hhuijser/liferay-portal — pull request #1504 by jonathanmccann (2013-09-11 19:16:58+00:00)
Title: LPS-39808 Page Comments - Users can delete and edit other User's Comments

Hey Hugo,

The issue here is that when the portlet checks for permissions, it submits the current user's ID as the owner ID instead of getting the owner ID from the message. It does it other places in the JSP file for view and add discussion, but there are no places in the portal to set the permissions for those actions on this portlet so it seems like any user who can view the portlet should be able to perform those actions.