Trailing whitespace – again, in comments module

Hi there,

similar to https://wordpress.org/support/topic/trailing-whitespace-2/ I’m having issues with comments not going through if there are trailing whitespaces in the author or comment field (the only fields we use here). [Edit: This is about the WP-Comments, not CF7 as in the linked topic]
Apparently this is something that mobile phones tend to do – adding a whitespace after each word, which is why we’ve had 7 out of 10 comments fail this morning.

I was able to fix it locally with a small mu-plugin that’s basically using the way the CF7 integration is doing it already:

add_filter('mosparo_integration_comments_form_data', function ($formData) { foreach (['comment', 'author', 'email', 'url'] as $field) { if (isset($_POST[$field]) && !is_array($_POST[$field])) { $formData[$field] = wp_unslash((string) $_POST[$field]); } } return $formData; }, 20);

Here’s what AI has to say about the problem:

The Comments module is the only module that does not verify the raw submitted values. CommentForm::verifyComment() runs on the pre_comment_approved filter and builds the verification data from $commentData (comment_content, comment_author, …). At that point WordPress has already modified these values:

1. wp_handle_comment_submission() applies trim() to comment, author, email and url.
2. wp_new_comment() calls wp_filter_comment() before pre_comment_approved fires. That applies the pre_comment_content filters (wp_filter_kses: & becomes &amp;, </> become entities, tags are stripped; wp_rel_ugc; wp_encode_emoji on non-utf8mb4 databases) and sanitize_text_field() / sanitize_email() / esc_url_raw() to the author fields – plus whatever third-party plugins do on preprocess_comment.

The mosparo frontend JS, however, hashed the raw field values at check-form-data time. Any single-character difference makes the verify hash comparison fail, the field is treated as manipulated, and the module returns spam – regardless of the actual spam rating.

Tech:
WP 7.1
mosparo version: 1.5.5
mosparo Integration: 1.18.2
Invisible mode

Think you can fix this in a future update? Or am I doing something wrong?
Thanks and best Wishes!
Bastian

• This topic was modified 3 weeks, 2 days ago by baboehm.