From 9d04a5d132d470cf3016188bf28c2b9e26865dbf Mon Sep 17 00:00:00 2001 From: Tim Hibberd Date: Mon, 23 Dec 2019 08:35:35 +1100 Subject: [PATCH 1/8] Bug fix to allow users to edit their own entries Fix included here involves: 1) passing in the commentid; 2) using the commentid in place of the postid for the comment author check; and; 3) initialising the postid used in the author question/answer author check when it is not passed in. See issue #238 for details. --- inc/Permission.php | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/inc/Permission.php b/inc/Permission.php index 71688a5c..f5f0e0eb 100644 --- a/inc/Permission.php +++ b/inc/Permission.php @@ -1,7 +1,10 @@ user_id ) ) { $post_author = $comment->user_id; } @@ -427,4 +430,4 @@ public function restrict_single_question( $posts ) { } } -?> \ No newline at end of file +?> From 981e1e89d87b5d027c53dc01361e499524cf5ff8 Mon Sep 17 00:00:00 2001 From: Tim Hibberd Date: Mon, 23 Dec 2019 08:40:34 +1100 Subject: [PATCH 2/8] Bug fix to allow users to edit their own comments Fix included here involves: 1) passing in the postid/commentid. See issue #238 for details. --- templates/content-comment.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/content-comment.php b/templates/content-comment.php index 519a6f6a..a989a718 100644 --- a/templates/content-comment.php +++ b/templates/content-comment.php @@ -15,7 +15,7 @@ user_id, true ); ?>
- + comment_id ) ) : ?> From 0b3d49c290471eb51b846346e1cc35a860fb16bd Mon Sep 17 00:00:00 2001 From: Tim Hibberd Date: Tue, 24 Dec 2019 19:39:26 +1100 Subject: [PATCH 3/8] Bug fix to comment / answer delete prompt When a user tried to delete a comment or answer they got an incorrect prompt 'Are you sure to delete this question' which was confusing especially when someone is deleting their comment associated with a question. --- templates/assets/js/dwqa-single-question.js | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/templates/assets/js/dwqa-single-question.js b/templates/assets/js/dwqa-single-question.js index cb043c93..4ad02bf9 100644 --- a/templates/assets/js/dwqa-single-question.js +++ b/templates/assets/js/dwqa-single-question.js @@ -108,9 +108,9 @@ }); }); - // delete question + // delete question, answer or comment $( '.dwqa_delete_question, .dwqa_delete_answer, .dwqa-delete-comment' ).on('click', function(e) { - var message = confirm( 'Are you sure to delete this question.' ); + var message = confirm( 'Are you sure to delete this item.' ); if ( !message ) { e.preventDefault(); @@ -175,4 +175,4 @@ current_form.find('.dwqa-form-submit').show(); }); -})(jQuery); \ No newline at end of file +})(jQuery); From 22e30fe3c1296e255c8647548580dea34ff03a3d Mon Sep 17 00:00:00 2001 From: Tim Hibberd Date: Tue, 24 Dec 2019 19:45:52 +1100 Subject: [PATCH 4/8] Bug fix to allow user to delete their comment This bug fix ensures the comment_ID is passed correctly to eliminate a false error when a user went to delete their own comment they added to their own question. --- inc/Ajax.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/inc/Ajax.php b/inc/Ajax.php index b41c0baa..2f0fd36b 100644 --- a/inc/Ajax.php +++ b/inc/Ajax.php @@ -25,11 +25,12 @@ public function __construct() { } public function delete_comment() { + $comment = get_comment( $_GET['comment_id'] ); if ( ! isset( $_GET['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( $_GET['_wpnonce'] ), '_dwqa_delete_comment' ) ) { wp_die( __( 'Are you cheating huh?', 'dw-question-answer' ) ); } - if ( !dwqa_current_user_can( 'delete_comment' ) ) { + if ( !dwqa_current_user_can( 'delete_comment', $comment->comment_post_ID, $comment->comment_ID ) ) { wp_die( __( 'You do not have permission to edit comment.', 'dw-question-answer' ) ); } @@ -37,8 +38,7 @@ public function delete_comment() { wp_die( __( 'Comment ID must be showed.', 'dw-question-answer' ) ); } - wp_delete_comment( intval( $_GET['comment_id'] ) ); - $comment = get_comment( $_GET['comment_id'] ); + wp_delete_comment( intval( $comment->comment_ID ) ); exit( wp_safe_redirect( dwqa_get_question_link( $comment->comment_post_ID ) ) ); } @@ -301,4 +301,4 @@ public function posts_where_suggest( $where ) { } return $where; } -} \ No newline at end of file +} From 5aa2cfa5b77b035dda49afcd8a13f4c5d293eff5 Mon Sep 17 00:00:00 2001 From: Tim Hibberd Date: Tue, 24 Dec 2019 19:49:27 +1100 Subject: [PATCH 5/8] Bug fix to get user comments delete to work Needed to pass the comment_id through to the permissions check in the case of a comment delete. --- inc/Permission.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inc/Permission.php b/inc/Permission.php index f5f0e0eb..b006b7e0 100644 --- a/inc/Permission.php +++ b/inc/Permission.php @@ -41,9 +41,9 @@ function dwqa_user_can( $user_id, $perm, $post_id = false, $comment_id = false ) return apply_filters( 'dwqa_user_can', $can, $perm, $user_id, $post_id ); } -function dwqa_current_user_can( $perm, $post_id = false ) { +function dwqa_current_user_can( $perm, $post_id = false, $comment_id = false ) { $current_user_id = get_current_user_id(); - $can = dwqa_user_can( $current_user_id, $perm, $post_id ); + $can = dwqa_user_can( $current_user_id, $perm, $post_id, $comment_id ); return apply_filters( 'dwqa_current_user_can', $can, $current_user_id, $perm, $post_id ); } From 9a379e0bf3bc3ba3bd180bbef89d56b4ff4e7aca Mon Sep 17 00:00:00 2001 From: Tim Hibberd Date: Tue, 24 Dec 2019 19:52:13 +1100 Subject: [PATCH 6/8] Correction to previous commit Corrected reference to comment_ID and added the extra parameter passing to delete_comment as well. --- templates/content-comment.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/content-comment.php b/templates/content-comment.php index a989a718..29e3752a 100644 --- a/templates/content-comment.php +++ b/templates/content-comment.php @@ -15,10 +15,10 @@ user_id, true ); ?>
- comment_id ) ) : ?> + comment_ID ) ) : ?> - + comment_ID ) ) : ?>
From de7d703d47ea50f0db849fa3cf1db58b55f10daf Mon Sep 17 00:00:00 2001 From: Tim Hibberd Date: Tue, 24 Dec 2019 20:47:39 +1100 Subject: [PATCH 7/8] Bug fix for User Delete Question The code was checking the user's answer permissions to proceed with the user's question deletion. This should have checked the quesiton permissions and passed through the question postid to the permissions checker. --- inc/Ajax.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inc/Ajax.php b/inc/Ajax.php index 2f0fd36b..a9276d76 100644 --- a/inc/Ajax.php +++ b/inc/Ajax.php @@ -168,7 +168,7 @@ public function delete_question() { wp_die( __( 'This post is not question.', 'dw-question-answer' ) ); } - if ( !dwqa_current_user_can( 'delete_answer' ) ) { + if ( !dwqa_current_user_can( 'delete_question', intval( $_GET['question_id'] ) ) ) { wp_die( __( 'You do not have permission to delete this post.', 'dw-question-answer' ) ); } From 9ec4ae40a9505dcc30781e875486b11c8020b271 Mon Sep 17 00:00:00 2001 From: Tim Hibberd Date: Tue, 24 Dec 2019 21:28:35 +1100 Subject: [PATCH 8/8] Bug fix - user could not edit question Needed to pass questionid to permissions checker. Also found another call involving answer_id. --- inc/Handle.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inc/Handle.php b/inc/Handle.php index b5f7b1b8..a0133ec8 100644 --- a/inc/Handle.php +++ b/inc/Handle.php @@ -137,7 +137,7 @@ public function insert_answer() { public function update_answer() { if ( isset( $_POST['dwqa-edit-answer-submit'] ) ) { - if ( !dwqa_current_user_can( 'edit_answer' ) ) { + if ( !dwqa_current_user_can( 'edit_answer', intval( $_POST['answer_id'] ) ) ) { dwqa_add_notice( __( "You do not have permission to edit answer.", 'dw-question-answer' ), 'error' ); } @@ -484,7 +484,7 @@ public function update_question() { if ( isset( $_POST['dwqa-edit-question-submit'] ) ) { if ( isset( $_POST['_wpnonce'] ) && wp_verify_nonce( esc_html( $_POST['_wpnonce'] ), '_dwqa_edit_question' ) ) { - if ( !dwqa_current_user_can( 'edit_question' ) ) { + if ( !dwqa_current_user_can( 'edit_question', intval( $_POST['question_id'] ) ) ) { dwqa_add_notice( __( "You do not have permission to edit question", 'dw-question-answer' ), 'error' ); }