[bor0]

Proposed Changes

• In o2_NoPriv_Write_API::create_comment(), fail with a logged_out error ("You have been logged out. Please log in again to comment.") when the message's author carries a userLogin.
• Move the message-to-$_POST remap into get_comment_fields() and default missing fields.
• Reject non-object messages, and messages without a type, in init().
• Add PHPUnit coverage in tests/phpunit/test-nopriv-write-api.php.

When a user's session expires, or they log out in another tab, the page still thinks they're logged in. The comment view then sends author as the current user (userLogin, userNicename, …, see js/views/comment.js:237) instead of the name/email/url form fields, and the request lands on the nopriv handler. create_comment() read author->name, email and url, logged a warning for each, and passed an empty author to wp-comments-post.php, which rejects the comment with a generic "please fill the required fields" error. The comment view already shows errorText, so the user now sees why the comment failed.

Seen in production on make.wordpress.org:

E_WARNING: Undefined property: stdClass::$name in inc/nopriv-write-api.php:92
E_WARNING: Undefined property: stdClass::$email in inc/nopriv-write-api.php:93
E_WARNING: Undefined property: stdClass::$url in inc/nopriv-write-api.php:94

Hand-crafted requests such as {"type":"comment","postID":999999999,"contentRaw":"test"} also logged Undefined property: stdClass::$parentID (line 91) and more. These now get empty defaults and are rejected by core as before.

A genuinely logged-out commenter is unaffected: that form sends author as { name, email, url } with no userLogin.

Testing Instructions

• Log in, open a post, then log out in another tab. Wait for the first tab to show "Your session has expired" (the next poll refreshes the nonce), then submit a comment there. Submitting before that prompt fails the nonce check with "Invalid or expired nonce" on both branches. On master, the warnings above are logged and the comment fails with "please fill the required fields". On this branch, the "You have been logged out" error is shown.
• Logged out, comment with name and email as usual. The comment still posts.
• vendor/bin/phpunit --filter NoPrivWriteAPITest passes. The tests fail with Undefined property: stdClass::$name without the fix.

🤖 Generated with Claude Code

[lancewillett]

tests/phpunit/test-nopriv-write-api.php:37: set $_SERVER['REQUEST_METHOD'] = 'POST' in this test and restore it afterward. The plugin test bootstrap leaves it as GET, so if the userLogin guard ever regresses, create_comment() reaches wp-comments-post.php, which calls a bare exit on non-POST requests. PHPUnit then stops with status 0, skips every later test, and CI shows green.

_{AI review · claude-opus-5-5}

[lancewillett]

1 blocker, left a comment.

[lancewillett]

Ran it locally: with the userLogin guard removed, the test now errors loudly, and you were right that the header warning already caught it before.

_{AI review · claude-opus-5-5}