WP-SpamShield sends admin data to users!

You are incorrect. WP-SpamShield does not send critical admin data to users. If this is happening, then something else is changing the standard function of things. As with your last support post, again, you are attributing an issue to the plugin that is not caused by WP-SpamShield.

WP-SpamShield does add extra data to the notifications that are sent to the admin when a new comment is posted. Yes, there is an option in the Settings page, to turn off extra data in comment notifications, “Hide extra technical data in comment notifications.” It sounds like the other plugin is changing the usage of the notifications incorrectly.

Your other plugin has not been updated in over two years, so you’re running already running a security risk by using it.

Please submit a support request per plugin documentation if you have further issues or would like me to look into specifics for you and explain further: WP-SpamShield Support Page.

Please read my response….it does add the extra data…but it only goes to the admin. If it’s functioning differently, then the other plugin is changing the behavior incorrectly. It should not be sending admin emails to regular users.

Sallam, as I said, please submit a support request at our support page.

That line is only sent to admins. If it’s going to regular users, then the other plugin is modifying things incorrectly.

We do not provide support or advice for hacking the plugin.

As, I mentioned twice now, please submit your support request to our support page. This is not our main support venue. We will need to email back and forth with you to effectively help you.

Lines 242-244 in the Comment Reply Notification plugin are causing the issue:

$mail_message = apply_filters('comment_notification_text', $mail_message, $id);
$mail_subject = apply_filters('comment_notification_subject', $mail_subject, $id);
$mail_headers = apply_filters('comment_notification_headers', $mail_headers, $id);

These are filters used in the WordPress core function that’s used to notify authors – wp_notify_postauthor(). Duplicating these filters isn’t a great idea…by adding these filters to his own email notification function without any validation or authentication it will create unexpected results.

It would be one thing if he included all the filters from that function which would allow for some validation on the recipient email addresses, but he did not so it makes validation more of a challenge.

If you delete those lines or comment them out like below, it should take care of your issue without hampering any functionality:

/*
$mail_message = apply_filters('comment_notification_text', $mail_message, $id);
$mail_subject = apply_filters('comment_notification_subject', $mail_subject, $id);
$mail_headers = apply_filters('comment_notification_headers', $mail_headers, $id);
*/

I would alert the author to fix this but it doesn’t seem to be supported anymore.

The only thing I can do on my end is look into creating workarounds and extra validation for future versions to try and prevent this type of situation from coming up again.

You’re welcome, Sallam. I’m glad I could help. 🙂