WP1.5: Allow users to edit their own comments

I think you’re right. I had hacked 1.2 so that equal level users couldn’t edit each other’s posts.

But it would indeed be very helpful, if (in wp-includes/functions-post.php)
function user_can_edit_post_comments($user_id, $post_id, $blog_id = 1) would get the actual comment as argument, so that such a check can easily be incorporated.

Sure. Here’s the diff. I essentially added a comment_id argument to user_can_edit/delete_post and then changed these functions to allow a user to edit their own comments IF
– they either wrote the original post, or
– have the same userlevel as the post author (could be changed to e.g. userlevel >= 1 ) and have the same nickname as the one used on the comment.

diff -uNr wp1.5wp-adminedit-comments.php wp1.5_ev1lwp-adminedit-comments.php
--- wp1.5wp-adminedit-comments.php Fri Feb 11 02:00:38 2005
+++ wp1.5_ev1lwp-adminedit-comments.php Tue Feb 22 16:23:00 2005
@@ -43,7 +43,7 @@
$comment = (int) $comment;
$post_id = $wpdb->get_var("SELECT comment_post_ID FROM $wpdb->comments WHERE comment_ID = $comment");
$authordata = get_userdata( $wpdb->get_var("SELECT post_author FROM $wpdb->posts WHERE ID = $post_id") );
- if ( user_can_delete_post_comments($user_ID, $post_id) ) :
+ if ( user_can_delete_post_comments($user_ID, $post_id, $comment) ) :
$wpdb->query("DELETE FROM $wpdb->comments WHERE comment_ID = $comment");
++$i;
endif;
@@ -93,10 +93,10 @@
<?php comment_text() ?>

<p><?php _e('Posted'); echo ' '; comment_date('M j, g:i A');
- if ( user_can_edit_post_comments($user_ID, $comment->comment_post_ID) ) {
+ if ( user_can_edit_post_comments($user_ID, $comment->comment_post_ID, $comment->comment_ID) ) {
echo " | <a href=\"post.php?action=editcomment&amp;comment=".$comment->comment_ID."\">" . __('Edit Comment') . "</a>";
}
- if ( user_can_delete_post_comments($user_ID, $comment->comment_post_ID) ) {
+ if ( user_can_delete_post_comments($user_ID, $comment->comment_post_ID, $comment->comment_ID) ) {
echo " | <a href=\"post.php?action=deletecomment&amp;p=".$comment->comment_post_ID."&amp;comment=".$comment->comment_ID."\" onclick=\"return confirm('" . sprintf(__("You are about to delete this comment by '%s'\n 'Cancel' to stop, 'OK' to delete."), $comment->comment_author) . "')\">" . __('Delete Comment') . "</a> — ";
} // end if any comments to show
// Get post title
@@ -138,15 +138,15 @@
$class = ('alternate' == $class) ? '' : 'alternate';
?>
<tr class='<?php echo $class; ?>'>
- <td><?php if (user_can_delete_post_comments($user_ID, $comment->comment_post_ID) ) { ?><input type="checkbox" name="delete_comments[]" value="<?php echo $comment->comment_ID; ?>" /><?php } ?></td>
+ <td><?php if (user_can_delete_post_comments($user_ID, $comment->comment_post_ID, $comment->comment_ID) ) { ?><input type="checkbox" name="delete_comments[]" value="<?php echo $comment->comment_ID; ?>" /><?php } ?></td>
<td><?php comment_author_link() ?></td>
<td><?php comment_author_email_link() ?></td>
<td><a href="http://ws.arin.net/cgi-bin/whois.pl?queryinput=&lt;?php comment_author_IP() ?>"><?php comment_author_IP() ?></a></td>
<td><?php comment_excerpt(); ?></td>
<td><a href="<?php echo get_permalink($comment->comment_post_ID); ?>#comment-<?php comment_ID() ?>" class="edit"><?php _e('View') ?></a></td>
- <td><?php if ( user_can_edit_post_comments($user_ID, $comment->comment_post_ID) ) {
+ <td><?php if ( user_can_edit_post_comments($user_ID, $comment->comment_post_ID, $comment->comment_ID) ) {
echo "<a href='post.php?action=editcomment&amp;comment=$comment->comment_ID' class='edit'>" . __('Edit') . "</a>"; } ?></td>
- <td><?php if ( user_can_delete_post_comments($user_ID, $comment->comment_post_ID) ) {
+ <td><?php if ( user_can_delete_post_comments($user_ID, $comment->comment_post_ID, $comment->comment_ID) ) {
echo "<a href=\"post.php?action=deletecomment&amp;p=".$comment->comment_post_ID."&amp;comment=".$comment->comment_ID."\" onclick=\"return confirm('" . sprintf(__("You are about to delete this comment by '%s'\n 'Cancel' to stop, 'OK' to delete."), $comment->comment_author) . "')\" class='delete'>" . __('Delete') . "</a>"; } ?></td>
</tr>
<?php
diff -uNr wp1.5wp-adminpost.php wp1.5_ev1lwp-adminpost.php
--- wp1.5wp-adminpost.php Mon Feb 14 09:46:08 2005
+++ wp1.5_ev1lwp-adminpost.php Tue Feb 22 16:25:00 2005
@@ -464,7 +464,7 @@
$comment = $_GET['comment'];
$commentdata = get_commentdata($comment, 1, true) or die(sprintf(__('Oops, no comment with this ID. <a href="%s">Go back</a>!'), 'javascript:history.go(-1)'));

- if (!user_can_edit_post_comments($user_ID, $commentdata['comment_post_ID'])) {
+ if (!user_can_edit_post_comments($user_ID, $commentdata['comment_post_ID'], $comment)) {
die('You are not allowed to edit comments on this post.');
}

@@ -486,7 +486,7 @@
$p = $_GET['p'];
$commentdata = get_commentdata($comment, 1, true) or die(sprintf(__('Oops, no comment with this ID. <a href="%s">Go back</a>!'), 'edit.php'));

- if (!user_can_delete_post_comments($user_ID, $commentdata['comment_post_ID'])) {
+ if (!user_can_delete_post_comments($user_ID, $commentdata['comment_post_ID'], $comment)) {
die('You are not allowed to delete comments on this post.');
}

@@ -528,7 +528,7 @@
$postdata = get_postdata($p) or die(sprintf(__('Oops, no post with this ID. <a href="%s">Go back</a>!'), 'edit.php'));
$commentdata = get_commentdata($comment, 1, true) or die(sprintf(__('Oops, no comment with this ID. <a href="%s">Go back</a>!'), 'post.php'));

- if (!user_can_delete_post_comments($user_ID, $commentdata['comment_post_ID'])) {
+ if (!user_can_delete_post_comments($user_ID, $commentdata['comment_post_ID'], $comment)) {
die('You are not allowed to edit comments on this post.');
}

@@ -559,7 +559,7 @@

$commentdata = get_commentdata($comment) or die(sprintf(__('Oops, no comment with this ID. <a href="%s">Go back</a>!'), 'edit.php'));

- if (!user_can_edit_post_comments($user_ID, $commentdata['comment_post_ID'])) {
+ if (!user_can_edit_post_comments($user_ID, $commentdata['comment_post_ID'], $comment)) {
die('You are not allowed to edit comments on this post, so you cannot disapprove this comment.');
}

@@ -579,7 +579,7 @@

$commentdata = get_commentdata($comment, 1, true) or die(sprintf(__('Oops, no comment with this ID. <a href="%s">Go back</a>!'), 'edit.php'));

- if (!user_can_edit_post_comments($user_ID, $commentdata['comment_post_ID'])) {
+ if (!user_can_edit_post_comments($user_ID, $commentdata['comment_post_ID'], $comment)) {
die('You are not allowed to edit comments on this post, so you cannot approve this comment.');
}

@@ -604,7 +604,7 @@
}
$commentdata = get_commentdata($comment) or die(sprintf(__('Oops, no comment with this ID. <a href="%s">Go back</a>!'), 'edit.php'));

- if (!user_can_edit_post_comments($user_ID, $commentdata['comment_post_ID'])) {
+ if (!user_can_edit_post_comments($user_ID, $commentdata['comment_post_ID'], $comment)) {
die('You are not allowed to edit comments on this post, so you cannot approve this comment.');
}

@@ -631,7 +631,7 @@
$newcomment_author_url = $_POST['newcomment_author_url'];
$comment_status = $_POST['comment_status'];

- if (!user_can_edit_post_comments($user_ID, $comment_post_ID)) {
+ if (!user_can_edit_post_comments($user_ID, $comment_post_ID, $comment_ID)) {
die('You are not allowed to edit comments on this post, so you cannot edit this comment.');
}

diff -uNr wp1.5wp-includesfunctions-post.php wp1.5_ev1lwp-includesfunctions-post.php
--- wp1.5wp-includesfunctions-post.php Wed Feb 16 22:01:52 2005
+++ wp1.5_ev1lwp-includesfunctions-post.php Tue Feb 22 16:56:00 2005
@@ -381,15 +381,20 @@
}

/* returns true if $user_id can edit $post_id's comments */
-function user_can_edit_post_comments($user_id, $post_id, $blog_id = 1) {
+function user_can_edit_post_comments($user_id, $post_id, $comment_id, $blog_id = 1) {
+ $author_data = get_userdata($user_id);
+ $post_data = get_postdata($post_id);
+ $post_author_data = get_userdata($post_data['Author_ID']);
+ $commd = get_commentdata($comment_id, 1);
+
// right now if one can edit a post, one can edit comments made on it
- return user_can_edit_post($user_id, $post_id, $blog_id);
+ return user_can_edit_post($user_id, $post_id, $blog_id) || ($author_data->user_level == $post_author_data->user_level && $author_data->user_nickname == $commd['comment_author']);
}

/* returns true if $user_id can delete $post_id's comments */
-function user_can_delete_post_comments($user_id, $post_id, $blog_id = 1) {
+function user_can_delete_post_comments($user_id, $post_id, $comment_id, $blog_id = 1) {
// right now if one can edit comments, one can delete comments
- return user_can_edit_post_comments($user_id, $post_id, $blog_id);
+ return user_can_edit_post_comments($user_id, $post_id, $comment_id, $blog_id);
}

function user_can_edit_user($user_id, $other_user) {
diff -uNr wp1.5wp-includestemplate-functions-links.php wp1.5_ev1lwp-includestemplate-functions-links.php
--- wp1.5wp-includestemplate-functions-links.php Wed Feb 16 15:49:02 2005
+++ wp1.5_ev1lwp-includestemplate-functions-links.php Tue Feb 22 16:50:00 2005
@@ -193,8 +193,8 @@
global $user_ID, $post, $comment;

get_currentuserinfo();
-
- if (!user_can_edit_post_comments($user_ID, $post->ID)) {
+
+ if (!user_can_edit_post_comments($user_ID, $post->ID, $comment->comment_ID)) {
return;
}