fix: only count previously approved normal comments for auto-approval - #3636
Open
faisalahammad wants to merge 1 commit into
Open
fix: only count previously approved normal comments for auto-approval#3636faisalahammad wants to merge 1 commit into
faisalahammad wants to merge 1 commit into
Conversation
The pre_comment_approved query used the same lookup as WordPress core's wp_allow_comment(), but without the comment_type filter. An approved Like, Repost, or Quote (stored with a non-default comment type) from a remote actor was therefore counted as a previously approved comment, which auto-approved that actor's subsequent normal replies even when 'comment must be previously approved' was enabled. Add comment_type = 'comment' to the lookup, matching core. Only prior approved normal replies now count toward auto-approval.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3579
Proposed changes:
When a remote account likes or reposts a post, the plugin stores that as an approved comment (with a non-default comment type such as
likeorrepost). Thepre_comment_approvedfilter then looked up whether the same author already had an approved comment, but did not filter by comment type. So that approved reaction counted as a "previously approved comment", and it auto-approved the same account's later normal replies even when "Comment author must have a previously approved comment" was enabled.The fix mirrors what WordPress core's
wp_allow_comment()does: it only counts prior approved comments of typecomment, so reactions no longer leak approval to real replies. An account that previously replied normally is still auto-approved.Other information:
Added
test_pre_comment_approved_ignores_reactions()intests/phpunit/tests/includes/class-test-comment.php, which inserts an approvedlikefrom a remote actor and verifies that a normal reply from the same actor stays held for moderation.Testing instructions:
Because
$comment_previously_approvedneeds to affect published replies, the trickiest part is setting up the scenario:Before this fix, that reply was auto-approved, because the account's previous Like was treated as a previously approved comment. A remote account that previously submitted a normal comment should still be auto-approved.
Changelog entry
Changelog Entry Details
Significance
Type
Message
Fixed normal replies from distant accounts sometimes being auto-approved just because that account had previously liked or reposted a post.