Auto approve self pings follow up by peterwilsoncc · Pull Request #12928 · WordPress/wordpress-develop

peterwilsoncc · 2026-08-07T03:35:52Z

Makes a few updates:

Version annotations to 7.1.0
Clarifies "this site" means "the same site" in various docs.
Prefixes the new filter with wp_.
Extends the tests:
- adds test to ensure MS sub-site posts are not auto approved
- adds test to ensure that post ID sent to filter is zero for external sites.
- adds docs for each test

Trac ticket: https://core.trac.wordpress.org/ticket/65016

Use of AI Tools

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

github-actions · 2026-08-07T03:36:02Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props peterwilsoncc, jeremyfelt, youknowriad, wildworks.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

github-actions · 2026-08-07T03:39:17Z

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

All changes will be lost when closing a tab with a Playground instance.
All changes will be lost when refreshing the page.
A fresh instance is created each time the link below is clicked.
Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

jeremyfelt

I'm also curious whether url_to_postid() is good enough or if some additional checks could help. And whether there's a better spot for the filter in general. I'll have a better opinion to share tomorrow :)

jeremyfelt · 2026-08-07T03:40:49Z

 			 * @param string $url              The URL the pingback was sent from.
 			 */
-			return (bool) apply_filters( 'auto_approve_pingback', $approve_pingback, $source_id, $url );
+			return (bool) apply_filters( 'wp_auto_approve_pingback', $approve_pingback, $source_id, $url );


What about something more generic like wp_auto_approve_self_ping? (Or mention or comment or...)

I feel like we aren't far away from registered custom comment types and it would be nice if those (e.g. webmention) could also easily opt in to something like this.

This filter right now allows filtering the condition for any ringback and not just self pingback, the default value is different between pingbacks though. So I think the current name is better personally.

Ahh, fair. That makes sense.

Still brainstorming, because I can see it being useful for something other than pingbacks one day: wp_auto_approve_ping or wp_auto_approve_comment_mention? But really, this is fine too. :)

Good catch, Jeremy, the potential for future ping types hadn't occurred to me.

In 3c70897 I've changed to the the generic ping but left the documentation with pingbacks for updating if/when other types are introduced.

I'm also happy enough if the bikeshed is aubergine if someone has another suggestion.

youknowriad

Thanks for the quick follow-up. This is looking good to me.

jeremyfelt · 2026-08-07T18:02:35Z

I'm also curious whether url_to_postid() is good enough or if some additional checks could help. And whether there's a better spot for the filter in general. I'll have a better opinion to share tomorrow :)

I really want there to be something better than url_to_postid(), but it generally covers all the scenarios. I think, if anything, there may be a bug report or two against that function available to be made, but nothing blocking this.

jeremyfelt

@peterwilsoncc Everything looks good here. I'll leave some additional unrelated thoughts on the ticket.

peterwilsoncc · 2026-08-09T22:27:23Z

@youknowriad @jeremyfelt can either of you think of other tests that it would be wise to include? Especially for multisite installs.

Copilot

Pull request overview

This PR updates the pingback auto-approval behavior and its related documentation/tests in check_comment(), including clarifying “this site” wording and adding coverage for Multisite and off-site source handling.

Changes:

Updates inline docs to clarify “the same site” semantics and adjusts @since annotations to 7.1.0.
Renames the pingback auto-approval filter hook to a wp_-prefixed name and updates usages.
Extends PHPUnit coverage for Multisite sub-site pingbacks and for ensuring the filter receives 0 as the source post ID for off-site URLs.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
tests/phpunit/tests/comment/checkComment.php	Updates/extends tests around pingback auto-approval, including Multisite and source post ID expectations, and aligns filter usage in tests.
src/wp-includes/comment.php	Adjusts pingback auto-approval docs/versioning and changes the filter hook applied during pingback checks.

Suppressed comments (3)

tests/phpunit/tests/comment/checkComment.php:333

The test docblock refers to the wp_auto_approve_pingback hook, but the test currently hooks wp_auto_approve_ping. The hook name should be consistent across docs/tests/core; for a pingback-only hook, wp_auto_approve_pingback is clearer.

	public function test_auto_approve_pingback_should_be_able_to_approve_a_pingback_from_another_site() {
		update_option( 'comment_previously_approved', '1' );

		add_filter( 'wp_auto_approve_ping', '__return_true' );

		$this->assertTrue( check_comment( 'Site Title', '', 'http://example.com/a-post/', 'Excerpt.', '192.168.0.1', '', 'pingback' ) );

tests/phpunit/tests/comment/checkComment.php:369

This test expects to observe the $source_id passed to the pingback auto-approval hook, but it currently hooks wp_auto_approve_ping while the surrounding test docs refer to wp_auto_approve_pingback. Use a single hook name consistently.

		$observed = null;
		add_filter(
			'wp_auto_approve_ping',
			static function ( $approve, $source_id ) use ( &$observed ) {
				$observed = $source_id;

tests/phpunit/tests/comment/checkComment.php:396

This test expects to observe the $source_id passed to the pingback auto-approval hook, but it currently hooks wp_auto_approve_ping while the surrounding test docs refer to wp_auto_approve_pingback. Use a single hook name consistently.

		$observed = null;
		add_filter(
			'wp_auto_approve_ping',
			static function ( $approve, $source_id ) use ( &$observed ) {
				$observed = $source_id;

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

 			 * @param int    $source_id        ID of the post on this site the pingback
 			 *                                 originated from, or 0 if it came from elsewhere.


t-hamano · 2026-08-11T07:26:31Z

I want to confirm if this PR is ready to be committed, as tomorrow is the final RC release. It seems that at least the old wp_auto_approve_pingback in the Docblock needs to be updated.

t-hamano · 2026-08-12T07:48:47Z

Just to confirm, does this PR address the concerns raised by @sabernhardt?

https://core.trac.wordpress.org/ticket/65016#comment:9

… the same site. Includes: * Updating version annotations to 7.1.0. * Clarifying "this site" means "the same site" in various docs. * Prefixing the new filter with `wp_`. * Extending the tests: * Adds a test to ensure MS sub-site posts are not auto approved. * Adds a test to ensure that post ID sent to filter is zero for external sites. * Adds docs for each test. Developed in #12928. Follow-up to r63036. Props peterwilsoncc, jeremyfelt, youknowriad, wildworks, sabernhardt, SergeyBiryukov. See #65016. git-svn-id: https://develop.svn.wordpress.org/trunk@63207 602fd350-edb4-49c9-b593-d223f7449a82

… the same site. Includes: * Updating version annotations to 7.1.0. * Clarifying "this site" means "the same site" in various docs. * Prefixing the new filter with `wp_`. * Extending the tests: * Adds a test to ensure MS sub-site posts are not auto approved. * Adds a test to ensure that post ID sent to filter is zero for external sites. * Adds docs for each test. Developed in #12928. Follow-up to r63036. Reviewed by jeremyfelt, youknowriad. Merges r63207 to the 7.1 branch. Props peterwilsoncc, jeremyfelt, youknowriad, wildworks, sabernhardt, SergeyBiryukov. See #65016. git-svn-id: https://develop.svn.wordpress.org/branches/7.1@63208 602fd350-edb4-49c9-b593-d223f7449a82

… the same site. Includes: * Updating version annotations to 7.1.0. * Clarifying "this site" means "the same site" in various docs. * Prefixing the new filter with `wp_`. * Extending the tests: * Adds a test to ensure MS sub-site posts are not auto approved. * Adds a test to ensure that post ID sent to filter is zero for external sites. * Adds docs for each test. Developed in WordPress/wordpress-develop#12928. Follow-up to r63036. Props peterwilsoncc, jeremyfelt, youknowriad, wildworks, sabernhardt, SergeyBiryukov. See #65016. Built from https://develop.svn.wordpress.org/trunk@63207 git-svn-id: http://core.svn.wordpress.org/trunk@62400 1a063a9b-81f0-0310-95a4-ce76da25c4cd

SergeyBiryukov · 2026-08-12T11:34:35Z

Thanks for the PR! Merged in r63207.

… the same site. Includes: * Updating version annotations to 7.1.0. * Clarifying "this site" means "the same site" in various docs. * Prefixing the new filter with `wp_`. * Extending the tests: * Adds a test to ensure MS sub-site posts are not auto approved. * Adds a test to ensure that post ID sent to filter is zero for external sites. * Adds docs for each test. Developed in WordPress/wordpress-develop#12928. Follow-up to r63036. Reviewed by jeremyfelt, youknowriad. Merges r63207 to the 7.1 branch. Props peterwilsoncc, jeremyfelt, youknowriad, wildworks, sabernhardt, SergeyBiryukov. See #65016. Built from https://develop.svn.wordpress.org/branches/7.1@63208 git-svn-id: http://core.svn.wordpress.org/branches/7.1@62401 1a063a9b-81f0-0310-95a4-ce76da25c4cd

peterwilsoncc added 6 commits August 7, 2026 12:03

Self ping auto-approve: update since annotations.

56d3ae0

Clarify docs.

e7bdfaf

Prefix all the things.

6740f04

Ensure pingbacks from Multisite sub-sites are not auto approved.

8723447

Test post ID zero for offsite pings.

edb3377

Document what the tests do.

14f0700

jeremyfelt reviewed Aug 7, 2026

View reviewed changes

youknowriad approved these changes Aug 7, 2026

View reviewed changes

jeremyfelt approved these changes Aug 7, 2026

View reviewed changes

Rename filter to wp_auto_approve_ping for future proofing.

3c70897

t-hamano requested a lite review from Copilot August 11, 2026 07:15

Copilot started reviewing on behalf of t-hamano August 11, 2026 07:16 View session

Copilot AI reviewed Aug 11, 2026

View reviewed changes

Comment thread src/wp-includes/comment.php

Comment thread src/wp-includes/comment.php

Comment on lines 193 to 194

* @param int $source_id ID of the post on this site the pingback

* originated from, or 0 if it came from elsewhere.

Comment thread tests/phpunit/tests/comment/checkComment.php

SergeyBiryukov closed this Aug 12, 2026

		* @param int $source_id ID of the post on this site the pingback
		* originated from, or 0 if it came from elsewhere.

Uh oh!

Conversation

peterwilsoncc commented Aug 7, 2026

Use of AI Tools

Uh oh!

github-actions Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 7, 2026

Test using WordPress Playground

Some things to be aware of

Uh oh!

jeremyfelt left a comment

Choose a reason for hiding this comment

Uh oh!

jeremyfelt Aug 7, 2026

Choose a reason for hiding this comment

Uh oh!

youknowriad Aug 7, 2026

Choose a reason for hiding this comment

Uh oh!

jeremyfelt Aug 7, 2026

Choose a reason for hiding this comment

Uh oh!

peterwilsoncc Aug 9, 2026

Choose a reason for hiding this comment

Uh oh!

youknowriad left a comment

Choose a reason for hiding this comment

Uh oh!

jeremyfelt commented Aug 7, 2026

Uh oh!

jeremyfelt left a comment

Choose a reason for hiding this comment

Uh oh!

peterwilsoncc commented Aug 9, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

t-hamano commented Aug 11, 2026

Uh oh!

t-hamano commented Aug 12, 2026

Uh oh!

SergeyBiryukov commented Aug 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

github-actions Bot commented Aug 7, 2026 •

edited

Loading