Download & Extend

'Administer comments' permission shouldn't be used to determine user access

Project:Comment notify
Version:6.x-1.5
Component:Code
Category:bug report
Priority:normal
Assigned:Unassigned
Status:needs work

Issue Summary

On my site, we use comment notify only with anonymous users and handle authenticated user/author/admin notifications using other means (e.g., subscriptions, Rule triggers). We use the 'subscribe to comments' permission to determine who gets the comment_notify UI.

Unfortunately, this doesn't work for roles with admin access to the comments (e.g., moderators), because comment_notify uses 'administer comments' permission to determine who gets access to it.

Patch included.

AttachmentSize
comment_notify-permissions.patch850 bytes

Comments

#1

Status:active» needs work

Thanks for the issue and patch.

The idea of this permission check is that when an admin modifies someone else's comment they can see and edit the subscription status.

We could change that check to add a test for whether they are editing a comment that is NOT by them and they have administer comments permission.

#2

Hi lirazsiri, will you be able to incorporate my suggestion into your patch?

nobody click here