Ticket #64779: 64779-notes-cap-fix.diff

src/wp-includes/capabilities.php

@@ -645 +645 @@
                         break;
 
                 case 'edit_comment':
+                case 'delete_comment':
+
+                        if ( empty( $args[0] ) ) {
+                                $caps[] = 'do_not_allow';
+                                break;
+                        }
+
+                        $comment = get_comment( $args[0] );
+
+                        if ( ! $comment ) {
+                                $caps[] = 'do_not_allow';
+                                break;
+                        }
+
+                        /*
+                         * Special handling for Notes.
+                         * Notes should not be editable by users who can edit the post
+                         * unless they are the note author. Users with manage_comments
+                         * can still edit/delete any note.
+                         */
+                        if ( 'note' === $comment->comment_type ) {
+
+                                // Allow if user is the note author.
+                                if ( (int) $comment->user_id === (int) $user_id ) {
+                                        $caps[] = 'edit_posts';
+                                } else {
+                                        $caps[] = 'manage_comments';
+                                }
+
+                                break;
+                        }
+
+                        // Default behavior for normal comments continues below.
 
                         if ( empty( $args[0] ) ) {
                                 $caps[] = 'do_not_allow';