Automattic / Automattic/jetpack
Comments: comment submission does not works on HTTP sites for logged in users
- Dominant language
- PHP
- Stars
- 1.8k
- Forks
- 898
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 774
Description
#### Steps to reproduce the issue
Start on a site using HTTP, and connected to WordPress.com.
1. Go to Jetpack > Settings > Discussion, and enable Jetpack Comments.
2. View one of your posts on the frontend.
3. Try leaving a comment. Jetpack's comment form should indicate that you are commenting using your logged in user account.
4. When the comment is submitter, you get an error back:
`Error: Please fill the required fields (name, email).`
https://github.com/WordPress/WordPress/blob/9f86174e0832bc046724092c669065810f6473c5/wp-includes/comment.php#L3384-L3385
********
It seems that Jetpack's comment form finds the logged in user just fine here: https://github.com/Automattic/jetpack/blob/c2b55eadb5dfb3b2779f41d73fbc1f101bab5604/modules/comments/comments.php#L265
Info about the logged in user is correctly passed to the comments iFrame here:
https://github.com/Automattic/jetpack/blob/c2b55eadb5dfb3b2779f41d73fbc1f101bab5604/modules/comments/comments.php#L306
- When you do submit the comment, however, if you examine the request headers of the POST request to `site/wp-comments-post.php?for=jetpack`, you'll notice that only 2 cookies are passed along with the request: `cookie: wordpress_test_cookie=WP+Cookie+check; __unam=a-unique-id`
- On a site using HTTPS, WordPress' authentication cookies are passed along as well: `cookie: wordpress_test_cookie=WP%20Cookie%20check; wp-settings-1=libraryContent%3Dbrowse; wp-settings-time-1=1588341172; wordpress_logged_in_uniqueid=uniqueid; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_uniqueid=uniqueid; comment_author_uniqueid=jeherve; comment_author_email_uniqueid=myemail@address.com; tk_qs=; tk_tc=uniqueid; tk_ai=uniqueid`
Originally reported in #15696.
Contributor guide
Research direction
Start by reproducing the issue on an HTTP site, then read modules/comments/comments.php around lines 265 and 306 and inspect the POST request to wp-comments-post.php?for=jetpack. Compare the cookies and logged-in user data sent over HTTP and HTTPS. Done means a logged-in user can submit a Jetpack comment on HTTP without the required-fields error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100