Ticket #39650: 39650.diff

src/wp-includes/comment.php

@@ -3005 +3005 @@
                  * @param int $comment_post_ID Post ID.
                  */
                 do_action( 'comment_on_draft', $comment_post_ID );
-
-                return new WP_Error( 'comment_on_draft' );
+                
+                if ( current_user_can( 'read_post', $comment_post_ID ) ) {
+                        return new WP_Error( 'comment_on_draft', __( 'Sorry, comments are not allowed for this item.' ), 403 );
+                } else {
+                        return new WP_Error( 'comment_on_draft' );
+                }
 
         } elseif ( post_password_required( $comment_post_ID ) ) {
 

tests/phpunit/tests/comment-submission.php

@@ -68 +68 @@
         }
 
         public function test_submitting_comment_to_draft_post_returns_error() {
-
                 $error = 'comment_on_draft';
 
                 $this->assertSame( 0, did_action( $error ) );
@@ -84 +83 @@
                 $this->assertSame( 1, did_action( $error ) );
                 $this->assertWPError( $comment );
                 $this->assertSame( $error, $comment->get_error_code() );
+                $this->assertEmpty( $comment->get_error_message() );
+
+        }
+
+        /**
+         * @ticket 39650
+         */
+        public function test_submitting_comment_to_draft_post_returns_error_message_for_user_with_correct_caps() {
+                $error = 'comment_on_draft';
+
+                $user   = self::factory()->user->create_and_get( array(
+                        'role' => 'author',
+                ) );
+
+                wp_set_current_user( $user->ID );
 
+                $this->assertSame( 0, did_action( $error ) );
+
+                $post = self::factory()->post->create_and_get( array(
+                        'post_status' => 'draft',
+                ) );
+                $data = array(
+                        'comment_post_ID' => $post->ID,
+                );
+                $comment = wp_handle_comment_submission( $data );
+
+                $this->assertSame( 1, did_action( $error ) );
+                $this->assertWPError( $comment );
+                $this->assertSame( $error, $comment->get_error_code() );
+                $this->assertNotEmpty( $comment->get_error_message() );
         }
 
         public function test_submitting_comment_to_scheduled_post_returns_error() {