Ticket #23939: wp_ajax_replyto_comment.patch

wp-admin/includes/ajax-actions.php

@@ -728 +728 @@
         if ( ! $post )
                 wp_die( -1 );
 
-        if ( !current_user_can( 'edit_post', $comment_post_ID ) )
+        $comment_parent = absint($_POST['comment_ID']);
+        if ( !current_user_can( 'edit_comment', $comment_parent ) )
                 wp_die( -1 );
 
         if ( empty( $post->post_status ) )
@@ -756 +757 @@
         if ( '' == $comment_content )
                 wp_die( __( 'ERROR: please type a comment.' ) );
 
-        $comment_parent = absint($_POST['comment_ID']);
         $comment_auto_approved = false;
         $commentdata = compact('comment_post_ID', 'comment_author', 'comment_author_email', 'comment_author_url', 'comment_content', 'comment_type', 'comment_parent', 'user_ID');