Doesn't block post requests from bots if mc-value parameter is missing
-
After I activated the plugin I still got annoying spam comments on my blog. After digging into the code I found that if the mc-value parameter is not contained in the post request there is no validation and the comment can be posted without any barrier.
public function add_comment_with_captcha($comment) { if(isset($_POST['mc-value']) && (!is_admin() || DOING_AJAX) && ($comment['comment_type'] === '' || $comment['comment_type'] === 'comment')) { ... } else return $comment; }Is there any reason for that? Why can’t the else be like
wp_die($this->error_messages['fill']);instead of returning $comment.
The topic ‘Doesn't block post requests from bots if mc-value parameter is missing’ is closed to new replies.