Ticket #12531 (confirmed Bug)
Comments visibility
Reported by: | micecchi | Owned by: | |
---|---|---|---|
Priority: | major | Milestone: | 4.x |
Component: | Commenting/Discussion | Version: | 4.2 |
Keywords: | plone.app.discussion, patch | Cc: | timo |
Description
According with the workflow, published comments are visible for anonymous users. If i make a catalog search for Discussion items (for example in a portlet that shows last comments in the portal), anonymous can see published comments for private contents. And if they try to access it, they can't because the commented content is private.
A simple solution is to enable acquisition from parent in the workflow (comment_review_workflow and also the one_state_workflow). In this case if an object is private, anonymous can't see his comments.
Change History
comment:2 Changed 4 years ago by garbas
- Status changed from new to confirmed
- Component changed from Archetypes to Commenting/Discussion
- Priority changed from minor to major
- Version changed from 3.3 to 4.2
- Milestone changed from Future to 4.x
- Keywords plone.app.discussiondiscussion added; plone.app.discussion discussion removed
i can confirm this ticket. not sure if this fix mentioned above really works since i couldn't get it to work, but then again i didn't spend much time trying to figure out why.
comment:3 Changed 3 years ago by maartenkling
This solution works, just tested in 4.2.
The default one_state_workflow needs to be copyed and changed for p.a.d to a new default workflow as you need to set acquired for both view and access content information on the one state workflow to.
tested workflow changes:
<state state_id="published" title="Published" i18n:attributes="title"> <description i18n:translate=""> Visible to everyone, non-editable. </description> <permission-map name="Access contents information" acquired="True"> </permission-map> <permission-map name="Modify portal content" acquired="False"> <permission-role>Manager</permission-role> </permission-map> <permission-map name="View" acquired="True"> </permission-map> <permission-map name="Reply to item" acquired="True"> </permission-map> </state>
comment:4 Changed 3 years ago by kleist
- Keywords plone.app.discussion, patch added; plone.app.discussiondiscussion removed
comment:5 Changed 3 years ago by khink
I can confirm that the solution Maarten outlined works: take away the "View" permission in "visible" state and make it acquire it from the parent. And it seems the sane thing to do.
- Modifying one_state_workflow might not be a good idea because i believe many Plone installations have used the one_state_workflow for other content types, where this behaviour is not desirable. (Although out of the box Plone uses it only for comments.)
- A new workflow (one_state_comment_workflow?) as Maarten suggests seems the best bet. There'd have to be an upgrade step.
- comment_review_workflow can be modified, also needs upgrade step.
comment:6 Changed 3 years ago by khink
However, in order for a catalog query for a specific number of total_comments to be correct, we need to re-index the commented object after changing its workflow state.
The erroneous behavior is (Plone 4.3):
- Apply a workflow to Discussion Items where in the 'visible' state, 'View' permission is acquired from the parent
- Create a new Document and publish it
- Add a comment (make it visible if that isn't its initial state)
- Create a script which does a catalog query for Documents with comments (see below)
- The script will count the Document we just created
- Now retract the Document
- You'd expect the script to return no results, but is still returns the Document
- Change the Document's title and save
- Now the script does not count the Document
# example catalog query for Documents with comments # for use in skins/custom folder from DateTime import DateTime from Products.CMFCore.utils import getToolByName print DateTime() ctool = getToolByName(context, 'portal_catalog') query = {'portal_type': 'Document', 'total_comments': {'query': 1, 'range': 'min'}} brains = ctool(**query) print len(brains) for brain in brains: print '{0} ({1})'.format(brain.total_comments, brain.getURL()) return printed