WP-SpamShield sends admin data to users!

You are incorrect. WP-SpamShield does not send critical admin data to users. If this is happening, then something else is changing the standard function of things. As with your last support post, again, you are attributing an issue to the plugin that is not caused by WP-SpamShield.

WP-SpamShield does add extra data to the notifications that are sent to the admin when a new comment is posted. Yes, there is an option in the Settings page, to turn off extra data in comment notifications, “Hide extra technical data in comment notifications.” It sounds like the other plugin is changing the usage of the notifications incorrectly.

Your other plugin has not been updated in over two years, so you’re running already running a security risk by using it.

Please submit a support request per plugin documentation if you have further issues or would like me to look into specifics for you and explain further: WP-SpamShield Support Page.

I’m sure its your plugin that adds such data.
Here is a quote from email sent for a comment notification:

Blacklist the IP Address: https://mydomain.com/wp-admin/options-general.php?page=wp-spamshield&wpss_action=blacklist_ip&submitter_ip=my.ip.address.number —————————————————————– Additional Technical Data Added by WP-SpamShield —————————————————————– Referrer: User-Agent (Browser/OS): Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.101 Safari/537.36 IP Address: my.ip.address.number Server: host-my.ip.address.number.ISP provider IP Address Lookup: https://whatismyipaddress.com/ip/my.ip.address.number (This data is helpful if you need to submit a spam sample.)

If I disable adding the tech data, the block ip address line does still gets added, showing admin ip. The url given has your plugin name.

Please read my response….it does add the extra data…but it only goes to the admin. If it’s functioning differently, then the other plugin is changing the behavior incorrectly. It should not be sending admin emails to regular users.

Sallam, as I said, please submit a support request at our support page.

You’re right, the option to hide tech data solved half the problem. I just want to hide also the line offering to block the ip. Is there such option?
If not could you guide me to where I can remove it from the code of your plugin files please?

That line is only sent to admins. If it’s going to regular users, then the other plugin is modifying things incorrectly.

We do not provide support or advice for hacking the plugin.

As, I mentioned twice now, please submit your support request to our support page. This is not our main support venue. We will need to email back and forth with you to effectively help you.

Just a heads up, I checked the code of the other plugin, and my suspicion was correct.

Lines 242-244 in the Comment Reply Notification plugin are causing the issue:

$mail_message = apply_filters('comment_notification_text', $mail_message, $id);
$mail_subject = apply_filters('comment_notification_subject', $mail_subject, $id);
$mail_headers = apply_filters('comment_notification_headers', $mail_headers, $id);

These are filters used in the WordPress core function that’s used to notify authors – wp_notify_postauthor(). Duplicating these filters isn’t a great idea…by adding these filters to his own email notification function without any validation or authentication it will create unexpected results.

It would be one thing if he included all the filters from that function which would allow for some validation on the recipient email addresses, but he did not so it makes validation more of a challenge.

If you delete those lines or comment them out like below, it should take care of your issue without hampering any functionality:

/*
$mail_message = apply_filters('comment_notification_text', $mail_message, $id);
$mail_subject = apply_filters('comment_notification_subject', $mail_subject, $id);
$mail_headers = apply_filters('comment_notification_headers', $mail_headers, $id);
*/

I would alert the author to fix this but it doesn’t seem to be supported anymore.

The only thing I can do on my end is look into creating workarounds and extra validation for future versions to try and prevent this type of situation from coming up again.

Thanks very much Scott. Your help continue to amaze me.
I guess I’ll stop using that faulty old plugin, and look for a better replacement.

You are correct. When I tried another comment notification plugin (https://www.ads-software.com/plugins/comment-email-reply/) the problem disappeared.

Thanks so much for your great help and time.

You’re welcome, Sallam. I’m glad I could help. ??