From 4f5be9b7dea9a63226d6572bf18de4992d870f6c Mon Sep 17 00:00:00 2001
From: audrasjb <audrasjb@git.wordpress.org>
Date: Thu, 12 Oct 2023 12:38:21 +0000
Subject: [PATCH] Comments: Prevent users who can not see a post from seeing
 comments on it.

Props peterwilsoncc, jorbin, audrasjb.




Built from https://develop.svn.wordpress.org/trunk@56836


git-svn-id: http://core.svn.wordpress.org/trunk@56348 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/includes/class-wp-comments-list-table.php | 13 +++++++++++++
 wp-admin/includes/class-wp-list-table.php          | 14 ++++++++++++++
 wp-admin/includes/dashboard.php                    | 11 ++++++++++-
 wp-includes/version.php                            |  2 +-
 4 files changed, 38 insertions(+), 2 deletions(-)

diff --git a/wp-admin/includes/class-wp-comments-list-table.php b/wp-admin/includes/class-wp-comments-list-table.php
index b9eb0c2052..1433818ccf 100644
--- a/wp-admin/includes/class-wp-comments-list-table.php
+++ b/wp-admin/includes/class-wp-comments-list-table.php
@@ -654,6 +654,19 @@ class WP_Comments_List_Table extends WP_List_Table {
 
 		$this->user_can = current_user_can( 'edit_comment', $comment->comment_ID );
 
+		$edit_post_cap = $post ? 'edit_post' : 'edit_posts';
+		if (
+			current_user_can( $edit_post_cap, $comment->comment_post_ID ) ||
+			(
+				empty( $post->post_password ) &&
+				current_user_can( 'read_post', $comment->comment_post_ID )
+			)
+		) {
+			// The user has access to the post
+		} else {
+			return false;
+		}
+
 		echo "<tr id='comment-$comment->comment_ID' class='$the_comment_class'>";
 		$this->single_row_columns( $comment );
 		echo "</tr>\n";
diff --git a/wp-admin/includes/class-wp-list-table.php b/wp-admin/includes/class-wp-list-table.php
index fefb69380e..b3aebd9643 100644
--- a/wp-admin/includes/class-wp-list-table.php
+++ b/wp-admin/includes/class-wp-list-table.php
@@ -851,6 +851,20 @@ class WP_List_Table {
 			$pending_comments_number
 		);
 
+		$post_object   = get_post( $post_id );
+		$edit_post_cap = $post_object ? 'edit_post' : 'edit_posts';
+		if (
+			current_user_can( $edit_post_cap, $post_id ) ||
+			(
+				empty( $post_object->post_password ) &&
+				current_user_can( 'read_post', $post_id )
+			)
+		) {
+			// The user has access to the post and thus can see comments
+		} else {
+			return false;
+		}
+
 		if ( ! $approved_comments && ! $pending_comments ) {
 			// No comments at all.
 			printf(
diff --git a/wp-admin/includes/dashboard.php b/wp-admin/includes/dashboard.php
index 31eba07a2d..5b50423949 100644
--- a/wp-admin/includes/dashboard.php
+++ b/wp-admin/includes/dashboard.php
@@ -1109,7 +1109,16 @@ function wp_dashboard_recent_comments( $total_items = 5 ) {
 
 		echo '<ul id="the-comment-list" data-wp-lists="list:comment">';
 		foreach ( $comments as $comment ) {
-			_wp_dashboard_recent_comments_row( $comment );
+			$comment_post = get_post( $comment->comment_post_ID );
+			if (
+				current_user_can( 'edit_post', $comment->comment_post_ID ) ||
+				(
+					empty( $comment_post->post_password ) &&
+					current_user_can( 'read_post', $comment->comment_post_ID )
+				)
+			) {
+				_wp_dashboard_recent_comments_row( $comment );
+			}
 		}
 		echo '</ul>';
 
diff --git a/wp-includes/version.php b/wp-includes/version.php
index a8440824d6..8096228091 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '6.4-beta3-56835';
+$wp_version = '6.4-beta3-56836';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.