It appears that looping through wp_comment_query() with the argument post_status set to publish also lists comments that are posted on password protected posts.

Is this the correct behavior or is this a bug? How can I avoid looping through comments submitted to password protected posts?

I checked through the database wp_comments table and there doesn't seem to be a relevant entry to play with.

Using the Query Monitor plugin, I was able to inspect the SQL query:

FROM wp_comments JOIN wp_posts
ON wp_posts.ID = wp_comments.comment_post_ID
WHERE ( comment_approved = '1' )
AND wp_posts.post_status IN ('publish')
AND wp_posts.post_type IN ('post')
ORDER BY wp_comments.comment_date_gmt DESC

To clarify the problem, as it stands, if you use wp_comment_query() to display comments (for example in the front-end), then comments that were posted on password protected posts are looped through.

  • Could you post the code that queries your comments, as well as the resulting SQL statement? – kovshenin Jul 29 '15 at 19:16
  • so $comments = WP_Comment_Query( array( 'post_status' => 'publish' ) ); give you comments to private posts? Could you post the resulting SQL query? – kovshenin Jul 29 '15 at 19:24
  • You can do it with a plugin like Query Monitor or the Debug Bar series. – kovshenin Jul 29 '15 at 20:05
  • Yeah, so that query makes sure comments are taken for published posts only. Why do you think it's returning comments for private posts as well? Can you print_r the returned set and check the post ID's against the database posts table? – kovshenin Jul 30 '15 at 19:43
  • @kovshenin It appears this issue is related to password protected posts, not private posts. That was my mistake. You can test this behavior as well. Simply create a password protected post, post a comment with a specific user and run the following by adding the $user_id... for example: $comments = WP_Comment_Query( array( 'post_status' => 'publish', 'post_author' => $user_id ) ); – Christine Cooper Jul 30 '15 at 22:47

It's not a bug (gasp!) really just not provided for. You have to add a filter to do this, eg

add_filter( 'comments_clauses', function ( $pieces, $query ) {
    if ( empty( $query->query_vars['wpse_no_password'] ) ) return $pieces;
    global $wpdb;
    $pieces[ 'where' ] .= $wpdb->prepare( ' AND ' . $wpdb->posts . '.post_password = %s', '' );
    return $pieces;
}, 10, 2 );

$args = array( 'post_status' => 'publish', 'wpse_no_password' => 1 );
$query = new WP_Comment_Query( $args );
| improve this answer | |
  • This is great bonger! IMO this behavior should be considered in core because comment entries in password protected posts should essentially be hidden (private) from a loop unless otherwise requested. – Christine Cooper Jul 31 '15 at 14:02
  • 1
    You have a point, though a quick scan of trac reveals a backend bug core.trac.wordpress.org/ticket/25338 that was downgraded to an enhancement (and then slid into the usual trac pit of endless silence...) – bonger Jul 31 '15 at 16:13
  • You have some amazing skills finding things in trac. I should invest time searching there prior to asking here. Thanks again! – Christine Cooper Jul 31 '15 at 23:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.