2

It can be sometimes bothersome when, in the Discussion (Comments) dashboard, where the admin can see a list of comments, moving the mouse over a link will cause a preview of that link. Sometimes the preview gets in the way of looking at the comment. This is especially true with spam comments.

And I am also concerned that a link to a page/site that had some 'bad' code would cause a compromise of my site.

Is there a way to disable this 'feature'? Not sure where it is coming from.

  • Are you sure this isn't either a browser feature or coming via a plugin? I can't reproduce this on a fresh install. – kero Jul 2 '18 at 22:34
  • The site is using the TwentyTen theme. On the Comments (in admin) screen, hovering over a link causes a window to pop up, with the "W" logo while the preview is being loaded. My first thought is that it is theme-related, but didn't think that themes would affect the Comments admin page. And, as usual, it could be a plugin. So (apparently) there is a hook that can be used to enable the preview. – Rick Hellewell Jul 2 '18 at 23:44
  • I'm really surprised there's no answer and that this is hard to find via Google. If you have any spam, you at least give them a signal to keep deluging you by visiting their links in whatever form. – D_N May 26 at 12:29
  • It does seem to be a core WordPress thing. Having a really hard time finding anything about it, though. Closest so far: en.forums.wordpress.com/topic/… – D_N May 26 at 13:05
  • See my answer; I decided to look into this. And am concerned about this apparent vulnerability that Akismet is introducing. – Rick Hellewell May 26 at 21:47
1

This annoying thing is introduced by Askimet.

in wp_content/plugins/askmimet/_inc/askimet.js line 89 (askimet 4.1.2) insert a "return;" just after

86: // Show a preview image of the hovered URL. Applies to author URLs and URLs inside the comments.
87: $( '#the-comment-list' ).on( 'mouseover', mshotEnabledLinkSelector, function () {
88:     clearTimeout( mshotRemovalTimer ); 
89: return;
  • Yeah, correct. Figured it out after posting on Akismet support forum. "It's a feature, not a bug." type of response. IMHO, should not be there. Haven't looked at the JS code (and not really an expert on it), but think there should be a way to disable it. Shouldn't be there in the first place. Thanks. – Rick Hellewell Jun 8 at 17:57
  • To read spammer websites is a feature ? Ha ha... – Remi Loisel Jun 9 at 2:14
0

This is still happening in WP5.2.1. You can verify it by looking at your spam messages (via the Admin, Comments screen) and hovering over a link. When you do wo, a box will pop up with the content of that link.

Using the Inspector, I found the HREF code on the link in the spam comment is similar to this (I obfuscated the domain but left the rest) (and not sure how to wrap the code block below)

<a href="http://Www.example.com/__media__/js/netsoltrademark.php?d=malyj.info%2F__media__%2Fjs%example.php%3Fd%3D3win8.city%2Findex.php%2Fdownload%2F29-ntc33"

target="_blank" rel="external nofollow">http://Www.example.com/media/js/netsoltrademark.php?d=malyj.info%2F__media__%2Fjs%2Fexample.php%3Fd%3D3win8.city%2Findex.php%2Fdownload%2F29-ntc33

And the CSS for the :after element, which comes from Akismet (which is why you only see it on Akismet-caught spam, using the latest version of Akismet), in akismet.css line 42:

table.comments td.comment p a::after {

    content: attr(href);
    color: #aaa;
    display: inline-block;
    padding: 0 1ex;

}

So the content element of the CSS is displaying the content in the link. And note that the example link above is a php file. Which is concerning....since clicking on the link appears to call some 'download' process. (I have not looked into the code of the link, nor clicked on it.)

....but not as concerning as if the example block was some JS. And more concerning if the JS is trying to do some exploit on your computer - which I don't think would require a click, just a hover to execute. YIKES!

So, the cause seems to be the CSS that Akismet is using is displaying the links' content.

And that doesn't look very safe. Akismet should not be using the content element in the :after CSS block.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.