We have separate permission for review but no permission for comment. Other permissions exists before allowing user enter workspace, i.e. member of a language or is maintainer. Once they can enter workspace and workspace is not read only, it means they can comment. There isn't any need for a separate permission once they've reached that far. 

Patrick Huang 
Senior Software Engineer 
Engineering - Internationalisation 
Red Hat 

----- Original Message -----

> From: "Sean Flanigan" <notifications@github.com>
> To: "zanata/zanata-server" <zanata-server@noreply.github.com>
> Cc: "Patrick Huang" <pahuang@redhat.com>
> Sent: Friday, August 16, 2013 9:47:08 AM
> Subject: Re: [zanata-server] rhbz996388 - reviewer only should be able to
> comment and reject (#130)

> In
> zanata-war/src/main/java/org/zanata/webtrans/server/rpc/AddReviewCommentHandler.java:
> >     @Override
> >     public AddReviewCommentResult execute(AddReviewCommentAction action,
> >     ExecutionContext context) throws ActionException
> >     {
> >        throwExceptionIfCommentIsInvalid(action);
> >
> > -      SecurityService.SecurityCheckResult securityCheckResult =
> > securityServiceImpl.checkPermission(action,
> > SecurityService.TranslationAction.MODIFY);
> > -      HLocale hLocale = securityCheckResult.getLocale();
> > -      TranslationWorkspace workspace = securityCheckResult.getWorkspace();
> > +      WorkspaceId workspaceId = action.getWorkspaceId();
> > +      securityServiceImpl.checkWorkspaceStatus(workspaceId);
> > +
> > +      HLocale hLocale =
> > localeServiceImpl.getByLocaleId(workspaceId.getLocaleId());
> > +      TranslationWorkspace workspace =
> > translationWorkspaceManager.getOrRegisterWorkspace(workspaceId);

> I don't think we should be removing the security check here. We may need to
> create a new permission which will be checked here instead.

> The security rules should be in security.drl as much as possible, not
> implicit in the code.

> —
> Reply to this email directly or view it on GitHub .