Skip to content

Commit

Permalink
Use SCRIPT_NAME instead of REQUEST_URI to check path
Browse files Browse the repository at this point in the history
The script is currently checking if the `REQUEST_URI` is containing
`wp-comments-post.php`, the default script to handle the submission
of a comment. Some security plugins have options to rename this file
to disguise that WordPress is used.

With this fix, the `SCRIPT_NAME` is used instead. Since many security
plugins do use rewrite rules, while the `REQUEST_URI` value is changed,
the `SCRIPT_NAME` value stays the same. Therefore the condition would
still recognize if a comment was submitted.

Fixes #585
  • Loading branch information
2ndkauboy committed May 6, 2024
1 parent cb75530 commit 230bbcd
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions antispam_bee.php
Original file line number Diff line number Diff line change
Expand Up @@ -1134,7 +1134,7 @@ public static function precheck_incoming_request() {
return;
}

$request_uri = self::get_key( $_SERVER, 'REQUEST_URI' );
$request_uri = self::get_key( $_SERVER, 'SCRIPT_NAME' );
$request_path = self::parse_url( $request_uri, 'path' );

if ( strpos( $request_path, 'wp-comments-post.php' ) === false ) {
Expand Down Expand Up @@ -1168,7 +1168,7 @@ public static function precheck_incoming_request() {
public static function handle_incoming_request( $comment ) {
$comment['comment_author_IP'] = self::get_client_ip();

$request_uri = self::get_key( $_SERVER, 'REQUEST_URI' );
$request_uri = self::get_key( $_SERVER, 'SCRIPT_NAME' );
$request_path = self::parse_url( $request_uri, 'path' );

if ( empty( $request_path ) ) {
Expand Down

0 comments on commit 230bbcd

Please sign in to comment.