Page comment moderation doesn't affect artefact comments
Bug #1540534 reported by
Kristina Hoeppner
This bug affects 2 people
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Mahara |
Fix Released
|
High
|
Son Nguyen | ||
15.10 |
Fix Released
|
High
|
Unassigned | ||
16.04 |
Fix Released
|
High
|
Unassigned | ||
16.10 |
Fix Released
|
High
|
Unassigned |
Bug Description
Seen on mahara.org and tested on latest master (16.04).
When you turn on comment moderation for a page, that moderation only goes for page comments but not artefact comments. Artefact comments should be treated the same in that regard as there is no separate moderation possibility. This loophole can be misused by anonymous people to post comments on an artefact that are immediately visible to everyone.
no longer affects: | mahara/1.10 |
no longer affects: | mahara/15.04 |
no longer affects: | mahara/15.10 |
Changed in mahara: | |
milestone: | 16.04.0 → 16.10.0 |
Changed in mahara: | |
milestone: | 16.10.0 → 16.10.1 |
Changed in mahara: | |
milestone: | 16.10.1 → 17.04.0 |
status: | Confirmed → In Progress |
Changed in mahara: | |
status: | In Progress → Fix Committed |
tags: | added: usermanualupdate |
tags: | removed: usermanualupdate |
Changed in mahara: | |
status: | Fix Committed → Fix Released |
To post a comment you must log in.
I suppose what we can do is take the view that the artefact is being viewed "from", and apply the moderation setting from that, to the artefact comments.
However, there's still a loophole in this, which is that an artefact can be viewed from multiple pages. So there's a high likelihood of a confusing case arising where a user has placed an artefact in two separate views, one with comment moderation enabled, and the other without. And if we ever implement individual artefact access, that will provide an even greater loophole; just access the artefact's page directly.
I think the "comment moderation" setting was probably originally devised without taking artefact comments into consideration. It would probably be a good idea to give it a good think and see if we can come up with a clever and more intuitive way to handle this. Like perhaps making a user's comment moderation setting global instead of per-page; or making it aware of "logged in" / "friend" / "logged-out".