CVE-2021-25991: Other (NVD-CWE-Other)
value: In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access to Ifme.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.3
Published: 2021-12-29T09:15Z
Repository: https://github.com/ifmeorg/ifme
Language: Ruby
Files changed: app/controllers/notifications_controller.rb, app/helpers/comments_helper.rb, app/views/allies/index.html.erb, app/views/profile/index.html.erb, app/views/search/index.html.erb, client/app/widgets/Comments/__tests__/Comments.spec.jsx, client/app/widgets/Comments/index.jsx, spec/helpers/comments_helper_spec.rb
Commit date: 2021-11-19 01:49:08 -0500
Commit message: [#2052] Fix improper access control leads to admin self-banning

Diff: diff --git a/app/controllers/notifications_controller.rb b/app/controllers/notifications_controller.rb
index 29c7e6d19..7bbfbc0b2 100644
--- a/app/controllers/notifications_controller.rb
+++ b/app/controllers/notifications_controller.rb
@@ -45,11 +45,13 @@ class NotificationsController < ApplicationController
 
   def render_notification(notification)
     uniqueid = notification[:uniqueid]
     data = convert_to_hash(notification[:data])
     # In case data[:name] is invalid
-    data[:email] = User.find(data[:user_id]).email
+    if data[:user_id]
+      data[:email] = User.find(data[:user_id]).email
+    end
     case data[:type]
     when /comment/ then comment_link(uniqueid, data)
     when /accepted_ally_request/ then accepted_ally_link(uniqueid, data)
     when /new_ally_request/ then new_ally_request_link(uniqueid, data)
     when /group/ then group_link(uniqueid, data)
diff --git a/app/helpers/comments_helper.rb b/app/helpers/comments_helper.rb
index 6f7b0ef1b..3b8660f2b 100644
--- a/app/helpers/comments_helper.rb
+++ b/app/helpers/comments_helper.rb
@@ -40,10 +40,11 @@ module CommentsHelper
     {
       currentUserUid: current_user.uid,
       commentByUid: user.uid,
       commentByName: user.name,
       commentByAvatar: user.avatar.url,
+      commentByAdmin: user.admin?,
       comment: sanitize(comment.comment),
       viewers: CommentViewersService.viewers(comment, current_user),
       createdAt: created_at(comment.created_at),
       deleteAction: delete_action(comment)
     }.merge(id: comment.id)
diff --git a/app/views/allies/index.html.erb b/app/views/allies/index.html.erb
index f0cd50e98..c48fc48cb 100644
--- a/app/views/allies/index.html.erb
+++ b/app/views/allies/index.html.erb
@@ -54,13 +54,15 @@
           <%= link_to ProfilePicture.fetch(ally.avatar.url, name: ally.name), profile_index_path(uid: ally.uid) %>
           <div class="subtle"><%= ally.location %></div>
           <div>
             <%= link_to t('common.actions.remove'), remove_allies_path(ally_id: ally.id), method: :post, data: { confirm: t('common.actions.confirm') } %>
           </div>
-          <div>
-            <%= link_to t('common.actions.report'), new_report_path(uid: ally.uid) %>
-          </div>
+          <% if !ally.admin? && ally != current_user %>
+            <div>
+              <%= link_to t('common.actions.report'), new_report_path(uid: ally.uid) %>
+            </div>
+          <% end %>
         </div>
       <% end %>
     </div>
   </div>
 <% end %>
diff --git a/app/views/profile/index.html.erb b/app/views/profile/index.html.erb
index d43226551..c6ccf604e 100644
--- a/app/views/profile/index.html.erb
+++ b/app/views/profile/index.html.erb
@@ -24,24 +24,26 @@
         </div>
       <% elsif current_user.allies_by_status(:accepted).include? @profile %>
         <div>
           <%= link_to t('common.actions.remove'), remove_allies_path(ally_id: @profile.id), method: :post, data: { confirm: t('common.actions.confirm') } %>
         </div>
-        <div>
-          <%= link_to t('common.actions.report'), new_report_path(uid: @profile.uid) %>
-        </div>
+        <% if !@profile.admin? && @profile != current_user %>
+          <div>
+            <%= link_to t('common.actions.report'), new_report_path(uid: @profile.uid) %>
+          </div>
+        <% end %>
       <% elsif current_user.allies_by_status(:pending_from_user).include? @profile %>
         <div>
           <%= link_to t('allies.accept'), add_allies_path(ally_id: @profile.id), method: :post %> | <%= link_to t('allies.reject'), remove_allies_path(ally_id: @profile.id), method: :post, data: { confirm: t('common.actions.confirm') } %>
         </div>
       <% else %>
         <div>
           <%= link_to t('allies.add_ally'), add_allies_path(ally_id: @profile.id), method: :post %>
         </div>
       <% end %>
     <% end %>
-    <% if current_user.admin? %>
+    <% if @profile != current_user && current_user.admin? %>
       <% if @profile.banned? %>
         <div>
           <%= link_to t('reports.remove_ban'), remove_ban_profile_index_path(user_id: @profile.id), method: :post %>
         </div>
       <% else %>
diff --git a/app/views/search/index.html.erb b/app/views/search/index.html.erb
index e43611e75..82ae99a38 100644
--- a/app/views/search/index.html.erb
+++ b/app/views/search/index.html.erb
@@ -13,13 +13,15 @@
             <%= link_to t('allies.accept'), add_allies_path(ally_id: user.id), method: :post %>
           <% elsif current_user.allies_by_status(:accepted).include?(user) %>
             <div>
               <%= link_to t('common.actions.remove'), remove_allies_path(ally_id: user.id), method: :post, data: { confirm: t('common.actions.confirm') } %>
             </div>
-            <div>
-              <%= link_to t('common.actions.report'), new_report_path(uid: user.uid) %>
-            </div>
+            <% if !user.admin? && user != current_user %>
+              <div>
+                <%= link_to t('common.actions.report'), new_report_path(uid: user.uid) %>
+              </div>
+            <% end %>
           <% else %>
             <%= link_to t('allies.add_ally'), add_allies_path(ally_id: user.id), method: :post %>
           <% end %>
         </div>
     <% end %>
diff --git a/client/app/widgets/Comments/__tests__/Comments.spec.jsx b/client/app/widgets/Comments/__tests__/Comments.spec.jsx
index e30836614..242511462 100644
--- a/client/app/widgets/Comments/__tests__/Comments.spec.jsx
+++ b/client/app/widgets/Comments/__tests__/Comments.spec.jsx
@@ -62,52 +62,94 @@ const formProps = {
 
 const value = 'Hey';
 
 const id = 1;
 
-const comment = {
+const getComment = ({ commentByAdmin } = {}) => ({
   comment: value,
-  currentUserId: 'some-uid',
+  currentUserUid: 'some-uid',
   commentByAvatar: null,
+  commentByAdmin: Boolean(commentByAdmin),
   commentByName: 'Kind Human',
   commentByUid: 'uid',
   createdAt: 'Created less than a minute ago',
   deleteAction: '/comments/delete?comment_id=1',
   id,
   viewers: 'Visible only between you and Lane Kim',
-};
-
-const component = <Comments formProps={formProps} />;
+});
 
 describe('Comments', () => {
-  beforeEach(() => {
-    jest.spyOn(axios, 'post').mockResolvedValue({
-      data: { comment },
+  describe('when written by a non-admin user', () => {
+    it('renders correctly with a report link', () => {
+      render(<Comments formProps={formProps} comments={[getComment()]} />);
+      expect(screen.getByRole('textbox')).toBeInTheDocument();
+      expect(screen.getByRole('article')).toBeInTheDocument();
+      expect(
+        screen.getByRole('button', { name: 'Submit' }),
+      ).toBeInTheDocument();
+      expect(screen.getByRole('link', { name: 'Report' })).toBeInTheDocument();
     });
-    jest.spyOn(axios, 'delete').mockResolvedValue({
-      data: { id },
+
+    it('add and delete a comment', async () => {
+      jest.spyOn(axios, 'post').mockResolvedValue({
+        data: { comment: getComment() },
+      });
+      jest.spyOn(axios, 'delete').mockResolvedValue({
+        data: { id },
+      });
+      render(<Comments formProps={formProps} />);
+      expect(screen.queryByRole('article')).not.toBeInTheDocument();
+
+      userEvent.type(screen.getByRole('textbox'));
+      userEvent.selectOptions(screen.getByRole('combobox'), 'private');
+      userEvent.click(screen.getByRole('button', { name: 'Submit' }));
+
+      await waitFor(() => expect(screen.getByRole('article')).toBeInTheDocument());
+      expect(screen.getByRole('article')).toHaveTextContent('Hey');
+
+      userEvent.click(screen.getByRole('link', { name: 'Delete' }));
+
+      await waitFor(() => expect(screen.queryByRole('article')).not.toBeInTheDocument());
     });
   });
 
-  it('renders correctly', () => {
-    render(component);
-    expect(screen.getByRole('textbox')).toBeInTheDocument();
-    expect(screen.queryByRole('article')).not.toBeInTheDocument();
-    expect(screen.getByRole('button', { name: 'Submit' })).toBeInTheDocument();
-  });
+  describe('when written by an admin user', () => {
+    it('renders correctly without a report link', () => {
+      render(
+        <Comments
+          formProps={formProps}
+          comments={[getComment({ commentByAdmin: true })]}
+        />,
+      );
+      expect(screen.getByRole('textbox')).toBeInTheDocument();
+      expect(screen.getByRole('article')).toBeInTheDocument();
+      expect(
+        screen.getByRole('button', { name: 'Submit' }),
+      ).toBeInTheDocument();
+      expect(
+        screen.queryByRole('link', { name: 'Report' }),
+      ).not.toBeInTheDocument();
+    });
 
-  it('add and delete a comment', async () => {
-    render(component);
-    expect(screen.queryByRole('article')).not.toBeInTheDocument();
+    it('add and delete a comment', async () => {
+      jest.spyOn(axios, 'post').mockResolvedValue({
+        data: { comment: getComment({ commentByAdmin: true }) },
+      });
+      jest.spyOn(axios, 'delete').mockResolvedValue({
+        data: { id },
+      });
+      render(<Comments formProps={formProps} />);
+      expect(screen.queryByRole('article')).not.toBeInTheDocument();
 
-    userEvent.type(screen.getByRole('textbox'));
-    userEvent.selectOptions(screen.getByRole('combobox'), 'private');
-    userEvent.click(screen.getByRole('button', { name: 'Submit' }));
+      userEvent.type(screen.getByRole('textbox'));
+      userEvent.selectOptions(screen.getByRole('combobox'), 'private');
+      userEvent.click(screen.getByRole('button', { name: 'Submit' }));
 
-    await waitFor(() => expect(screen.getByRole('article')).toBeInTheDocument());
-    expect(screen.getByRole('article')).toHaveTextContent('Hey');
+      await waitFor(() => expect(screen.getByRole('article')).toBeInTheDocument());
+      expect(screen.getByRole('article')).toHaveTextContent('Hey');
 
-    userEvent.click(screen.getByRole('link', { name: 'Delete' }));
+      userEvent.click(screen.getByRole('link', { name: 'Delete' }));
 
-    await waitFor(() => expect(screen.queryByRole('article')).not.toBeInTheDocument());
+      await waitFor(() => expect(screen.queryByRole('article')).not.toBeInTheDocument());
+    });
   });
 });
diff --git a/client/app/widgets/Comments/index.jsx b/client/app/widgets/Comments/index.jsx
index 5edddcaa3..65fa40693 100644
--- a/client/app/widgets/Comments/index.jsx
+++ b/client/app/widgets/Comments/index.jsx
@@ -22,10 +22,11 @@ type Comment = {
   id: number,
   currentUserUid: string,
   commentByUid: string,
   commentByName: string,
   commentByAvatar?: string,
+  commentByAdmin: Boolean,
   comment: any,
   viewers?: string,
   createdAt: string,
   deleteAction?: string,
 };
@@ -66,13 +67,14 @@ export const Comments = ({ comments, formProps }: Props) => {
     viewers: ?string,
     deleteAction: ?string,
     currentUserUid: string,
     uid: string,
     id: number,
+    commentByAdmin: Boolean,
   ) => {
     const actions = {};
-    if (currentUserUid !== uid) {
+    if (currentUserUid !== uid && !commentByAdmin) {
       actions.report = reportAction(uid, id);
     }
     if (viewers) {
       actions.viewers = viewers;
     }
@@ -92,10 +94,11 @@ export const Comments = ({ comments, formProps }: Props) => {
       id,
       currentUserUid,
       commentByUid,
       commentByName,
       commentByAvatar,
+      commentByAdmin,
       comment,
       viewers,
       createdAt,
       deleteAction,
     } = myComment;
@@ -111,10 +114,11 @@ export const Comments = ({ comments, formProps }: Props) => {
               viewers,
               deleteAction,
               currentUserUid,
               commentByUid,
               id,
+              commentByAdmin,
             )}
             hasStory
           />
         </div>
       </article>
diff --git a/spec/helpers/comments_helper_spec.rb b/spec/helpers/comments_helper_spec.rb
index 14d1fbb33..1b147f5ed 100644
--- a/spec/helpers/comments_helper_spec.rb
+++ b/spec/helpers/comments_helper_spec.rb
@@ -30,10 +30,11 @@ describe CommentsHelper, type: :controller do
                                                                                           id: new_comment.id,
                                                                                           currentUserUid: user1.uid,
                                                                                           commentByUid: user1.uid,
                                                                                           commentByName: user1.name,
                                                                                           commentByAvatar: user1.avatar.url,
+                                                                                          commentByAdmin: false,
                                                                                           comment: comment,
                                                                                           createdAt: created_at,
                                                                                           viewers: nil,
                                                                                           deleteAction: delete_comments_path(comment_id: new_comment.id)
                                                                                         }])
@@ -45,10 +46,11 @@ describe CommentsHelper, type: :controller do
                                                                                           id: new_comment.id,
                                                                                           currentUserUid: user1.uid,
                                                                                           commentByUid: user1.uid,
                                                                                           commentByName: user1.name,
                                                                                           commentByAvatar: user1.avatar.url,
+                                                                                          commentByAdmin: false,
                                                                                           comment: comment,
                                                                                           createdAt: created_at,
                                                                                           viewers: "Visible only between you and #{user2.name}",
                                                                                           deleteAction: delete_comments_path(comment_id: new_comment.id)
                                                                                         }])
@@ -66,10 +68,11 @@ describe CommentsHelper, type: :controller do
                                                                                           id: new_comment.id,
                                                                                           currentUserUid: user2.uid,
                                                                                           commentByUid: user2.uid,
                                                                                           commentByName: user2.name,
                                                                                           commentByAvatar: user2.avatar.url,
+                                                                                          commentByAdmin: false,
                                                                                           comment: comment,
                                                                                           createdAt: created_at,
                                                                                           viewers: nil,
                                                                                           deleteAction: delete_comments_path(comment_id: new_comment.id)
                                                                                         }])
@@ -81,10 +84,11 @@ describe CommentsHelper, type: :controller do
                                                                                           id: new_comment.id,
                                                                                           currentUserUid: user2.uid,
                                                                                           commentByUid: user2.uid,
                                                                                           commentByName: user2.name,
                                                                                           commentByAvatar: user2.avatar.url,
+                                                                                          commentByAdmin: false,
                                                                                           comment: comment,
                                                                                           createdAt: created_at,
                                                                                           viewers: "Visible only between you and #{user1.name}",
                                                                                           deleteAction: delete_comments_path(comment_id: new_comment.id)
                                                                                         }])
@@ -106,10 +110,11 @@ describe CommentsHelper, type: :controller do
                                                                                           id: new_comment.id,
                                                                                           currentUserUid: user1.uid,
                                                                                           commentByUid: user1.uid,
                                                                                           commentByName: user1.name,
                                                                                           commentByAvatar: user1.avatar.url,
+                                                                                          commentByAdmin: false,
                                                                                           comment: comment,
                                                                                           createdAt: created_at,
                                                                                           viewers: nil,
                                                                                           deleteAction: delete_comments_path(comment_id: new_comment.id)
                                                                                         }])
@@ -121,10 +126,11 @@ describe CommentsHelper, type: :controller do
                                                                                           id: new_comment.id,
                                                                                           currentUserUid: user1.uid,
                                                                                           commentByUid: user1.uid,
                                                                                           commentByName: user1.name,
                                                                                           commentByAvatar: user1.avatar.url,
+                                                                                          commentByAdmin: false,
                                                                                           comment: comment,
                                                                                           createdAt: created_at,
                                                                                           viewers: "Visible only between you and #{user2.name}",
                                                                                           deleteAction: delete_comments_path(comment_id: new_comment.id)
                                                                                         }])
@@ -142,10 +148,11 @@ describe CommentsHelper, type: :controller do
                                                                                           id: new_comment.id,
                                                                                           currentUserUid: user2.uid,
                                                                                           commentByUid: user2.uid,
                                                                                           commentByName: user2.name,
                                                                                           commentByAvatar: user2.avatar.url,
+                                                                                          commentByAdmin: false,
                                                                                           comment: comment,
                                                                                           createdAt: created_at,
                                                                                           viewers: nil,
                                                                                           deleteAction: delete_comments_path(comment_id: new_comment.id)
                                                                                         }])
@@ -157,10 +164,11 @@ describe CommentsHelper, type: :controller do
                                                                                           id: new_comment.id,
                                                                                           currentUserUid: user2.uid,
                                                                                           commentByUid: user2.uid,
                                                                                           commentByName: user2.name,
                                                                                           commentByAvatar: user2.avatar.url,
+                                                                                          commentByAdmin: false,
                                                                                           comment: comment,
                                                                                           createdAt: created_at,
                                                                                           viewers: "Visible only between you and #{user1.name}",
                                                                                           deleteAction: delete_comments_path(comment_id: new_comment.id)
                                                                                         }])
@@ -184,10 +192,11 @@ describe CommentsHelper, type: :controller do
                                                                                           id: new_comment.id,
                                                                                           currentUserUid: user1.uid,
                                                                                           commentByUid: user1.uid,
                                                                                           commentByName: user1.name,
                                                                                           commentByAvatar: user1.avatar.url,
+                                                                                          commentByAdmin: false,
                                                                                           comment: comment,
                                                                                           createdAt: created_at,
                                                                                           viewers: nil,
                                                                                           deleteAction: delete_comments_path(comment_id: new_comment.id)
                                                                                         }])
@@ -202,10 +211,11 @@ describe CommentsHelper, type: :controller do
                                                                                           id: new_comment.id,
                                                                                           currentUserUid: user2.uid,
                                                                                           commentByUid: user2.uid,
                                                                                           commentByName: user2.name,
                                                                                           commentByAvatar: user2.avatar.url,
+                                                                                          commentByAdmin: false,
                                                                                           comment: comment,
                                                                                           createdAt: created_at,
                                                                                           viewers: nil,
                                                                                           deleteAction: delete_comments_path(comment_id: new_comment.id)
                                                                                         }])

Vulnerable code:     data[:email] = User.find(data[:user_id]).email
          <div>
            <%= link_to t('common.actions.report'), new_report_path(uid: ally.uid) %>
          </div>
        <div>
          <%= link_to t('common.actions.report'), new_report_path(uid: @profile.uid) %>
        </div>
    <% if current_user.admin? %>
            <div>
              <%= link_to t('common.actions.report'), new_report_path(uid: user.uid) %>
            </div>
const comment = {
  currentUserId: 'some-uid',
};

const component = <Comments formProps={formProps} />;
  beforeEach(() => {
    jest.spyOn(axios, 'post').mockResolvedValue({
      data: { comment },
    jest.spyOn(axios, 'delete').mockResolvedValue({
      data: { id },
  it('renders correctly', () => {
    render(component);
    expect(screen.getByRole('textbox')).toBeInTheDocument();
    expect(screen.queryByRole('article')).not.toBeInTheDocument();
    expect(screen.getByRole('button', { name: 'Submit' })).toBeInTheDocument();
  });
  it('add and delete a comment', async () => {
    render(component);
    expect(screen.queryByRole('article')).not.toBeInTheDocument();
    userEvent.type(screen.getByRole('textbox'));
    userEvent.selectOptions(screen.getByRole('combobox'), 'private');
    userEvent.click(screen.getByRole('button', { name: 'Submit' }));
    await waitFor(() => expect(screen.getByRole('article')).toBeInTheDocument());
    expect(screen.getByRole('article')).toHaveTextContent('Hey');
    userEvent.click(screen.getByRole('link', { name: 'Delete' }));
    await waitFor(() => expect(screen.queryByRole('article')).not.toBeInTheDocument());
    if (currentUserUid !== uid) {
Fixed code:     if data[:user_id]
      data[:email] = User.find(data[:user_id]).email
    end
      commentByAdmin: user.admin?,
          <% if !ally.admin? && ally != current_user %>
            <div>
              <%= link_to t('common.actions.report'), new_report_path(uid: ally.uid) %>
            </div>
          <% end %>
        <% if !@profile.admin? && @profile != current_user %>
          <div>
            <%= link_to t('common.actions.report'), new_report_path(uid: @profile.uid) %>
          </div>
        <% end %>
    <% if @profile != current_user && current_user.admin? %>
            <% if !user.admin? && user != current_user %>
              <div>
                <%= link_to t('common.actions.report'), new_report_path(uid: user.uid) %>
              </div>
            <% end %>
const getComment = ({ commentByAdmin } = {}) => ({
  currentUserUid: 'some-uid',
  commentByAdmin: Boolean(commentByAdmin),
});
  describe('when written by a non-admin user', () => {
    it('renders correctly with a report link', () => {
      render(<Comments formProps={formProps} comments={[getComment()]} />);
      expect(screen.getByRole('textbox')).toBeInTheDocument();
      expect(screen.getByRole('article')).toBeInTheDocument();
      expect(
        screen.getByRole('button', { name: 'Submit' }),
      ).toBeInTheDocument();
      expect(screen.getByRole('link', { name: 'Report' })).toBeInTheDocument();

    it('add and delete a comment', async () => {
      jest.spyOn(axios, 'post').mockResolvedValue({
        data: { comment: getComment() },
      });
      jest.spyOn(axios, 'delete').mockResolvedValue({
        data: { id },
      });
      render(<Comments formProps={formProps} />);
      expect(screen.queryByRole('article')).not.toBeInTheDocument();

      userEvent.type(screen.getByRole('textbox'));
      userEvent.selectOptions(screen.getByRole('combobox'), 'private');
      userEvent.click(screen.getByRole('button', { name: 'Submit' }));

      await waitFor(() => expect(screen.getByRole('article')).toBeInTheDocument());
      expect(screen.getByRole('article')).toHaveTextContent('Hey');

      userEvent.click(screen.getByRole('link', { name: 'Delete' }));

      await waitFor(() => expect(screen.queryByRole('article')).not.toBeInTheDocument());
  describe('when written by an admin user', () => {
    it('renders correctly without a report link', () => {
      render(
        <Comments
          formProps={formProps}
          comments={[getComment({ commentByAdmin: true })]}
        />,
      );
      expect(screen.getByRole('textbox')).toBeInTheDocument();
      expect(screen.getByRole('article')).toBeInTheDocument();
      expect(
        screen.getByRole('button', { name: 'Submit' }),
      ).toBeInTheDocument();
      expect(
        screen.queryByRole('link', { name: 'Report' }),
      ).not.toBeInTheDocument();
    });
    it('add and delete a comment', async () => {
      jest.spyOn(axios, 'post').mockResolvedValue({
        data: { comment: getComment({ commentByAdmin: true }) },
      });
      jest.spyOn(axios, 'delete').mockResolvedValue({
        data: { id },
      });
      render(<Comments formProps={formProps} />);
      expect(screen.queryByRole('article')).not.toBeInTheDocument();
      userEvent.type(screen.getByRole('textbox'));
      userEvent.selectOptions(screen.getByRole('combobox'), 'private');
      userEvent.click(screen.getByRole('button', { name: 'Submit' }));
      await waitFor(() => expect(screen.getByRole('article')).toBeInTheDocument());
      expect(screen.getByRole('article')).toHaveTextContent('Hey');
      userEvent.click(screen.getByRole('link', { name: 'Delete' }));
      await waitFor(() => expect(screen.queryByRole('article')).not.toBeInTheDocument());
    });
  commentByAdmin: Boolean,
    commentByAdmin: Boolean,
    if (currentUserUid !== uid && !commentByAdmin) {
      commentByAdmin,
              commentByAdmin,
                                                                                          commentByAdmin: false,
                                                                                          commentByAdmin: false,
                                                                                          commentByAdmin: false,
                                                                                          commentByAdmin: false,
                                                                                          commentByAdmin: false,
                                                                                          commentByAdmin: false,
                                                                                          commentByAdmin: false,
                                                                                          commentByAdmin: false,
                                                                                          commentByAdmin: false,
                                                                                          commentByAdmin: false,