Ticket #30091: 30091.diff

src/wp-comments-post.php

@@ -58 +58 @@
          */
         do_action( 'comment_on_trash', $comment_post_ID );
         exit;
-} elseif ( ! $status_obj->public && ! $status_obj->private ) {
-        /**
-         * Fires when a comment is attempted on a post in draft mode.
-         *
-         * @since 1.5.1
-         *
-         * @param int $comment_post_ID Post ID.
-         */
-        do_action( 'comment_on_draft', $comment_post_ID );
-        exit;
 } elseif ( post_password_required( $comment_post_ID ) ) {
         /**
          * Fires when a comment is attempted on a password-protected post.
@@ -79 +69 @@
         do_action( 'comment_on_password_protected', $comment_post_ID );
         exit;
 } else {
-        /**
-         * Fires before a comment is posted.
-         *
-         * @since 2.8.0
-         *
-         * @param int $comment_post_ID Post ID.
-         */
-        do_action( 'pre_comment_on_post', $comment_post_ID );
+        if ( ! $status_obj->public && ! $status_obj->private && current_user_can( 'edit_posts') ) {
+
+                /**
+                 * Fires when a comment is attempted on a post in draft mode.
+                 *
+                 * @since 1.5.1
+                 *
+                 * @param int $comment_post_ID Post ID.
+                 */
+                do_action( 'comment_on_draft', $comment_post_ID );
+
+                /**
+                 * Fires before a comment is posted.
+                 *
+                 * @since 2.8.0
+                 *
+                 * @param int $comment_post_ID Post ID.
+                 */
+                do_action( 'pre_comment_on_post', $comment_post_ID );
+        } else {
+                do_action( 'pre_comment_on_post', $comment_post_ID );
+        }
 }
 
 $comment_author       = ( isset($_POST['author']) )  ? trim(strip_tags($_POST['author'])) : null;