From 0708ffe15c463fca2a2afdb7f6d5cf3b6ed7efe6 Mon Sep 17 00:00:00 2001
From: Scott Taylor <scott.c.taylor@mac.com>
Date: Thu, 17 Sep 2015 22:22:25 +0000
Subject: [PATCH] In `wp-comments-post.php`, sanity check a few of the comment
 inputs that are expected to be a string beford calling string-only functions
 on them.

Props Kloon.
Fixes #23416.

Built from https://develop.svn.wordpress.org/trunk@34274


git-svn-id: http://core.svn.wordpress.org/trunk@34238 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-comments-post.php    | 8 ++++----
 wp-includes/version.php | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/wp-comments-post.php b/wp-comments-post.php
index 44eab61d1c..cb7bd50fa4 100644
--- a/wp-comments-post.php
+++ b/wp-comments-post.php
@@ -89,10 +89,10 @@ if ( ! comments_open( $comment_post_ID ) ) {
 	do_action( 'pre_comment_on_post', $comment_post_ID );
 }
 
-$comment_author       = ( isset($_POST['author']) )  ? trim(strip_tags($_POST['author'])) : null;
-$comment_author_email = ( isset($_POST['email']) )   ? trim($_POST['email']) : null;
-$comment_author_url   = ( isset($_POST['url']) )     ? trim($_POST['url']) : null;
-$comment_content      = ( isset($_POST['comment']) ) ? trim($_POST['comment']) : null;
+$comment_author       = ( isset( $_POST['author'] ) && is_string( $_POST['author'] ) ) ? trim( strip_tags( $_POST['author'] ) ) : null;
+$comment_author_email = ( isset( $_POST['email'] ) && is_email( $_POST['email'] ) ) ? trim( $_POST['email'] ) : null;
+$comment_author_url   = ( isset( $_POST['url'] ) && is_string( $_POST['url'] ) ) ? trim( $_POST['url'] ) : null;
+$comment_content      = ( isset( $_POST['comment'] ) && is_string( $_POST['comment'] ) ) ? trim( $_POST['comment'] ) : null;
 
 // If the user is logged in
 $user = wp_get_current_user();
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 41452b0129..7c664dde2c 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -4,7 +4,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '4.4-alpha-34273';
+$wp_version = '4.4-alpha-34274';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.