This is another method to handle the same problem: http://drupal.org/node/79693
This bug its, at this moment, in Drupal 4.7 and 5.1. But I'm patching for 4.7.
__________________________
In this case, I don't add any feature. Only correcting the bug itself.
The bug is, that, if a user that is not allowed to post a comment without approval, in some cases, HE CAN edit their comments without ANY approval by the admin.
Adding a "edit approval queue" is a feature itself (and very interesting) will be the better solution for this problem, but I believe that this feature must be in future versions of drupal.
_________________________________
My code don't allow users to edit their posts, if they doesn't have the "post comments without approval". Because if they can't post comments without approval, then, they aren't allowed to edit their posts without approval too.
This patch applies only to the comment.module, and only to the "comment_access" function.
Here is the original function at Drupal 4.7.6 comment.module:
function comment_access($op, $comment) {
global $user;
if ($op == 'edit') {
return ($user->uid && $user->uid == $comment->uid && comment_num_replies($comment->cid) == 0) || user_access('administer comments');
}
}
And the modified version:
function comment_access($op, $comment) {
global $user;
if ($op == 'edit') {
return ($user->uid && $user->uid == $comment->uid && user_access('post comments without approval') && comment_num_replies($comment->cid) == 0) || user_access('administer comments');
}
}
Note that, I've only added a "&& user_access('post comments without approval') " to the return line. This is the unique modification needed to correct this bug.
_________
PD: The code is untested yet. If someone test it under Drupal 4.7.6, reply to this issue.
| Comment | File | Size | Author |
|---|---|---|---|
| #1 | comment.module_71.patch | 512 bytes | deavidsedice |
Comments
Comment #1
deavidsedice commentedI've found today that Drupal 5.1 has the same problem. I've created a patch to fix it.
Comment #2
drummI would expect the ability to edit comments, but they would go back into the moderation queue. A message explaining why the comment just disappeared or warning that the comment will disappear would need to be shown.
Comment #3
errement commentedHaving same issue with Drupal 6.6. What do you recommend?
Comment #4
weimeng commentedChanging issue title to better reflect what's going on here, resetting status to active and changing version to 6.x HEAD. Might want to move into 7.x if appropriate.
A user can potentially post an innoculous comment which the site admin will approve, then subsequently edit the comment to anything else he wishes, including malicious or unappropriate content.
Comment #5
sivaji_ganesh_jojodae commentedThis is a duplicate of #438224: "Post comments without approval" permission name is completely misleading
Comment #6
weimeng commentedThat issue describes a different problem.
This is more of a security/design issue caused by the fact that there is no "Edit comments without approval" permission.
Comment #7
weimeng commentedSetting to 7.x for more attention.
I'm aware it might be too late or not important enough an issue, please change the version as necessary.
Comment #8
aaronbaumanIs this really a bug?
Yes, the permission "edit own comments" opens the flood gates, but buyer beware right?
The comment permissions behave the same way as the "edit own" node permissions, and administrators always need to be careful with how they grant them.
Adding a possibly cumbersome layer of revision moderation to the relatively simple comment system does not seem like the answer. IMO this is a feature better addressed by contrib.
IMO it boils down to an interface issue that can be solved with a better description of the permission itself, or using D7's "restrict access" key in comment module's hook_permissions.
Comment #9
marcingy commentedMarking as a feature request, this is really adding a new permission or a new combination of permissions. And I agree should core really be doing this?
Comment #22
smustgrave commentedWonder if this is still relevant for D10?
Comment #24
quietone commentedNearly another two years and there is no discussion or support for this idea.
The proposal doesn't met the Criteria for evaluating proposed changes. In this case, there is not demonstrated demand and support for the change.
If there is interest in this re-open the issue and add a comment. Or open a new issue and reference this one.