Skip to content

fix: only count previously approved normal comments for auto-approval - #3636

Open
faisalahammad wants to merge 1 commit into
Automattic:trunkfrom
faisalahammad:fix/3579-comment-approved-type
Open

fix: only count previously approved normal comments for auto-approval#3636
faisalahammad wants to merge 1 commit into
Automattic:trunkfrom
faisalahammad:fix/3579-comment-approved-type

Conversation

@faisalahammad

Copy link
Copy Markdown

Fixes #3579

Proposed changes:

When a remote account likes or reposts a post, the plugin stores that as an approved comment (with a non-default comment type such as like or repost). The pre_comment_approved filter then looked up whether the same author already had an approved comment, but did not filter by comment type. So that approved reaction counted as a "previously approved comment", and it auto-approved the same account's later normal replies even when "Comment author must have a previously approved comment" was enabled.

The fix mirrors what WordPress core's wp_allow_comment() does: it only counts prior approved comments of type comment, so reactions no longer leak approval to real replies. An account that previously replied normally is still auto-approved.

Other information:

  • Have you written new tests for your changes, if applicable?

Added test_pre_comment_approved_ignores_reactions() in tests/phpunit/tests/includes/class-test-comment.php, which inserts an approved like from a remote actor and verifies that a normal reply from the same actor stays held for moderation.

Testing instructions:

Because $comment_previously_approved needs to affect published replies, the trickiest part is setting up the scenario:

  • Enable "Comment author must have a previously approved comment" (Settings -> Discussion).
  • From a remote Mastodon account that has never commented on your site, like one of your posts (auto-approve Likes must be enabled).
  • From that same account, reply with a normal comment on another post.
  • The reply should land in Comments as pending (held for moderation), not approved.

Before this fix, that reply was auto-approved, because the account's previous Like was treated as a previously approved comment. A remote account that previously submitted a normal comment should still be auto-approved.

Changelog entry

  • Automatically create a changelog entry from the details below.
Changelog Entry Details

Significance

  • Patch
  • Minor
  • Major

Type

  • Added - for new features
  • Changed - for changes in existing functionality
  • Deprecated - for soon-to-be removed features
  • Removed - for now removed features
  • Fixed - for any bug fixes
  • Security - in case of vulnerabilities

Message

Fixed normal replies from distant accounts sometimes being auto-approved just because that account had previously liked or reposted a post.

The pre_comment_approved query used the same lookup as WordPress core's
wp_allow_comment(), but without the comment_type filter. An approved Like,
Repost, or Quote (stored with a non-default comment type) from a remote
actor was therefore counted as a previously approved comment, which
auto-approved that actor's subsequent normal replies even when 'comment
must be previously approved' was enabled.

Add comment_type = 'comment' to the lookup, matching core. Only prior
approved normal replies now count toward auto-approval.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Auto approved comments

1 participant