Repository navigation
A spam/ham correction obeys the form's Akismet switch, not just Akismet's presence - #49
Merged
AllTerrainDeveloper merged 1 commit intoSep 1, 2026
Conversation
…et's presence The WordPress.org review flagged it: marking an entry as spam or not-spam sent its contents, IP address and user agent to Akismet whenever the Akismet plugin was configured, without consulting the form's own opt-in setting. The check on submission already honoured that switch; the correction did not. `alltfo_akismet_submit_correction()` now looks up the entry's form and returns before touching Akismet unless that form has `spam.akismet` on. The same test, `alltfo_form_uses_akismet()`, is now the single gate both code paths pass through, so no request to Akismet can be made on behalf of a form that never opted in. The function returns whether a correction was sent. Tests exercise both paths against a recording stand-in for Akismet: a form with Akismet off produces zero requests on submission and on either correction, even with an API key configured; a form with it on produces exactly one comment-check, one submit-spam and one submit-ham. readme.txt's External services section now states that corrections obey the per-form switch. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DVAaHFURDGeBzeuWHZ2dcP
AllTerrainDeveloper
deleted the
fix/akismet-corrections-respect-form-opt-in
branch
September 1, 2026 17:33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What the reviewer flagged
Correct.
alltfo_akismet_submit_correction()checked onlyalltfo_akismet_available()(plugin installed + API key). The submission-time check already honoured the form'sspam.akismetswitch (off by default); the correction path skipped it.The fix
includes/spam.phpalltfo_form_uses_akismet( $schema )— the single gate every Akismet request passes through. Reads only the form's ownspam.akismetswitch.alltfo_akismet_submit_correction()looks up the entry's form (_alltfo_formmeta) and returns before Akismet is even looked for unless that form opted in. Now returnsbool(whether anything was sent).alltfo_screen_for_spam()uses the same gate.includes/entries.php— docblock onalltfo_set_entry_status()says what actually happens.readme.txt— External services now states explicitly that spam/ham corrections obey the per-form switch.Net: with Akismet off on a form (the default), nothing about its entries ever reaches Akismet — not on submission, not when someone clicks spam / not-spam — regardless of whether the Akismet plugin is installed and configured on the site.
Tests
New
tests/phpunit/tests/akismet.php(5 tests, 25 assertions) against a recording stand-in for theAkismetclass (tests/phpunit/stubs/class-akismet.php, guarded byclass_exists):false.submit-spamthensubmit-ham; marking spam twice is one correction.comment-check; on → exactly onecomment-check, verdictakismet.Full suite: 749 tests, 3542 assertions, OK. PHPCS clean on new/changed code.
🤖 Generated with Claude Code
https://claude.ai/code/session_01DVAaHFURDGeBzeuWHZ2dcP