wpDiscuz version: 7.6.69
Environment: WordPress (ClassicPress-based), PHP, LiteSpeed server, no caching plugin active
Summary:
The bubble/live-update REST endpoint (wp-json/wpdiscuz/v1/update) never returns
newly posted comments in its "ids" field when two different guest visitors post
comments without filling in an email address. The overall "all_comments_count"
does update correctly, but the "ids" array (which drives the notification
bubble/toast) stays empty forever for these visitors, even though the new
comments are approved and clearly exist with a higher comment_ID than the
client's lastId.
Root cause (found by reading includes/class.WpdiscuzDBManager.php):
getNewCommentIds() builds its query with:
... AND `comment_ID` > %d AND `comment_author_email` != %s ...
where %s is the requesting visitor's own email (from $_COOKIE
"comment_author_email_" . COOKIEHASH, or the logged-in user's email).
This is meant to exclude a visitor's own comments from their own
notification feed. However, when a guest commenter does not enter an
email address, comment_author_email is stored as an empty string (‘’).
If a SECOND, completely different guest visitor also leaves the email
field blank, their request also sends email = ''. The exclusion filter
then matches "comment_author_email != ''" as FALSE for the other
visitor's new comment (because it also equals ''), so that comment is
incorrectly treated as "my own" and excluded from `ids` — even though
it was posted by a different person in a different browser.
Steps to reproduce:
1. Open the same post in two different browsers/profiles as two
different anonymous guests (not logged in).
2. In both, submit a comment WITHOUT filling in an email address
(only a display name).
3. Wait for the bubble's live-update poll (wp-json/wpdiscuz/v1/update)
to fire in either browser.
4. Observe: `all_comments_count` increases correctly, but `ids` and
the notification bubble/toast never show the other guest's new
comment — because both share the same blank email identity.
5. For comparison, if one of the two commenters is logged in (so their
email is a real, distinct value), notifications work correctly in
both directions.
Expected behavior:
Two different guest visitors who both leave the email field blank
should still be notified of each other's new comments — an empty
email should not be treated as a shared "identity" for the
self-exclusion filter. Suggested fix: only apply the
`comment_author_email != %s` exclusion when the requester's email is
non-empty, or use a more reliable per-visitor identifier (e.g. a
random per-session cookie/nonce) instead of email for this
self-exclusion check.
Impact:
On a public site where many visitors comment as anonymous guests
without an email address, this silently breaks the live comment
notification feature for a large share of real visitors, not just in
a synthetic multi-browser test.
Happy to share captured network requests/responses (from Chrome
DevTools/Firefox DevTools) and the exact wp_comments rows (comment_ID,
comment_author, comment_author_email) that reproduce this if useful.