Displaying a comment whose comment_parent has been deleted results in PHP Notices

[rachelbaker]

There are missing checks in the Comments (wp-admin/edit-comments.php) and Edit Comment (wp-admin/comment.php?action=editcomment&c={comment_ID}) screens for comments that have a comment_parentvalue. If the comment parent was deleted , or for some reason doesn't exist, get_comment( $comment->comment_parent ) won't return an object. In both screens we do not check that we have a parent object before calling get_comment_link() or get_comment_author(), both of which also assume a comment object exists, which result in PHP Notice: Trying to get property of non-object messages.

Assuming your PHP error reporting level includes Notices, you log or display the errors, and you enjoy replicating bugs; here are the steps to reproduce:

1. Create a test comment
2. Reply to the test comment
3. Delete the test comment created in step 1
4. View the Comments screen
5. Note the PHP Notices (example ​https://cloudup.com/cpH6cjQry-a)
6. Locate your parentless comment (the reply created in step 2) in the list table and click the "Edit" link
7. View the Edit Comment screen
8. Note the PHP Notices (example: ​https://cloudup.com/ckUOLcdVCY5)
9. Throw laptop out window

[rachelbaker]

Patch checks if the comment parent object exists and if it does escapes the comment parent author's name.

[rachelbaker]

Related: #17928

[SergeyBiryukov]

esc_attr() is only useful for HTML attributes, which is not the case here.

Comment author name already runs through sanitize_text_field() and KSES filters, it should be safe.

[rachelbaker]

Refreshed patch to remove esc_attr

[wonderboymusic]

I churned the Comment List Table code, patch needs a reboot

[rachelbaker]

@wonderboymusic

attachment:33710.2.patch​ refreshes the patch. Added commit keyword for your consideration.

[wonderboymusic]

In 34015:

Comments/PHP Notices: check that a parent comment exists before displaying an orphan's link to it in the admin.

Props rachelbaker.
Fixes #33710.

[wonderboymusic]

In 34038:

After [34015], handle orphaned comments in the Dashboard comments widget. Pass full $comment versus just passing the comment ID when possible.

See #33710.