Upstream
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Comments: Prevent users who can not see a post from seeing comments on it. 

Props peterwilsoncc, jorbin, audrasjb.
Merges [56836] to the 6.3 branch.




Built from https://develop.svn.wordpress.org/branches/6.3@56843


git-svn-id: http://core.svn.wordpress.org/branches/6.3@56355 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
audrasjb 2023-10-12 13:24:22 +00:00
parent 5caf39a880
commit 41a82ac638
4 changed files with 38 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
wp-admin/includes/class-wp-comments-list-table.php
View File

@ -651,6 +651,19 @@ class WP_Comments_List_Table extends WP_List_Table {
$this->user_can = current_user_can( 'edit_comment', $comment->comment_ID );
$edit_post_cap = $post ? 'edit_post' : 'edit_posts';
if (
current_user_can( $edit_post_cap, $comment->comment_post_ID ) ||
(
empty( $post->post_password ) &&
current_user_can( 'read_post', $comment->comment_post_ID )
)
) {
// The user has access to the post
} else {
return false;
}
echo "<tr id='comment-$comment->comment_ID' class='$the_comment_class'>";
$this->single_row_columns( $comment );
echo "</tr>\n";

14
wp-admin/includes/class-wp-list-table.php
View File

@ -818,6 +818,20 @@ class WP_List_Table {
$pending_comments_number
);
$post_object = get_post( $post_id );
$edit_post_cap = $post_object ? 'edit_post' : 'edit_posts';
if (
current_user_can( $edit_post_cap, $post_id ) ||
(
empty( $post_object->post_password ) &&
current_user_can( 'read_post', $post_id )
)
) {
// The user has access to the post and thus can see comments
} else {
return false;
}
if ( ! $approved_comments && ! $pending_comments ) {
// No comments at all.
printf(

11
wp-admin/includes/dashboard.php
View File

@ -1103,7 +1103,16 @@ function wp_dashboard_recent_comments( $total_items = 5 ) {
echo '<ul id="the-comment-list" data-wp-lists="list:comment">';
foreach ( $comments as $comment ) {
_wp_dashboard_recent_comments_row( $comment );
$comment_post = get_post( $comment->comment_post_ID );
if (
current_user_can( 'edit_post', $comment->comment_post_ID ) ||
(
empty( $comment_post->post_password ) &&
current_user_can( 'read_post', $comment->comment_post_ID )
)
) {
_wp_dashboard_recent_comments_row( $comment );
}
}
echo '</ul>';

2
wp-includes/version.php
View File

@ -16,7 +16,7 @@
*
* @global string $wp_version
*/
$wp_version = '6.3.2-RC1-56842';
$wp_version = '6.3.2-RC1-56843';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.