Skip to:

Opened 6 years ago

Closed 6 years ago

#7766 closed defect (bug) (fixed)

comments auto-created by new_blog_post activity replies do not respect post comment_status

Reported by: cyclic's profile cyclic Owned by: djpaul's profile djpaul
Milestone: 4.0 Priority: normal
Severity: normal Version: 2.5.0
Component: Blogs Keywords: has-patch commit


In a multisite BuddyPress install with the bp-disable-blogforum-comments option off, users can reply to new_blog_post activities which causes a WP comment to be created on the original post. Specifically, bp_blogs_sync_add_from_activity_comment() runs on the bp_activity_comment_posted hook and calls wp_insert_comment() with 'comment_approved' => 1 - and apparently never checks whether comments are allowed on the post in question.

This fixes the problem by removing that action if comments are disabled on the post:

 * BuddyPress does not consider whether post comments are enabled when users reply to a post activity.
 * Remove the action responsible for posting the comment unless comments are enabled.
 * @param int    $comment_id      The activity ID for the posted activity comment.
 * @param array  $params          Parameters for the activity comment.
 * @param object $parent_activity Parameters of the parent activity item (in this case, the blog post).
function hcommons_constrain_activity_comments( $comment_id, $r, $activity ) {
	switch_to_blog( $activity->item_id );

	// BP filters comments_open to prevent comments on its own post types.
	// Disable it for `new_blog_post` activities.
	if ( 'new_blog_post' === $activity->type ) {
		remove_filter( 'comments_open', 'bp_comments_open', 10, 2 );

	if ( ! comments_open( $activity->secondary_item_id ) ) {
		remove_action( 'bp_activity_comment_posted', 'bp_blogs_sync_add_from_activity_comment', 10, 3 );

// Priority 5 to run before bp_blogs_sync_add_from_activity_comment()
add_action( 'bp_activity_comment_posted', 'hcommons_constrain_activity_comments', 5, 3 );

I wasn't sure the best place to put this, but it seems like bp_blogs_sync_add_from_activity_comment() should check comments_open() before calling wp_insert_comment(). If you agree let me know and I'll submit a patch.

P.S. I had to filter bp_comments_open() here because it returns false incorrectly in some activity feeds (where is_buddypress() is true but the post in question isn't in fact a BP post type). I just removed that filter since in this case I know every post is a regular WP post and not a BP post type, but is that a separate multisite bug that requires its own bp_force_comment_status filter? I get the impression I might be abusing comments_open() as it seems to be intended only for post templates but I couldn't find a better method.

Attachments (1)

7766.01.patch (513 bytes) - added by r-a-y 6 years ago.

Download all attachments as: .zip

Change History (6)

#1 @r-a-y
6 years ago

  • Keywords has-patch added
  • Milestone changed from Awaiting Review to 3.1
  • Version changed from 2.9.4 to 2.5.0

Nice catch, @cyclic, and thanks for the in-depth report.

Can you try the following patch to see if it works for you? I've tentatively put this in the 3.1 milestone since 3.0 is in beta at the moment.

6 years ago

#2 @cyclic
6 years ago

I tested your patch and it works great. Thanks @r-a-y !

#3 @DJPaul
6 years ago

  • Milestone changed from 3.1 to 4.0

Milestone renamed

#4 @DJPaul
6 years ago

  • Keywords commit added

#5 @djpaul
6 years ago

  • Owner set to djpaul
  • Resolution set to fixed
  • Status changed from new to closed

In 12169:

Blogs, Activity: prevent replies to posts' activity comments when that post has disabled comments.

Fixes #7766

Props cyclic, r-a-y

Note: See TracTickets for help on using tickets.