comments auto-created by new_blog_post activity replies do not respect post comment_status

[cyclic]

In a multisite BuddyPress install with the bp-disable-blogforum-comments option off, users can reply to new_blog_post activities which causes a WP comment to be created on the original post. Specifically, bp_blogs_sync_add_from_activity_comment() runs on the bp_activity_comment_posted hook and calls wp_insert_comment() with 'comment_approved' => 1 - and apparently never checks whether comments are allowed on the post in question.

This fixes the problem by removing that action if comments are disabled on the post:

/**
 * BuddyPress does not consider whether post comments are enabled when users reply to a post activity.
 * Remove the action responsible for posting the comment unless comments are enabled.
 *
 * @param int    $comment_id      The activity ID for the posted activity comment.
 * @param array  $params          Parameters for the activity comment.
 * @param object $parent_activity Parameters of the parent activity item (in this case, the blog post).
 */
function hcommons_constrain_activity_comments( $comment_id, $r, $activity ) {
	switch_to_blog( $activity->item_id );

	// BP filters comments_open to prevent comments on its own post types.
	// Disable it for `new_blog_post` activities.
	if ( 'new_blog_post' === $activity->type ) {
		remove_filter( 'comments_open', 'bp_comments_open', 10, 2 );
	}

	if ( ! comments_open( $activity->secondary_item_id ) ) {
		remove_action( 'bp_activity_comment_posted', 'bp_blogs_sync_add_from_activity_comment', 10, 3 );
	}

	restore_current_blog();
}
// Priority 5 to run before bp_blogs_sync_add_from_activity_comment()
add_action( 'bp_activity_comment_posted', 'hcommons_constrain_activity_comments', 5, 3 );

I wasn't sure the best place to put this, but it seems like bp_blogs_sync_add_from_activity_comment() should check comments_open() before calling wp_insert_comment(). If you agree let me know and I'll submit a patch.

P.S. I had to filter bp_comments_open() here because it returns false incorrectly in some activity feeds (where is_buddypress() is true but the post in question isn't in fact a BP post type). I just removed that filter since in this case I know every post is a regular WP post and not a BP post type, but is that a separate multisite bug that requires its own bp_force_comment_status filter? I get the impression I might be abusing comments_open() as it seems to be intended only for post templates but I couldn't find a better method.

[r-a-y]

Nice catch, @cyclic, and thanks for the in-depth report.

Can you try the following patch to see if it works for you? I've tentatively put this in the 3.1 milestone since 3.0 is in beta at the moment.

[cyclic]

I tested your patch and it works great. Thanks @r-a-y !

[DJPaul]

Milestone renamed

[djpaul]

In 12169:

Blogs, Activity: prevent replies to posts' activity comments when that post has disabled comments.

Fixes #7766

Props cyclic, r-a-y