Comments visibile on restricted posts

yknivag
(@yknivag)

7 years, 2 months ago

When restricting posts to a specific user group, if I use “blocked” then the post itself is replaced correctly with “This content is not available for your user group”, but the comments below are visible for that user.

Furthermore, if I choose “hidden” then the post disappears from the archives etc as designed, but all the comments for that post still show up in the “Recent Comments” widget and when clicked the user gets a 404 error.

If the post is restricted then this should restrict the comments also, otherwise it is not really stopping the content as someone with access could simply quote the post in the comment and everyone can see it.

Oddly logged out users can’t see the comments, they just get the login page. It’s only restriction between user groups that doesn’t work.

Viewing 5 replies - 1 through 5 (of 5 total)

Thread Starter yknivag
(@yknivag)

7 years, 2 months ago

It does seem just to be viewing of comments that is buggy, I can’t leave a comment on a post my membership group can’t see, but I can see all comments from all groups under posts I can’t see.
Thread Starter yknivag
(@yknivag)

7 years, 2 months ago
Seems to be fixable by changing lines 860-863 of class-wp-members.php from
```
	function do_securify_comments_array( $comments , $post_id ) {
		$comments = ( ! is_user_logged_in() && wpmem_is_blocked() ) ? array() : $comments;
		return $comments;
	}
```
to
```
	function do_securify_comments_array( $comments , $post_id ) {
		$comments = ( ! is_user_logged_in() || wpmem_is_blocked() ) ? array() : $comments;
		return $comments;
	}
```
But I’m not sure if this is the correct way to fix it. Is there a better way? Should it be fixed properly so that it would survive an update?
Plugin Author Chad Butler
(@cbutlerjr)

7 years, 2 months ago

It sounds like this is an issue when you’re using specified Memberships? And specifically, when using “hidden” for the post restriction, right?

While the change you indicated may resolve the issue in your instance, I don’t think that’s going to work in all cases because wpmem_is_blocked() will return true even if a user is logged in.

I’ll note this for review and see if I can reproduce the issue. If I can, then I should be able to find a resolution for it and update accordingly.

Thread Starter yknivag
(@yknivag)

7 years, 2 months ago

Thanks for replying @cbutlerjr

I can’t use “hidden mode” at the moment due to a separate issue with that (see https://ww.wp.xz.cn/support/topic/recent-comments-widget-issue/) so I’m using “blocked”.

The way I see it the comments on a blocked post should only be visible if the user is logged in and also has permission to read the post. If there is no user logged in OR the user doesn’t have permission then the $comments array should be nulled.

I think the confusion arises because line 861 is a double negative. Another way of doing it would be:
$comments = ( is_user_logged_in() && ! wpmem_is_blocked() ) ? $comments : array();
ie “If a user is logged in AND the post is NOT blocked THEN show the comments, otherwise hide them.”

For example, if I have two levels of membership “Silver” and “Gold”. I don’t want people with “Silver” membership being able to read comments on “Gold” posts. I can’t think of any use case where someone would want to restrict a post but have the comments visible where the post wasn’t.

I’ve not done exhaustive regression testing, but I can say that after my change comments on “blocked” posts are not visible if no user is logged in, or if the logged-in user isn’t in the correct group but are visible and open for replies if a user in the correct group logs in. Hope that helps.

I have to say that other than this little issue and the other thread I’ve opened this has to be by a long way the best content restriction plug in in the WordPress directory. I’ve tested almost every free similar plugin over the last fortnight and none of the others are as intuitive to use or as complete.

Plugin Author Chad Butler
(@cbutlerjr)

7 years, 2 months ago

I totally understand what you’re saying and I believe I can work out the issues – but I’ll have to track down where that needs to work out, and it may require some additional changes.

The way I see it the comments on a blocked post should only be visible if the user is logged in and also has permission to read the post. If there is no user logged in OR the user doesn’t have permission then the $comments array should be nulled.

I think the confusion arises because line 861 is a double negative. Another way of doing it would be:
$comments = ( is_user_logged_in() && ! wpmem_is_blocked() ) ? $comments : array();
ie “If a user is logged in AND the post is NOT blocked THEN show the comments, otherwise hide them.”

Part of the problem with how you’re looking at it is that you’re looking at wpmem_is_blocked() as an access conditional (i.e. whether a user has access or not), but that’s not how that function works. If a post is blocked, it will return true always – it has nothing to do with the user.

We’re kind of in a transitional period in the plugin’s development – moving from a single membership to multiple. It’s also new to allow content to be “hidden”. Between those two newer features, there are situations where some previously unseen issues may come into play.

In terms of the comments with regards to hidden posts, those are currently determined in the main object class (what you’ve already been looking at), but there is an additional element in the Products class (that handles memberships) and the comments are filtered there based on user access.

I think all of that works fine for whether comments are displayed on the post or not. However, in situations like a “recent comments” widget that may not work out as intended/needed.

It may be that the comments array needs to be handled earlier than it currently is. It may need to be something that loads into the plugin’s main object right away – OR – alternatively, another approach may be that if the comments array is accessed and it contains comments from multiple posts (such as recent comments) that any that match inaccessible post IDs are dropped from the array.

I’m not sure what the ultimate solution will be – these are just general thoughts at present – but I will review it for improvement.

I have to say that other than this little issue and the other thread I’ve opened this has to be by a long way the best content restriction plug in in the WordPress directory. I’ve tested almost every free similar plugin over the last fortnight and none of the others are as intuitive to use or as complete.

Glad to hear that – I do try to make it as simple/intuitive as possible.

Viewing 5 replies - 1 through 5 (of 5 total)

The topic ‘Comments visibile on restricted posts’ is closed to new replies.