Fix lesson comments being visible to unregistered users in some cases #7848
Conversation
m1r0
changed the title
There was a problem hiding this comment.
Pull Request Overview
This PR fixes a security issue where lesson comments were visible to unregistered users or users without lesson access when using Full Site Editing themes with Learning Mode disabled. The fix introduces proper permission checking before displaying comments.
- Replaces boolean theme/post-type checks with user permission validation
- Adds new method to centralize comment visibility logic
- Ensures comments are only shown to users who can view the lesson
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| includes/unsupported-theme-handlers/class-sensei-unsupported-theme-handler-cpt.php | Implements permission-based comment visibility control by replacing theme checks with user access validation |
| changelog/fix-lesson-comments-visible-to-unregistered-users | Documents the security fix in the changelog |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
includes/unsupported-theme-handlers/class-sensei-unsupported-theme-handler-cpt.php
Outdated
Show resolved
Hide resolved
Co-authored-by: Copilot <[email protected]>
|
@donnapep, could you please give this one a look and tell me if it makes sense? I'm somewhat concerned that I might be fixing something that is a feature for some users. |
|
This was the issue I was thinking of related to comments - #2192. I didn't test, but if the scenario described in that PR still works, then this change seems fine. |
|
I just checked, and the lesson preview scenario still works as expected with this change. Appreciate the feedback, Donna! 🙇 |
Reported in 10207255-zd-a8c
Discussion 10207255-zd-a8cp1757609717205269-slack-C07418EJ0
Proposed Changes
This PR disables the lesson comments for users who are unregistered or don't have access to the lesson. This is only a case when Learning Mode is off and the theme supports Full Site Editing.
Testing Instructions
Pre-Merge Checklist