Rewrote all tal:condition in comments.pt. The authenticated user has
the reply button and the comment form if he has the "Reply to item" permission and the conversation is currently enabled. Warning: There is a security hole at the moment. Any authenticated user having the zope2.View permission or anonymous user without captcha can add a comment by creating a post request. svn path=/plone.app.discussion/trunk/; revision=38888
This commit is contained in:
@@ -223,7 +223,7 @@ class CommentsViewlet(ViewletBase):
|
||||
def has_replies(self, workflow_actions=False):
|
||||
"""Returns true if there are replies.
|
||||
"""
|
||||
if self.get_replies(workflow_actions):
|
||||
if self.get_replies(workflow_actions) is not None:
|
||||
try:
|
||||
self.get_replies(workflow_actions).next()
|
||||
return True
|
||||
|
||||
Reference in New Issue
Block a user