automattic / safe-report-comments Goto Github PK

Either a different hook (back compat risk), or better regex.

I note primarily because Twenty Twenty runs some code there that makes our regex not match. But it's unclear to the user that there's an issue and just looks broken.

We don't explicitly state it anywhere but it should be GPLv2.

I discovered this while working on #13. I believe I confirmed it's not a regression, but would welcome confirmation.

Issue

When re-flagging a comment, I do not get the expected "already flagged" message.

Reproduce

1. Activate the plugin on a site running any default theme but Twenty Twenty (#14).
2. Add an approve at least one comment for testing on.
3. View the comment on the front-end and click "Report Comment"
4. Note you'll get a sfrc_flags cookie value something like this eyIxOTAzMCI6MX0%3D

The problem is during unserialization

Problem one is the base64 decoding leaves a trailing character

wp> $base64 = base64_decode( 'eyIxOTAzMCI6MX0%3D' )
=> string(12) "{"19030":1}7"

Which then prevents json decoding

wp> json_decode( $base64 );
=> NULL

Because the data ends up as null (which is "cleaned" into an empty array), our comment isn't found in the data so is not considered "already flagged".

Note: It may be difficult to fully see this on the front-end due to the transients fallback. Conditional blocks at