Use SCRIPT_NAME instead of REQUEST_URI to check path

[2ndkauboy]

The script is currently checking if the REQUEST_URI is containing wp-comments-post.php, the default script to handle the submission of a comment. Some security plugins have options to rename this file to disguise that WordPress is used.

With this fix, the SCRIPT_NAME is used instead. Since many security plugins do use rewrite rules, while the REQUEST_URI value is changed, the SCRIPT_NAME value stays the same. Therefore, the condition would still recognize if a comment was submitted.

Fixes #585

[2ndkauboy]

Somehow, I accidentally closed the PR 🤔

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

[Zodiac1978]

Possible alternative approach:

johndarrel/hide-my-wp#2 (comment)

[2ndkauboy]

@Zodiac1978 I don't think it's an alternative approach, it's just another step. Currently, the condition is the following:

strpos( $request_path, 'wp-comments-post.php' ) !== false

The $request_path used to be the REQUEST_URI, which would change, if a security plugin "changes this script name" using a rewrite rule. By using SCRIPT_NAME, we make sure we get the script name of the actual script that handles the request.

This is only affecting the left side of the condition and the first parameter $request_path. With home_url(), we could replace the second parameter, the static wp-comments-post.php string. But this would still not solve the issue. Replacing the first parameter with home_url(), the condition would most probably always be true, right?

Since this PR resolves the issue, I would not introduce a new function call (twice), we probably don't need.

[stklcode]

home_url(…) should equal REQUEST_URI. But I don’t see much of a benefit over the (cheaper) SCRIPT_NAME comparison.

[2ndkauboy]

The home_url() path is not looking at any $_SERVER values at all. All it does (in this case) is prepending the path with a slash. So calling home_url('wp-comments-post.php', 'relative') does always return /wp-comments-post.php, unless there is a filter hooking into home_url, which Hide My WP does not seem to do. So this is no solution.

@Zodiac1978 are you also OK to merge this then?

[Zodiac1978]

are you also OK to merge this then?

I just asked the author and if his approach is not smart, let's do it better.

From my understanding, it would still solve the issue with his plugin, so yes, I'm fine with PR!

[Zodiac1978]

LGTM!