Automattic / Automattic/o2

Unable to preview comments when restricted from posting.

Open
#215 1 comment 1 reaction 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
338
Forks
56
Avg merge
24m
Merged PRs (30d)
16

Description

When a user can comment on a o2 site, but cannot post to it, the user is unable to preview their o2 comments.

This is caused by the below code which requires that the user have edit post rights in order to use the preview endpoint.

https://github.com/Automattic/o2/blob/master/inc/read-api.php#L464-L468

This code branch should allow a comment preview (but NOT a post preview) when the user can create a comment, but alike, it should not allow a comment preview when the user cannot comment (ie. unauthenticated, or blocked from commenting too).

The experience a user will see when running into this situation, is a `The connection to the server has been interrupted. Please reconnect.` error.

As reported on the WordPress.org slack instance: https://wordpress.slack.com/archives/C02QB8GMM/p1636931587138600

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with inc/read-api.php at lines 464-468 and trace the preview endpoint's permission checks for comments and posts. Verify the behavior for users who can comment but cannot post, users blocked from commenting, and unauthenticated users. Done means eligible comment previews work without permitting post previews, while ineligible users remain denied without the connection error.

Written by the indexing model from the issue text.

Assessment

Tech stack
php, wordpress
Domain
api, authorization
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.