wordpress-develop/tests/phpunit/tests/comment/slashes.php

<?php

/**
 * @group comment
 * @group slashes
 * @ticket 21767
 */
class Tests_Comment_Slashes extends WP_UnitTestCase {

	/*
	 * It is important to test with both even and odd numbered slashes,
	 * as KSES does a strip-then-add slashes in some of its function calls.
	 */

	const SLASH_1 = 'String with 1 slash \\';
	const SLASH_2 = 'String with 2 slashes \\\\';
	const SLASH_3 = 'String with 3 slashes \\\\\\';
	const SLASH_4 = 'String with 4 slashes \\\\\\\\';
	const SLASH_5 = 'String with 5 slashes \\\\\\\\\\';
	const SLASH_6 = 'String with 6 slashes \\\\\\\\\\\\';
	const SLASH_7 = 'String with 7 slashes \\\\\\\\\\\\\\';

	protected static $author_id;
	protected static $post_id;

	public static function wpSetUpBeforeClass( WP_UnitTest_Factory $factory ) {
		// We need an admin user to bypass comment flood protection.
		self::$author_id = $factory->user->create( array( 'role' => 'administrator' ) );
		self::$post_id   = $factory->post->create();
	}

	public function set_up() {
		parent::set_up();

		wp_set_current_user( self::$author_id );
	}

	/**
	 * Tests the extended model function that expects slashed data.
	 *
	 * @covers ::wp_new_comment
	 */
	public function test_wp_new_comment() {
		$post_id = self::$post_id;

		// Not testing comment_author_email or comment_author_url
		// as slashes are not permitted in that data.
		$data       = array(
			'comment_post_ID'      => $post_id,
			'comment_author'       => self::SLASH_1,
			'comment_author_url'   => '',
			'comment_author_email' => '',
			'comment_type'         => '',
			'comment_content'      => self::SLASH_7,
		);
		$comment_id = wp_new_comment( $data );

		$comment = get_comment( $comment_id );

		$this->assertSame( wp_unslash( self::SLASH_1 ), $comment->comment_author );
		$this->assertSame( wp_unslash( self::SLASH_7 ), $comment->comment_content );

		$data       = array(
			'comment_post_ID'      => $post_id,
			'comment_author'       => self::SLASH_2,
			'comment_author_url'   => '',
			'comment_author_email' => '',
			'comment_type'         => '',
			'comment_content'      => self::SLASH_4,
		);
		$comment_id = wp_new_comment( $data );

		$comment = get_comment( $comment_id );

		$this->assertSame( wp_unslash( self::SLASH_2 ), $comment->comment_author );
		$this->assertSame( wp_unslash( self::SLASH_4 ), $comment->comment_content );
	}

	/**
	 * Tests the controller function that expects slashed data.
	 *
	 * @covers ::edit_comment
	 */
	public function test_edit_comment() {
		$post_id    = self::$post_id;
		$comment_id = self::factory()->comment->create(
			array(
				'comment_post_ID' => $post_id,
			)
		);

		// Not testing comment_author_email or comment_author_url
		// as slashes are not permitted in that data.
		$_POST                            = array();
		$_POST['comment_ID']              = $comment_id;
		$_POST['comment_status']          = '';
		$_POST['newcomment_author']       = self::SLASH_1;
		$_POST['newcomment_author_url']   = '';
		$_POST['newcomment_author_email'] = '';
		$_POST['content']                 = self::SLASH_7;

		$_POST = add_magic_quotes( $_POST ); // The edit_comment() function will strip slashes.

		edit_comment();
		$comment = get_comment( $comment_id );

		$this->assertSame( self::SLASH_1, $comment->comment_author );
		$this->assertSame( self::SLASH_7, $comment->comment_content );

		$_POST                            = array();
		$_POST['comment_ID']              = $comment_id;
		$_POST['comment_status']          = '';
		$_POST['newcomment_author']       = self::SLASH_2;
		$_POST['newcomment_author_url']   = '';
		$_POST['newcomment_author_email'] = '';
		$_POST['content']                 = self::SLASH_4;

		$_POST = add_magic_quotes( $_POST ); // The edit_comment() function will strip slashes.

		edit_comment();
		$comment = get_comment( $comment_id );

		$this->assertSame( self::SLASH_2, $comment->comment_author );
		$this->assertSame( self::SLASH_4, $comment->comment_content );
	}

	/**
	 * Tests the model function that expects slashed data.
	 *
	 * @covers ::wp_insert_comment
	 */
	public function test_wp_insert_comment() {
		$post_id = self::$post_id;

		$comment_id = wp_insert_comment(
			array(
				'comment_post_ID' => $post_id,
				'comment_author'  => self::SLASH_1,
				'comment_content' => self::SLASH_7,
			)
		);
		$comment    = get_comment( $comment_id );

		$this->assertSame( wp_unslash( self::SLASH_1 ), $comment->comment_author );
		$this->assertSame( wp_unslash( self::SLASH_7 ), $comment->comment_content );

		$comment_id = wp_insert_comment(
			array(
				'comment_post_ID' => $post_id,
				'comment_author'  => self::SLASH_2,
				'comment_content' => self::SLASH_4,
			)
		);
		$comment    = get_comment( $comment_id );

		$this->assertSame( wp_unslash( self::SLASH_2 ), $comment->comment_author );
		$this->assertSame( wp_unslash( self::SLASH_4 ), $comment->comment_content );
	}

	/**
	 * Tests the model function that expects slashed data.
	 *
	 * @covers ::wp_update_comment
	 */
	public function test_wp_update_comment() {
		$post_id    = self::$post_id;
		$comment_id = self::factory()->comment->create(
			array(
				'comment_post_ID' => $post_id,
			)
		);

		wp_update_comment(
			array(
				'comment_ID'      => $comment_id,
				'comment_author'  => self::SLASH_1,
				'comment_content' => self::SLASH_7,
			)
		);
		$comment = get_comment( $comment_id );

		$this->assertSame( wp_unslash( self::SLASH_1 ), $comment->comment_author );
		$this->assertSame( wp_unslash( self::SLASH_7 ), $comment->comment_content );

		wp_update_comment(
			array(
				'comment_ID'      => $comment_id,
				'comment_author'  => self::SLASH_2,
				'comment_content' => self::SLASH_4,
			)
		);
		$comment = get_comment( $comment_id );

		$this->assertSame( wp_unslash( self::SLASH_2 ), $comment->comment_author );
		$this->assertSame( wp_unslash( self::SLASH_4 ), $comment->comment_content );
	}
}