329,24 @@ public function test_auto_approve_pingback_should_be_able_to_approve_a_pingback_ $this->assertTrue( check_comment( 'Site Title', '', 'http://example.com/a-post/', 'Excerpt.', '192.168.0.1', '', 'pingback' ) ); } + /** + * Ensure pingbacks from Multisite sub-sites are not auto approved. + * + * @ticket 65016 + * @group ms-required + */ + public function test_auto_approve_pingback_should_not_approve_from_a_different_ms_site() { + update_option( 'comment_previously_approved', '1' ); + + $new_blog = self::factory()->blog->create(); + + switch_to_blog( $new_blog ); + $source_url = get_permalink( self::factory()->post->create() ); + restore_current_blog(); + + $this->assertFalse( check_comment( 'Site Title', '', $source_url, 'Excerpt.', '192.168.0.1', '', 'pingback' ) ); + } + /** * @ticket 65016 */ From edb33777932ed88f02658b2e64a9a081509dab72 Mon Sep 17 00:00:00 2001 From: Peter Wilson Date: Fri, 7 Aug 2026 13:22:22 +1000 Subject: [PATCH 5/6] Test post ID zero for offsite pings. --- tests/phpunit/tests/comment/checkComment.php | 27 ++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/tests/phpunit/tests/comment/checkComment.php b/tests/phpunit/tests/comment/checkComment.php index 862b4841d67b2..aba481fde83df 100644 --- a/tests/phpunit/tests/comment/checkComment.php +++ b/tests/phpunit/tests/comment/checkComment.php @@ -372,6 +372,33 @@ static function ( $approve, $source_id ) use ( &$observed ) { $this->assertSame( $post_id, $observed ); } + /** + * Ensure the `wp_auto_approve_pingback` filter does not receive a post ID for off-site pings. + * + * @ticket 65016 + */ + public function test_auto_approve_pingback_should_receive_the_post_id_zero_for_off_site_pings() { + update_option( 'comment_previously_approved', '1' ); + + $post_permalink = get_permalink( self::factory()->post->create() ); + $source_url = str_replace( home_url( '/' ), 'http://wordpress.org/', $post_permalink ); + + $observed = null; + add_filter( + 'wp_auto_approve_pingback', + static function ( $approve, $source_id ) use ( &$observed ) { + $observed = $source_id; + return $approve; + }, + 10, + 2 + ); + + check_comment( 'Site Title', '', $source_url, 'Excerpt.', '192.168.0.1', '', 'pingback' ); + + $this->assertSame( 0, $observed ); + } + /** * Data provider. * From 14f0700e0a758710a0b5d692e2ccc68c1b046568 Mon Sep 17 00:00:00 2001 From: Peter Wilson Date: Fri, 7 Aug 2026 13:23:00 +1000 Subject: [PATCH 6/6] Document what the tests do. --- tests/phpunit/tests/comment/checkComment.php | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tests/phpunit/tests/comment/checkComment.php b/tests/phpunit/tests/comment/checkComment.php index aba481fde83df..05a6242facf62 100644 --- a/tests/phpunit/tests/comment/checkComment.php +++ b/tests/phpunit/tests/comment/checkComment.php @@ -306,6 +306,8 @@ public function test_should_return_false_for_a_comment_whose_author_url_is_a_pos } /** + * Test auto approvals can be turned off via the `wp_auto_approve_pingback` filter. + * * @ticket 65016 */ public function test_auto_approve_pingback_should_be_able_to_hold_a_pingback_from_this_site() { @@ -319,6 +321,8 @@ public function test_auto_approve_pingback_should_be_able_to_hold_a_pingback_fro } /** + * Test auto approvals can be turned on via the `wp_auto_approve_pingback` filter. + * * @ticket 65016 */ public function test_auto_approve_pingback_should_be_able_to_approve_a_pingback_from_another_site() { @@ -348,6 +352,8 @@ public function test_auto_approve_pingback_should_not_approve_from_a_different_m } /** + * Ensure the `wp_auto_approve_pingback` filter receives the post ID for same site pings. + * * @ticket 65016 */ public function test_auto_approve_pingback_should_receive_the_source_post_id() {