Allow anonymous users to edit their content (for N minutes after posting)

[dontdream]

This patch extends to anonymous users the ability to edit their topics and replies, if and when the existing Editing settings allow that.

[johnjamesjacoby]

Thanks for the patch, and apologies that this sat without review for so long.

The current approach cannot safely identify the original anonymous author. wp_get_current_commenter() returns the name, email address, and URL from client-controlled cookies. WordPress uses these cookies for conveniences such as prefilling fields and showing pending comments, but not as authorization to edit a comment. Matching those values against bbPress post metadata would let anyone who can reproduce them impersonate the original poster.

bbPress has intentionally denied anonymous edits since #1678. That behavior was recently reinforced in r7410, which applies capability checks consistently to anonymous topics and replies and covers direct edit submissions.

A safe design would need an unguessable, server-generated credential scoped to the individual topic or reply, with expiration, revocation, storage, and privacy behavior considered together. That is substantially different from the attached patch and the existing commenter cookies.

Given the security model and long-standing behavior, I am closing this as wontfix. A future proposal with a complete credential design could revisit this.