| @@ -119,8 +119,12 @@ | ||
| 119 | 119 | do_action( 'ep_comment_after_search_widget', $comment_query, $request ); |
| 120 | 120 | |
| 121 | 121 | $return = []; |
| 122 | 122 | foreach ( $comment_query->comments as $comment ) { |
| 123 | + if ( ! $this->can_read_comment( $comment ) ) { | |
| 124 | + continue; | |
| 125 | + } | |
| 126 | + | |
| 123 | 127 | $return[ $comment->comment_ID ] = [ |
| 124 | 128 | 'id' => $comment->comment_ID, |
| 125 | 129 | 'content' => $comment->comment_content, |
| 126 | 130 | 'link' => get_comment_link( $comment ), |
| @@ -135,8 +139,32 @@ | ||
| 135 | 139 | * @param {array} $return The result of fetched comments. |
| 136 | 140 | * @return {array} New value |
| 137 | 141 | */ |
| 138 | 142 | return apply_filters( 'ep_comment_search_widget_response', $return ); |
| 143 | + } | |
| 144 | + | |
| 145 | + /** | |
| 146 | + * Whether the current user can read a comment's parent post. | |
| 147 | + * | |
| 148 | + * Mirrors WP_REST_Comments_Controller::check_read_post_permission() for a | |
| 149 | + * collection search: password-protected parents stay hidden unless the | |
| 150 | + * visitor has the password cookie or can edit the post. | |
| 151 | + * | |
| 152 | + * @since 5.3.5 | |
| 153 | + * @param \WP_Comment $comment Comment object. | |
| 154 | + * @return bool | |
| 155 | + */ | |
| 156 | + protected function can_read_comment( $comment ) { | |
| 157 | + $post = get_post( (int) $comment->comment_post_ID ); | |
| 158 | + if ( ! $post ) { | |
| 159 | + return false; | |
| 160 | + } | |
| 161 | + | |
| 162 | + if ( post_password_required( $post ) ) { | |
| 163 | + return current_user_can( 'edit_post', $post->ID ); | |
| 164 | + } | |
| 165 | + | |
| 166 | + return true; | |
| 139 | 167 | } |
| 140 | 168 | |
| 141 | 169 | /** |
| 142 | 170 | * Get searchable post types. |
