bgermann

Hi @dailyvideo. You are using the original cformsII version from deliciousdays.com, which has been shut down. It contains serious security bugs that can easily lead to your site being hacked. If you want to protect yourself, install the current version from https://wordpress.org/plugins/cforms2/

Now you have to use cforms so that the function is called. It is called on successfull submission of one of your defined forms.

I am sorry, but as I personally do not use the WP Comment feature, I do not want to support it any longer. The AJAX version rebuilt some WordPress stuff (reimplementing the things you extend is very bad engineering). And actually WordPress is built in a way that it does not expect someone posting comments via AJAX. A good way to do it would include having an actual implementation for the WordPress comment interfaces and exchanging them. Maybe there is another plugin that does something like this.

You seem to be the only one who uses WP Comments at all, because I only got bug reports for this from you. You should think of switching to normal WordPress comments really.

Actually I just removed the Tell-a-Friend feature for 14.12 as this feature requires a lot of manual fiddeling with the theme and I do not like the use case. One should be able to manually send a recommendation email with a link to friends. They then see that this is really coming from you and is not spam from any odd webserver. Did you check how often that feature is used on literaturcafe.de?

However as long as there are no security issues with 14.10.1 you can continue to use it. The Q&A and CAPTCHA features have issues in that version. They can be guessed programmatically.

Yes, I changed the comment form to be non-AJAX only. That results in appending the GET parameter cfemail to the HTTP redirect followed by the form submission. I guess there was a security issue with this in older cformsII versions so that Wordfence included a rule. You can switch back to 14.10.1 and I will investigate it.

Can you post your mod_rewrite rules (most probably Apache .htaccess file)?

You can try the following: delete this block from cforms.php:

###  fix for WP Comment (loading after redirect)
	if ( isset($_GET['cfemail']) && $isWPcommentForm ){
		$usermessage_class = ' success';
		$success=true;
		if ( $_GET['cfemail']=='sent' || $_GET['cfemail']=='posted' ){
			$usermessage_text = preg_replace ( '|\r\n|', '<br />', stripslashes($cformsSettings['form'.$no]['cforms'.$no.'_success']) );
		} else {
			$usermessage_class = ' failure';
			$success=false;
		}
	}

Okay. Can you paste the exact code here (use code markup)? Did you just edit the txt file or did you remove .txt etension and enable the plugin?

To clarify: Are you expecting the comment to show up in WordPress comments (which should do) or in cforms tracking database (which should not do)?

Do you have any example URL?

14.11.3 should fix this. Can you confirm?