Restrict note editing capabilities to their authors or comment moderators#11191
Restrict note editing capabilities to their authors or comment moderators#11191mindctrl wants to merge 2 commits intoWordPress:trunkfrom
Conversation
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
Test using WordPress PlaygroundThe changes in this pull request can previewed and tested using a WordPress Playground instance. WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser. Some things to be aware of
For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation. |
| } | ||
|
|
||
| /* | ||
| * Notes can be read by any user who can edit the parent post. |
There was a problem hiding this comment.
Minor point: I don't think “parent” is right to mention here, since it could be confused with comment_parent in that a comment can have a parent comment.
| * Notes can be read by any user who can edit the parent post. | |
| * Notes can be read by any user who can edit the associated post. |
| * | ||
| * @since 7.0.0 |
There was a problem hiding this comment.
Since this isn't a dockblock, a @since tag I don't think is warranted. I don't see other examples of this in the function.
| * | |
| * @since 7.0.0 |
| * | ||
| * @ticket 64779 | ||
| */ | ||
| public function test_contributor_cannot_update_others_note() { |
There was a problem hiding this comment.
| public function test_contributor_cannot_update_others_note() { | |
| public function test_contributor_cannot_update_others_note(): void { |
| * | ||
| * @ticket 64779 | ||
| */ | ||
| public function test_contributor_cannot_delete_others_note() { |
There was a problem hiding this comment.
| public function test_contributor_cannot_delete_others_note() { | |
| public function test_contributor_cannot_delete_others_note(): void { |
| * | ||
| * @ticket 64779 | ||
| */ | ||
| public function test_editor_can_update_others_note() { |
There was a problem hiding this comment.
| public function test_editor_can_update_others_note() { | |
| public function test_editor_can_update_others_note(): void { |
| * @ticket 64779 | ||
| * @covers ::map_meta_cap | ||
| */ | ||
| public function test_delete_regular_comment_maps_to_edit_post() { |
There was a problem hiding this comment.
| public function test_delete_regular_comment_maps_to_edit_post() { | |
| public function test_delete_regular_comment_maps_to_edit_post(): void { |
| * @ticket 64779 | ||
| * @covers ::map_meta_cap | ||
| */ | ||
| public function test_edit_comment_nonexistent_comment() { |
There was a problem hiding this comment.
| public function test_edit_comment_nonexistent_comment() { | |
| public function test_edit_comment_nonexistent_comment(): void { |
| * @ticket 64779 | ||
| * @covers ::map_meta_cap | ||
| */ | ||
| public function test_delete_comment_nonexistent_comment() { |
There was a problem hiding this comment.
| public function test_delete_comment_nonexistent_comment() { | |
| public function test_delete_comment_nonexistent_comment(): void { |
| * @covers ::map_meta_cap | ||
| * @expectedIncorrectUsage map_meta_cap | ||
| */ | ||
| public function test_edit_comment_without_argument() { |
There was a problem hiding this comment.
| public function test_edit_comment_without_argument() { | |
| public function test_edit_comment_without_argument(): void { |
| * @covers ::map_meta_cap | ||
| * @expectedIncorrectUsage map_meta_cap | ||
| */ | ||
| public function test_delete_comment_without_argument() { |
There was a problem hiding this comment.
| public function test_delete_comment_without_argument() { | |
| public function test_delete_comment_without_argument(): void { |
2 participants
Notes (internal collaborative comments on posts) currently inherit the same capability mapping as regular comments, meaning anyone who can edit the parent post can edit or delete any note on it.
Trac ticket: https://core.trac.wordpress.org/ticket/64779
Use of AI Tools
Opus 4.6 helped with this, particularly the phpunit tests.
This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.