vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-06-28 14:20:15 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Comments: Prevent users who can not see a post from seeing comments on it.

Browse Source 
Props peterwilsoncc, jorbin, audrasjb.





git-svn-id: https://develop.svn.wordpress.org/trunk@56836 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Jb Audras
2023-10-12 12:36:29 +00:00
parent ed821528ee
commit c445b80b58
3 changed files with 37 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/wp-admin/includes/class-wp-comments-list-table.php
View File

@@ -654,6 +654,19 @@ class WP_Comments_List_Table extends WP_List_Table {
$this->user_can = current_user_can( 'edit_comment', $comment->comment_ID );
$edit_post_cap = $post ? 'edit_post' : 'edit_posts';
if (
current_user_can( $edit_post_cap, $comment->comment_post_ID ) ||
(
empty( $post->post_password ) &&
current_user_can( 'read_post', $comment->comment_post_ID )
)
) {
// The user has access to the post
} else {
return false;
}
echo "<tr id='comment-$comment->comment_ID' class='$the_comment_class'>";
$this->single_row_columns( $comment );
echo "</tr>\n";

14
src/wp-admin/includes/class-wp-list-table.php
View File

@@ -851,6 +851,20 @@ class WP_List_Table {
$pending_comments_number
);
$post_object = get_post( $post_id );
$edit_post_cap = $post_object ? 'edit_post' : 'edit_posts';
if (
current_user_can( $edit_post_cap, $post_id ) ||
(
empty( $post_object->post_password ) &&
current_user_can( 'read_post', $post_id )
)
) {
// The user has access to the post and thus can see comments
} else {
return false;
}
if ( ! $approved_comments && ! $pending_comments ) {
// No comments at all.
printf(

11
src/wp-admin/includes/dashboard.php
View File

@@ -1109,7 +1109,16 @@ function wp_dashboard_recent_comments( $total_items = 5 ) {
echo '<ul id="the-comment-list" data-wp-lists="list:comment">';
foreach ( $comments as $comment ) {
_wp_dashboard_recent_comments_row( $comment );
$comment_post = get_post( $comment->comment_post_ID );
if (
current_user_can( 'edit_post', $comment->comment_post_ID ) ||
(
empty( $comment_post->post_password ) &&
current_user_can( 'read_post', $comment->comment_post_ID )
)
) {
_wp_dashboard_recent_comments_row( $comment );
}
}
echo '</ul>';