fix: only count previously approved normal comments for auto-approval

[faisalahammad]

Fixes #3579

Proposed changes:

When a remote account likes or reposts a post, the plugin stores that as an approved comment (with a non-default comment type such as like or repost). The pre_comment_approved filter then looked up whether the same author already had an approved comment, but did not filter by comment type. So that approved reaction counted as a "previously approved comment", and it auto-approved the same account's later normal replies even when "Comment author must have a previously approved comment" was enabled.

The fix mirrors what WordPress core's wp_allow_comment() does: it only counts prior approved comments of type comment, so reactions no longer leak approval to real replies. An account that previously replied normally is still auto-approved.

Other information:

• Have you written new tests for your changes, if applicable?

Added test_pre_comment_approved_ignores_reactions() in tests/phpunit/tests/includes/class-test-comment.php, which inserts an approved like from a remote actor and verifies that a normal reply from the same actor stays held for moderation.

Testing instructions:

Because $comment_previously_approved needs to affect published replies, the trickiest part is setting up the scenario:

• Enable "Comment author must have a previously approved comment" (Settings -> Discussion).
• From a remote Mastodon account that has never commented on your site, like one of your posts (auto-approve Likes must be enabled).
• From that same account, reply with a normal comment on another post.
• The reply should land in Comments as pending (held for moderation), not approved.

Before this fix, that reply was auto-approved, because the account's previous Like was treated as a previously approved comment. A remote account that previously submitted a normal comment should still be auto-approved.

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message

Fixed normal replies from distant accounts sometimes being auto-approved just because that account had previously liked or reposted a post.

[Copilot]

🟡 Changes recommended

The updated query’s comment_type constraint and the new test’s setup both have correctness gaps that could cause regressions or allow the test to pass without exercising the intended plugin logic.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR fixes an auto-moderation loophole where previously approved reactions (like/repost) from a remote ActivityPub actor could incorrectly satisfy WordPress’s “comment author must have a previously approved comment” requirement, causing that actor’s later normal replies to be auto-approved.

Changes:

• Restricts the “previously approved comment” lookup to only count normal comments (excluding reaction comment types).
• Adds a PHPUnit regression test to ensure approved reactions don’t grant auto-approval to later normal replies.
• Adds a patch-level changelog entry documenting the moderation behavior fix.

File summaries

File	Description
includes/class-comment.php	Updates the previously-approved lookup query to filter by comment type so reactions don’t “leak” approval to replies.
tests/phpunit/tests/includes/class-test-comment.php	Adds a regression test to ensure approved reactions do not satisfy comment_previously_approved for later normal replies.
.github/changelog/fix-3579-auto-approved-comments	Patch changelog entry describing the moderation fix in user-facing terms.

Review details

Suppressed comments (1)

tests/phpunit/tests/includes/class-test-comment.php:296

• This test mutates global state (removes the comment flood action and changes the comment_previously_approved option) but only restores it at the end of the method. If an assertion fails mid-test, the restoration won’t run and can leak state into subsequent tests. Use a try/finally to guarantee restoration.

		// Disable flood control.
		\remove_action( 'check_comment_flood', 'check_comment_flood_db' );

		$previous = \get_option( 'comment_previously_approved' );
		\update_option( 'comment_previously_approved', '1' );

• Files reviewed: 3/3 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.