thebuggenie/thebuggenie — pull request #165 by sharrondenice (2013-02-21 04:19:08+00:00)
Title: Merging fork to master 02/20/13 - 20:17 CST

Issue #1945
Fixed - Fix visibility issues with issue comments (Updated comment template to show comment if (the comment is hidden and the user can see hidden comments) OR (the comment is public and user can see public comments) OR (the user posted the comment))

Verified - Comments are saved to database with the proper is_public flag

Fixed - Do not allow unauthorized users to edit comments (UPDATED the comment template to allow user to (edit the comment if the user posted the comment AND the user can edit own comments) OR (the user can edit all comments))

Fixed - Do not allow unauthorized users to delete comments (UPDATED the comment template to allow user to (delete the comment if the user posted the comment AND the user can delete own comments) OR (the user can delete all comments))

Fixed Bug - Allow root administrator global rights (discovered a very cleverly hidden bug) - In the Comment class existing functions "canUserEditComment" and "canUserDeleteComment" contained a permission check on "canpostandeditcomments/caneditcomments" when this permission does NOT exist. There are only "canpostseeandeditallcomments/caneditcomments" and "canpostseeandeditallcomments/candeletecomments". REMOVED the bad permission checks from the function and ADDED two new functions "canUserEditOwnComment" and "canUserDeleteOwnComment" that will support "canpostandeditcomments/caneditcommentsown" and "canpostandeditcomments/canedeletecommentsown" permissions

Fixed Bug - Do not allow user to delete system comments

User Note:
Because comment editing and deleting is restrictive the admin will need to ConfigureTheBugGenie to allow this option. Also when this option is turned on, Guests are allowed to edit/delete their own comments. Since Guests encompasses all unregistered users, the admin will need to update the permission to all everyone to edit/delete their own comments EXCEPT guests.