Automattic / Automattic/jetpack

Comments: comment submission does not works on HTTP sites for logged in users

Open
#16,065 4 comments 0 reactions 0 assignees View on GitHub
[Feature] Comments [Pri] Normal Bug
Dominant language
PHP
Stars
1.8k
Forks
898
Avg merge
1d 18h
Merged PRs (30d)
774

Description

#### Steps to reproduce the issue

Start on a site using HTTP, and connected to WordPress.com.

1. Go to Jetpack > Settings > Discussion, and enable Jetpack Comments.
2. View one of your posts on the frontend.
3. Try leaving a comment. Jetpack's comment form should indicate that you are commenting using your logged in user account.
4. When the comment is submitter, you get an error back:
`Error: Please fill the required fields (name, email).`
https://github.com/WordPress/WordPress/blob/9f86174e0832bc046724092c669065810f6473c5/wp-includes/comment.php#L3384-L3385

********

It seems that Jetpack's comment form finds the logged in user just fine here: https://github.com/Automattic/jetpack/blob/c2b55eadb5dfb3b2779f41d73fbc1f101bab5604/modules/comments/comments.php#L265
Info about the logged in user is correctly passed to the comments iFrame here:
https://github.com/Automattic/jetpack/blob/c2b55eadb5dfb3b2779f41d73fbc1f101bab5604/modules/comments/comments.php#L306
- When you do submit the comment, however, if you examine the request headers of the POST request to `site/wp-comments-post.php?for=jetpack`, you'll notice that only 2 cookies are passed along with the request: `cookie: wordpress_test_cookie=WP+Cookie+check; __unam=a-unique-id`
- On a site using HTTPS, WordPress' authentication cookies are passed along as well: `cookie: wordpress_test_cookie=WP%20Cookie%20check; wp-settings-1=libraryContent%3Dbrowse; wp-settings-time-1=1588341172; wordpress_logged_in_uniqueid=uniqueid; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_uniqueid=uniqueid; comment_author_uniqueid=jeherve; comment_author_email_uniqueid=myemail@address.com; tk_qs=; tk_tc=uniqueid; tk_ai=uniqueid`

Originally reported in #15696.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue on an HTTP site, then read modules/comments/comments.php around lines 265 and 306 and inspect the POST request to wp-comments-post.php?for=jetpack. Compare the cookies and logged-in user data sent over HTTP and HTTPS. Done means a logged-in user can submit a Jetpack comment on HTTP without the required-fields error.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.