title: Wordpress guest can see unauthorized comments
body: <p>i created a wordpress comment site with the help of a template for my blog.</p>
  
  <p>The Problem is. If i'm logged in i can see only the approved comments as it should be.
  But if i'm logged out, like a Guest, i can see all comments including all unauthorized comments.</p>
  
  <p>This is my code:</p>
  
  <pre><code>&lt;?php if (!empty($post-&gt;post_password) &amp;&amp; $_COOKIE['wp-postpass_'.COOKIEHASH]!=$post-&gt;post_password) : ?&gt;
      &lt;p id="comments-locked"&gt;Please log in to see the comments.&lt;/p&gt;
  &lt;?php return; endif; ?&gt;
  
  &lt;?php if ($comments) : ?&gt;
  
  &lt;?php 
  
      $author = array(
              "highlight" =&gt; "highlight",
              "email" =&gt; "YOUR EMAIL HERE",
              "name" =&gt; "YOUR NAME HERE"
      ); 
  
      $numPingBacks = 0;
      $numComments  = 0;
  
      foreach ($comments as $comment) {
          if (get_comment_type() != "comment") { $numPingBacks++; }
          else { $numComments++; }
      }
  
      $thiscomment = 'odd';
  ?&gt;
  
  &lt;?php
  
      if ($numPingBacks != 0) : ?&gt;
  
      &lt;h3 class="comments-header"&gt;&lt;?php _e($numPingBacks); ?&gt; Trackbacks/Pingbacks&lt;/h3&gt;
      &lt;ol id="trackbacks"&gt;
  
  &lt;?php foreach ($comments as $comment) : ?&gt;
  &lt;?php if (get_comment_type()!="comment") : ?&gt;
  
      &lt;li id="comment-&lt;?php comment_ID() ?&gt;" class="&lt;?php _e($thiscomment); ?&gt;"&gt;
      &lt;?php comment_type(__('Comment'), __('Trackback'), __('Pingback')); ?&gt;:
      &lt;?php comment_author_link(); ?&gt; on &lt;?php comment_date(); ?&gt;
      &lt;/li&gt;
  
      &lt;?php if('odd'==$thiscomment) { $thiscomment = 'even'; } else { $thiscomment = 'odd'; } ?&gt;
  
  &lt;?php endif; endforeach; ?&gt;
  
      &lt;/ol&gt;
  
  &lt;?php endif; ?&gt;
  
  &lt;?php 
  
      if ($numComments != 0) : ?&gt;
  
      &lt;h3 class="comments-header"&gt;&lt;?php _e($numComments); ?&gt; Comments&lt;/h3&gt;
      &lt;ol id="comments"&gt;
  
      &lt;?php foreach ($comments as $comment) : ?&gt;
      &lt;?php if (get_comment_type()=="comment") : ?&gt;
  
          &lt;li id="comment-&lt;?php comment_ID(); ?&gt;" class="&lt;?php 
  
          $this_name = $comment-&gt;comment_author;
          $this_email = $comment-&gt;comment_author_email;
  
          if (strcasecmp($this_name, $author["name"])==0 &amp;&amp; strcasecmp($this_email, $author["email"])==0)
              _e($author["highlight"]);
          else
              _e($thiscomment); 
  
          ?&gt;"&gt;
              &lt;div class="comment-meta"&gt;
                  &lt;span class="comment-author"&gt;&lt;?php comment_author_link() ?&gt;&lt;/span&gt;,
                  &lt;span class="comment-date"&gt;&lt;?php comment_date() ?&gt;&lt;/span&gt;:
              &lt;/div&gt;
              &lt;div class="comment-text"&gt;
                  &lt;?php comment_text(); ?&gt;
              &lt;/div&gt;
          &lt;/li&gt;
  
      &lt;?php if('odd'==$thiscomment) { $thiscomment = 'even'; } else { $thiscomment = 'odd'; } ?&gt;
  
      &lt;?php endif; endforeach; ?&gt;
  
      &lt;/ol&gt;
  
      &lt;?php endif; ?&gt;
  
  &lt;?php else : 
  
  ?&gt;
  
      &lt;h3 class="comments-header noPandM"&gt;There are no comments!&lt;/h3&gt;
  
      &lt;p class="noPandM"&gt;Write the first Comment!&lt;/p&gt;
      &lt;br /&gt;
  &lt;?php endif; ?&gt;
  
  &lt;?php if (comments_open()) : ?&gt;
  
      &lt;div id="comments-form"&gt;
  
      &lt;h3 id="comments-header"&gt;Write a Comment&lt;/h3&gt;
      &lt;p class="commentsSmall"&gt; Your E-Mail will not be published. Required fields are marked. &lt;/p&gt;
          &lt;br /&gt;
      &lt;?php if (get_option('comment_registration') &amp;&amp; !$user_ID ) : ?&gt;
          &lt;p id="comments-blocked"&gt;You must be &lt;a href="&lt;?php echo get_option('siteurl'); ?&gt;/wp-login.php?redirect_to=
          &lt;?php the_permalink(); ?&gt;"&gt;Login&lt;/a&gt; to write a Comment.&lt;/p&gt;
      &lt;?php else : ?&gt;
  
      &lt;form action="&lt;?php echo get_option('siteurl'); ?&gt;/wp-comments-post.php" method="post" id="commentform"&gt;
  
      &lt;?php if ($user_ID) : ?&gt;
  
      &lt;p&gt;Logged in as &lt;a href="&lt;?php echo get_option('siteurl'); ?&gt;/wp-admin/profile.php"&gt;
          &lt;?php echo $user_identity; ?&gt;&lt;/a&gt;.
          &lt;a href="&lt;?php echo get_option('siteurl'); ?&gt;/wp-login.php?action=logout"
          title="Log out of this account"&gt;Logout&lt;/a&gt;
      &lt;/p&gt;
  
      &lt;?php else : ?&gt;
  
      &lt;p class="commentformlabel"&gt;&lt;label for="author"&gt;Name&lt;?php if ($req) _e(' (*)'); ?&gt;&lt;/label&gt;&lt;/p&gt;
      &lt;p&gt;&lt;input type="text" class="commentText" name="author" id="author" value="&lt;?php echo $comment_author; ?&gt;" size="22" /&gt;&lt;/p&gt;
  
      &lt;p class="commentformlabel"&gt;&lt;label for="email"&gt;E-mail &lt;?php if ($req) _e(' (*)'); ?&gt;&lt;/label&gt;&lt;/p&gt;
      &lt;p&gt;&lt;input type="text" class="commentText" name="email" id="email" value="&lt;?php echo $comment_author_email; ?&gt;" size="22" /&gt;&lt;/p&gt;
  
      &lt;p class="commentformlabel"&gt;&lt;label for="url"&gt;Website&lt;/label&gt;&lt;/p&gt;
      &lt;p&gt;&lt;input type="text" class="commentText" name="url" id="url" value="&lt;?php echo $comment_author_url; ?&gt;" size="22" /&gt;&lt;/p&gt;
  
      &lt;?php endif; ?&gt;
      &lt;br /&gt;
      &lt;p class="commentformlabel"&gt;&lt;label for="comment"&gt;Comment&lt;/label&gt;&lt;/p&gt;
          &lt;p&gt;&lt;textarea name="comment" style="width:80% !important;" id="comment" rows="8"&gt;&lt;/textarea&gt;&lt;/p&gt;
              &lt;br /&gt;
          &lt;p&gt;&lt;button type="submit" name="submit" id="sub"&gt;Submit&lt;/button&gt;
          &lt;input type="hidden" name="comment_post_ID" value="&lt;?php echo $id; ?&gt;"&gt;&lt;/p&gt;
  
      &lt;?php do_action('comment_form', $post-&gt;ID); ?&gt;
  
      &lt;/form&gt;
      &lt;/div&gt;
  
  &lt;?php endif; ?&gt;
  
  &lt;?php else : ?&gt;
      &lt;p id="comments-closed"&gt;Sorry, but the Comments are closed in this Area!&lt;/p&gt;
  &lt;?php endif; ?&gt;
  </code></pre>
  
  <p>Thank you for reading!
  Daniel</p>