Skip to content

Let authors edit checklists in their own comments - #258

Merged
lancewillett merged 2 commits into
masterfrom
p2hq-269-authors-cannot-edit-checklists-in-their-own-comments-on
Sep 2, 2026
Merged

Let authors edit checklists in their own comments#258
lancewillett merged 2 commits into
masterfrom
p2hq-269-authors-cannot-edit-checklists-in-their-own-comments-on

Conversation

@lancewillett

@lancewillett lancewillett commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

What changed

Checklist authorization for comments now runs the existing o2_Write_API::restrict_comment_editing() capability filter around the edit_comment check, the same way the comment Edit and Trash actions already do. Authors can tick, edit, delete, and add checklist items in comments they wrote on posts owned by other users. Other users' comments still need moderate_comments.

WordPress core maps edit_comment to the parent post's edit capabilities and never consults the comment's author, so after #255 removed the role-name fallback an Author lost checklist access to their own comments on someone else's post. The rendered checkbox came out disabled and the AJAX request was refused.

The method is now declared public and its parameter renamed to $object_id so the WordPress.com mirror passes its coding-standards gate. Behavior is otherwise unchanged.

Testing

  • New PHPUnit coverage in tests/phpunit/modules/test-checklists.php: an Author's own comment on another Author's post is editable and renders enabled; another user's comment is not editable and renders disabled; logged-out users are denied. The first test fails with the fix reverted.
  • Full suite: 85 tests, 150 assertions pass locally against WordPress 7.1.
  • Browser regression coverage in https://github.com/Automattic/p2/pull/6745: an Author's own comment on another user's post renders an enabled checkbox and accepts an update, while the post owner's comment renders disabled and refuses the update.

Checklist authorization for comments now applies o2's comment editing rule
through the existing restrict_comment_editing capability filter, so authors
can change checklists in comments they wrote on posts owned by other users.

See: P2HQ-269
@lancewillett

Copy link
Copy Markdown
Contributor Author

8ad031c adds a PHPUnit case that an Editor can still edit checklists in another user's comment, covering the moderate_comments branch of the reused filter. Suite: 86 tests, 151 assertions pass.

@lancewillett
lancewillett merged commit f11d5a9 into master Sep 2, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant