I am using Nodecomment to provide multiple content types as comments (e.g. reviews, answers, comments, etc.). I may want to allow anonymous users to create Comments, but only allow authenticated users to create Answers. For this, I need more granular permissions than 'post comments'.

Fortunately, this functionality is already provided for you by the node module (e.g. 'create review content', 'create answer content', 'create comment content', etc.) and just needs to be checked for. (see attached patch)

I only modified the logic which decides whether or not to display the comment form. You'd know better than I, but you probably also want to include this logic in the actual hook_insert() or hook_nodeapi() functions as well for security reasons.

Hope this helps! :)

CommentFileSizeAuthor
nodecomment.module.patch959 bytesms2011

Comments

robertdouglass’s picture

Status: Needs review » Fixed

I applied a slight variation of this patch to beta3. Please test. Also note that similar issues likely occur at other places in this module with regards to the conflict between the legacy comment permissions and node level permissions. A thorough audit of the permissions system is needed.

Anonymous’s picture

Status: Fixed » Closed (fixed)