SAK-33405 Honour comment.create in saveComment api (sakaiproject#4835)

s50600822 · Sep 26, 2017 · 5c99c3a · 5c99c3a
1 parent e8e8ee7
commit 5c99c3a
Show file tree

Hide file tree

Showing 4 changed files with 21 additions and 14 deletions.
diff --git a/commons/impl/src/java/org/sakaiproject/commons/impl/CommonsManagerImpl.java b/commons/impl/src/java/org/sakaiproject/commons/impl/CommonsManagerImpl.java
@@ -169,17 +169,19 @@ public boolean deletePost(String postId) {
     public Comment saveComment(String commonsId, Comment comment) {
 
         try {
-            Comment savedComment = persistenceManager.saveComment(comment);
-            if (savedComment != null) {
-                List<String> contextIds = new ArrayList();
-                if (persistenceManager.getCommons(commonsId).isSocial()) {
-                    Post post = persistenceManager.getPost(comment.getPostId(), false);
-                    contextIds = getConnectionUserIds(post.getCreatorId());
-                } else {
-                    contextIds.add(commonsId);
+            Post post = persistenceManager.getPost(comment.getPostId(), false);
+            if (commonsSecurityManager.canCurrentUserCommentOnPost(post)) {
+                Comment savedComment = persistenceManager.saveComment(comment);
+                if (savedComment != null) {
+                    List<String> contextIds = new ArrayList();
+                    if (persistenceManager.getCommons(commonsId).isSocial()) {
+                        contextIds = getConnectionUserIds(post.getCreatorId());
+                    } else {
+                        contextIds.add(commonsId);
+                    }
+                    removeContextIdsFromCache(contextIds);
+                    return savedComment;
                 }
-                removeContextIdsFromCache(contextIds);
-                return savedComment;
             }
         } catch (Exception e) {
             log.error("Caught exception whilst saving comment", e);

diff --git a/commons/impl/src/java/org/sakaiproject/commons/impl/CommonsSecurityManagerImpl.java b/commons/impl/src/java/org/sakaiproject/commons/impl/CommonsSecurityManagerImpl.java
@@ -56,6 +56,11 @@ public boolean canCurrentUserCommentOnPost(Post post) {
 
         log.debug("canCurrentUserCommentOnPost()");
 
+        // This acts as an override
+        if (sakaiProxy.isAllowedFunction(CommonsFunctions.COMMENT_UPDATE_ANY, post.getSiteId())) {
+            return true;
+        }
+
         // An author can always comment on their own posts
         if (post.getCreatorId().equals(sakaiProxy.getCurrentUserId())) {
             return true;
@@ -98,7 +103,7 @@ public boolean canCurrentUserEditPost(Post post) {
 
         // If the current user is authenticated and the post author, yes.
         if (currentUser != null && currentUser.equals(post.getCreatorId())) {
-            if (StringUtils.isEmpty(post.getId())) {
+            if (StringUtils.isBlank(post.getId())) {
                 return sakaiProxy.isAllowedFunction(CommonsFunctions.POST_CREATE, post.getSiteId());
             } else {
                 return sakaiProxy.isAllowedFunction(CommonsFunctions.POST_UPDATE_OWN, post.getSiteId());

diff --git a/...ons/tool/src/java/org/sakaiproject/commons/tool/entityprovider/CommonsEntityProvider.java b/...ons/tool/src/java/org/sakaiproject/commons/tool/entityprovider/CommonsEntityProvider.java
@@ -317,7 +317,7 @@ public ActionReturn handleSaveComment(Map<String, Object> params) {
 
         content = escape(content);
 
-        boolean isNew = "".equals(comment.getId());
+        boolean isNew = StringUtils.isBlank(comment.getId());
 
         Comment savedComment = commonsManager.saveComment(commonsId, comment);
         if (savedComment != null) {

diff --git a/commons/tool/src/webapp/js/commons_utils.js b/commons/tool/src/webapp/js/commons_utils.js
@@ -418,7 +418,7 @@ commons.utils = {
 
         p.currentUserId = commons.userId;
 
-        p.canComment = commons.currentUserPermissions.commentCreate;
+        p.canComment = commons.currentUserPermissions.commentCreate || commons.currentUserPermissions.commentUpdateAny;
         p.canDelete = commons.currentUserPermissions.postDeleteAny
                         || (commons.currentUserPermissions.postDeleteOwn && p.creatorId === commons.userId);
         p.canEdit = commons.currentUserPermissions.postUpdateAny
@@ -431,7 +431,7 @@ commons.utils = {
 
         var postCreatorId = document.getElementById('commons-post-' + c.postId).dataset.creatorId;
 
-        c.canComment = commons.currentUserPermissions.commentCreate;
+        c.canComment = commons.currentUserPermissions.commentCreate || commons.currentUserPermissions.commentUpdateAny;
         c.modified = c.modifiedDate > c.createdDate;
         c.canDelete = commons.currentUserPermissions.commentDeleteAny
                         || (commons.currentUserPermissions.commentDeleteOwn && c.creatorId === commons.userId)