From 9831fa216c11f2e0aadfd1f0b9645b834411333d Mon Sep 17 00:00:00 2001 From: Scott Taylor Date: Sat, 12 Sep 2015 07:18:36 +0000 Subject: [PATCH] AJAX Reply to Comment: check the `edit_comment` cap when parent comment will be auto-approved. Props rachelbaker. Fixes #23939. git-svn-id: https://develop.svn.wordpress.org/trunk@34074 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-admin/includes/ajax-actions.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/wp-admin/includes/ajax-actions.php b/src/wp-admin/includes/ajax-actions.php index a4feb6f0dd..e0391dc970 100644 --- a/src/wp-admin/includes/ajax-actions.php +++ b/src/wp-admin/includes/ajax-actions.php @@ -1011,6 +1011,10 @@ function wp_ajax_replyto_comment( $action ) { $parent = get_comment( $comment_parent ); if ( $parent && $parent->comment_approved === '0' && $parent->comment_post_ID == $comment_post_ID ) { + if ( ! current_user_can( 'edit_comment', $parent->comment_ID ) ) { + wp_die( -1 ); + } + if ( wp_set_comment_status( $parent->comment_ID, 'approve' ) ) $comment_auto_approved = true; }