Comment author should be able to edit his comments for a half hour

[Denis-de-Bernardy]

It's a shame that, in 2010, WP still doesn't allow (even on wp.com) to edit one's comment for a half hour/an hour after writing it, in order to fix a typo.

[scribu]

I agree.

However, it's not a trivial task. Moving to Future Release until a patch is submitted.

Since we don't have a special template for editing... anything, here's how I think it could be done:

Have a special query_var that would populate the comment area with the desired comment to edit.

Example:

1. You have a post ​http://example.com/2010/01/my-post

2. A user posts a comment that gets the id 123.

3. He finds a typo and clicks on the "edit comment" link

4. He is sent to ​http://example.com/2010/01/my-post?edit_comment=123

5. On this page, the form is prefilled with the comment content.

6. The user edits the comment and clicks submit, as usual.

[scribu]

Related plugins:

​WP Ajax Edit Comments

​Front-end Editor

[miqrogroove]

I assume you mean for registered users only?

[scribu]

I assumed he meant for anonymous commenters as well.

For registered users only, it would be easier:

• add a link in the theme to the comment editing screen in the admin

• check if the current user is the author of the comment (or add a new capability: edit_own_comments)

[miqrogroove]

I did some light testing with anonymous comments. It looks like the author cookie isn't set unless the commenter fills the name field. Unless that gets changed, the editing feature wouldn't be available to everyone.

[miqrogroove]

Ah, you've also got trivial session fixation in the existing system. That's a deal-breaker for anonymous comment editing.

1. Fill the name field as 'user1' and leave a comment.

2. Delete author cookie or switch computers.

3. Leave a second comment with same name value as the first commenter.

WordPress resets the second user's author cookie with the first user's session key. The second user can now guess the comment ID number and edit the first user's comment.

Conversely:

1. Leave a comment using a known name, 'scribu'.

2. Use your favorite method to sneak your author cookie onto scribu's computer.

3. When scribu leaves a comment, the author key is already known by a third party and the comment ID number can be guessed for editing access.

[jane]

I'd like this to be available either in core or as a core plugin, too, but since it's been 2 years with no patch and there are plugins that do this, closing as wontfix.

[swissspidy]

#35245 was marked as a duplicate.