ajung/plone.app.discussion
ajung
/
plone.app.discussion
0
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Rewrote all tal:condition in comments.pt. The authenticated user has 

the reply button and the comment form if he has the "Reply to item"
permission and the conversation is currently enabled.

Warning:
There is a security hole at the moment. Any authenticated user having the
zope2.View permission or anonymous user without captcha can add a comment
by creating a post request.

svn path=/plone.app.discussion/trunk/; revision=38888
This commit is contained in:
Vincent Fretin 2010-08-24 11:25:17 +00:00
parent 1579064ee6
commit 17fce9d515
2 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
plone/app/discussion/browser/comments.pt
View File

@ -25,7 +25,7 @@
<div class="discussion" <div class="discussion"
tal:attributes="class python: showCommenterImage and 'discussion showCommenterImage' or 'discussion';" tal:attributes="class python: showCommenterImage and 'discussion showCommenterImage' or 'discussion';"
tal:condition="python:replies or (userHasReplyPermission and isDiscussionAllowed) or (isAnon and not userHasReplyPermission and isDiscussionAllowed)"> tal:condition="has_replies">
<tal:getreplies repeat="reply_dict replies"> <tal:getreplies repeat="reply_dict replies">
<div class="comment" <div class="comment"
@ -85,7 +85,7 @@
<div class="commentActions"> <div class="commentActions">
<button class="context reply-to-comment-button hide allowMultiSubmit" <button class="context reply-to-comment-button hide allowMultiSubmit"
tal:condition="python:userHasReplyPermission and isDiscussionAllowed or isAnonymousDiscussionAllowed" tal:condition="python:isDiscussionAllowed and (isAnon and isAnonymousDiscussionAllowed or userHasReplyPermission)"
i18n:translate="label_reply"> i18n:translate="label_reply">
Reply Reply
</button> </button>
@ -94,7 +94,7 @@
action="" action=""
method="post" method="post"
style="display: inline;" style="display: inline;"
tal:condition="view/can_manage" tal:condition="canManage"
tal:attributes="action string:${reply/absolute_url}/@@moderate-delete-comment"> tal:attributes="action string:${reply/absolute_url}/@@moderate-delete-comment">
<input name="form.button.DeleteComment" <input name="form.button.DeleteComment"
class="destructive" class="destructive"
@ -109,6 +109,7 @@
action="" action=""
method="get" method="get"
style="display: inline;" style="display: inline;"
tal:condition="canManage"
tal:repeat="action reply_dict/actions|nothing" tal:repeat="action reply_dict/actions|nothing"
tal:attributes="action string:${reply/absolute_url}/@@moderate-publish-comment; tal:attributes="action string:${reply/absolute_url}/@@moderate-publish-comment;
name action/id"> name action/id">
@ -129,7 +130,7 @@
</div> </div>
<div class="reply" <div class="reply"
tal:condition="python: isAnon and not isAnonymousDiscussionAllowed and has_replies"> tal:condition="python:isDiscussionAllowed and (isAnon and not isAnonymousDiscussionAllowed)">
<form tal:attributes="action view/login_action"> <form tal:attributes="action view/login_action">
<input class="standalone" <input class="standalone"
style="margin-bottom: 1.25em;" style="margin-bottom: 1.25em;"
@ -140,7 +141,7 @@
</form> </form>
</div> </div>
<div id="commenting" class="reply" tal:condition="python: isAnon and isAnonymousDiscussionAllowed or not isAnon"> <div id="commenting" class="reply" tal:condition="python:isDiscussionAllowed and (isAnon and isAnonymousDiscussionAllowed or userHasReplyPermission)">
<fieldset> <fieldset>

2
plone/app/discussion/browser/comments.py
View File

@ -223,7 +223,7 @@ class CommentsViewlet(ViewletBase):
def has_replies(self, workflow_actions=False): def has_replies(self, workflow_actions=False):
"""Returns true if there are replies. """Returns true if there are replies.
""" """
if self.get_replies(workflow_actions): if self.get_replies(workflow_actions) is not None:
try: try:
self.get_replies(workflow_actions).next() self.get_replies(workflow_actions).next()
return True return True