Can this be used on cached pages?

Daan,

I talked to Ryan a bit as well, and my answer at this point is: I’m not sure.

Immediately after the comment is posted, a cookie is set in the user’s browser with a hash based on a random salt and the commenter’s IP address and the time of the comment. This hash is also stored as post meta for the post.

When the page is refreshed, this stored hash is checked against the cookie, and if passed, the user can edit the comment. The actual comment is wrapped with some DIVs, then once JS is initialized, the DOM is inspected, and if found, the user interface is shown and a timer is shown as well.

I would be afraid at this point that if the page were cached, then other users may see the “click to edit” button and try to edit that comment. Since they do not have the cookie present, they should be able to “edit” the comment, but not “save” it.

To combat this, I can add in an additional check in the ajax_get_time_left method of the plugin to make sure a user can indeed edit the comment. I can then return an error to JS to make sure not to show the interface if an error is present.

So, in theory, it should work. Wrong users may be shown the interface at this point, but I’m willing to put out an update that will address this on cached pages.

Also, I can add in some hooks for when a comment has changed, that way you can hook into these and update the cached page as necessary.

Thoughts?

Actually, WordPress already supplies some hooks for when the comment has changed, so what I put in will be redundant.

When a comment is deleted (in wp_delete_comment), you can hook in here: do_action( 'deleted_comment', $comment_id );

When a comment is edited (in wp_update_comment), you can hook in here: do_action( 'edit_comment', $comment_ID );

Hi Ronald, thanks for the quick response.

Yes, we already hook into that.

I suggest you add IDs to the comments (if they’re not there already) and lookup the ID of the comment in the cookie with JS, then add the edit link with JS. After that still check with hashes and such if edit is allowed. Less intrusive, no hardcoded edit links.

Daan,

That sounds like a good approach. I’ll give it a try. Might be a few days though.

Thanks, hit me up if you need assistance from me or Ryan (if possible we need it on friday for an acceptance release & load test).

Moving further communication to github issue: https://github.com/ronalfy/simple-comment-editing/issues/4

Not resolved but closing to keep communication at the right place.