9

Ran across something a bit odd that I haven't seen before. A client has a pretty active blog and uses Akismet (paid) to protect against spam. At least once a day, they're reporting a spam comment that is correctly marked as spam, but cannot be removed from the admin dashboard by clicking Empty Spam or manually selecting the entry and trying to delete it.

I looked into this and noticed that the DB entry has a comment_post_ID of 0, which I'd have to assume means it is not attached to any post. I can obviously remove them manual from the DB (and it works just fine), but haven't found any information on what this could be.

I've replaced the core WP files (thinking it might be a security issue) and also re-generated the salts/keys in the wp-config.php file without any change.

Any thoughts would be a huge help. thanks!

Update

While this may have stemmed from, I'm not sure if it is the result of the InMotion hack.

Here's what's been done:

  • Changed FTP, MySQL passwords
  • Created new DB user, assigned to database
  • Updated salts/keys in wp-config.php
  • Changed all WP user passwords
  • Re-installed core WordPress files

Akismet is out of ideas on this one (don't blame them) as this one is persistent.

  • 2
    If a comment is posted without a post ID the ID is set to '0'. Look in /wp-comments-post.php. The next few lines should kill the script though, unless you have a post with ID '0'. And that is puzzling, which is why this is a comment and not an attempt at an answer. – s_ha_dum Nov 7 '12 at 17:37
  • Yeah - this one's a head-scratcher for sure – Zach Nov 7 '12 at 19:53
  • 1
    Another idea. Grab the spammers IP from the DB and search for it in the server logs. Which url has the spammer requested? – Ralf912 Nov 22 '12 at 21:08
  • 1
    do a grep on comment_save_pre and see if there's a function that alters the data before it is saved. It's not possible to add a comment without an (open to comments) post number, so it has the be changed after reception. Some questions: Are there custom post types, do you use ajax to submit comments (plugins). Are you using captcha plugins. – Patriek Nov 25 '12 at 19:25
  • 1
    Hi all - appreciate the continued interest in this one. A few responses: No plugins that hook into either comment_id_not_found or comment_save_pre (did have a plugin called Easy Comment Uploads previously, but is unpublished and can't find original files - now using Comment Images). The access logs have yet to reveal any matches for these IP addresses (which also don't match), but searches confirm they are spam (if that wasn't obvious already ha). – Zach Nov 26 '12 at 14:45
1

I'm sorry can't comment here but i'll try to help.

wp_handle_comment_submission function handing comments posting contains exact check for post_id:

    $post = get_post( $comment_post_ID );

    if ( empty( $post->comment_status ) ) {
         ...
       return error_happened; 
    }

i.e. (1) it passes through , or (2) comment was added other than default way of posting comments.

For (1) - check that post with id=0 doesnt exists in db, wp_posts table. Sometimes failures in database cause presence of such records

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.