Spam check not sending author information to Akismet for logged in users

[procifer]

Testing on a brand new WordPress 5.4 site with only Akismet 4.1.4 and bbPress 2.6.4 active, I've noticed that bbPress is not sending several author-related fields to Akismet when new Topics are created by logged in users.

To reproduce:

1. Modify maybe_spam function in akismet.php to output what information is being sent to Akismet for debugging.
2. In an incognito window, create and login to user account with topic posting permission and a non-empty Name, Email, and URL in profile.
3. Attempt to create a new Topic
4. Check output from 1 and see that comment_author, comment_author_email, and comment_author_url are blank.

I think the reason for this is the logic around line 113 of includes/extend/akismet.php, where it's checking for the presence of $anonymous_data, and uses information from it if not empty. The problem is that $anonymous_data seems to be non-empty even when a user is logged in, but the anonymous fields are blank or not accurate.

I'll attach a patch that fixes this in my testing. It also adjusts similar logic further down in that file when determining if submitted attributes match current post attributes for those fields.

The logic to determine username, email, and URL from $userdata and $anonymous_data could probably be refactored and shared between those two spots, and some better checking for possibly missing keys in $anonymous_data in the latter would be good. I am not very familiar with bbPress or that extension though, so it could use some thorough review by someone who is.

Getting those fields sent to Akismet will definitely help with spam detection on many many sites.

[johnjamesjacoby]

Hey @procifer, thanks for the report.

Your findings and research make sense, to me.

It is not intentional to send empty user data for registered users to Akismet. I'll test this a bit more, but until then I think this makes sense to fit into the 2.6.5 release.

[procifer]

Great news, thanks for the quick reply @johnjamesjacoby !

[netweb]

See also #2853

[johnjamesjacoby]

In 7128:

Akismet: fix spam check not sending author info for logged in users

This commit uses bbp_has_errors() to catch whether anonymous information exists or not, and falls back to the currently logged in user otherwise (anonymous has priority due to moderator ability to edit topics & replies).

This commit also improves the readability of a few lengthy function calls, and adds empty() checks to all of the related array key touches.

In branches/2.6, for 2.6.6.

Props procifer.

See #3368.

[johnjamesjacoby]

In 7129:

Akismet: fix spam check not sending author info for logged in users

This commit uses bbp_has_errors() to catch whether anonymous information exists or not, and falls back to the currently logged in user otherwise (anonymous has priority due to moderator ability to edit topics & replies).

This commit also improves the readability of a few lengthy function calls, and adds empty() checks to all of the related array key touches.

In trunk, for 2.7.

Props procifer.

See #3368.

[stephdau]

Thanks so much, @johnjamesjacoby ! <3