From a7b3c818f26c80f414eb5a05844d2b54b5eadf6e Mon Sep 17 00:00:00 2001
From: Gaudenz Steinlin <gaudenz.steinlin@bz-gs.so.ch>
Date: Mon, 7 May 2012 13:02:07 +0200
Subject: [PATCH 1/8] Delete own comments

Add permission to allow comment authors to delete their own comments if
there are no replies yet.
---
 CHANGES.txt                                   |  8 +++++
 plone/app/discussion/browser/comments.pt      | 13 ++++++++
 plone/app/discussion/browser/comments.py      | 24 +++++++++++++-
 plone/app/discussion/browser/configure.zcml   | 10 +++++-
 .../browser/javascripts/comments.js           |  3 ++
 plone/app/discussion/browser/moderation.py    | 31 +++++++++++++++++++
 plone/app/discussion/permissions.zcml         |  5 +++
 .../discussion/profiles/default/rolemap.xml   |  6 ++++
 8 files changed, 98 insertions(+), 2 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index bb27a70..33f7280 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -3,9 +3,17 @@ Changelog
 
 2.1.6 (unreleased)
 ------------------
+- Add permission to allow comment authors to delete their own comments if 
+  there are no replies yet.
+  [gaudenz]
+
 - Add Site Administrator role to Review comments permission.
   [gaudenz]
 
+- Add permission to allow comment authors to delete their own comments if 
+  there are no replies yet.
+  [gaudenz]
+
 - Fix excessive JS comment deletion.
   [gaudenz]
 
diff --git a/plone/app/discussion/browser/comments.pt b/plone/app/discussion/browser/comments.pt
index ac38d1a..fbc95eb 100644
--- a/plone/app/discussion/browser/comments.pt
+++ b/plone/app/discussion/browser/comments.pt
@@ -83,6 +83,19 @@
                     <span tal:replace="structure reply/getText" />
 
                     <div class="commentActions">
+                        <form name="delete"
+                              action=""
+                              method="post"
+			      tal:condition="python: not view.can_review() and view.could_delete_own(reply)"
+                              tal:attributes="action string:${reply/absolute_url}/@@delete-own-comment;
+			                      style python:view.can_delete_own(reply) and 'display: inline' or 'display: none'">
+                            <input name="form.button.DeleteComment"
+                                   class="destructive"
+                                   type="submit"
+                                   value="Delete"
+                                   i18n:attributes="value label_delete;"
+                                   />
+                        </form>
                         <form name="delete"
                               action=""
                               method="post"
diff --git a/plone/app/discussion/browser/comments.py b/plone/app/discussion/browser/comments.py
index cae1887..9420671 100644
--- a/plone/app/discussion/browser/comments.py
+++ b/plone/app/discussion/browser/comments.py
@@ -190,6 +190,7 @@ class CommentForm(extensible.ExtensibleForm, form.Form):
             # Member
             member = portal_membership.getAuthenticatedMember()
             username = member.getUserName()
+            userid = member.getUserId()
             email = member.getProperty('email')
             fullname = member.getProperty('fullname')
             if not fullname or fullname == '':
@@ -206,6 +207,10 @@ class CommentForm(extensible.ExtensibleForm, form.Form):
             comment.user_notification = user_notification
             comment.creation_date = datetime.utcnow()
             comment.modification_date = datetime.utcnow()
+
+            # add local "Owner" role for current user
+            comment.manage_setLocalRoles(userid, ['Owner'])
+
         else:  # pragma: no cover
             raise Unauthorized("Anonymous user tries to post a comment, but "
                 "anonymous commenting is disabled. Or user does not have the "
@@ -283,6 +288,24 @@ class CommentsViewlet(ViewletBase):
         return getSecurityManager().checkPermission('Review comments',
                                                     aq_inner(self.context))
 
+    def can_delete_own(self, comment):
+        """Returns true if the current user can delete the comment. Only
+        comments without replies can be deleted.
+        """
+        try:
+            return comment.restrictedTraverse('@@delete-own-comment').can_delete()
+        except Unauthorized:
+            return False
+
+    def could_delete_own(self, comment):
+        """Returns true if the current user could delete the comment if it had no
+        replies. This is used to prepare hidden form buttons for JS.
+        """
+        try:
+            return comment.restrictedTraverse('@@delete-own-comment').could_delete()
+        except Unauthorized:
+            return False
+
     def is_discussion_allowed(self):
         context = aq_inner(self.context)
         return context.restrictedTraverse('@@conversation_view').enabled()
@@ -346,7 +369,6 @@ class CommentsViewlet(ViewletBase):
         conversation = IConversation(context)
 
         wf = getToolByName(context, 'portal_workflow')
-
         # workflow_actions is only true when user
         # has 'Manage portal' permission
 
diff --git a/plone/app/discussion/browser/configure.zcml b/plone/app/discussion/browser/configure.zcml
index a240167..b60a64d 100644
--- a/plone/app/discussion/browser/configure.zcml
+++ b/plone/app/discussion/browser/configure.zcml
@@ -71,7 +71,7 @@
         permission="zope2.View"
         />
 
-    <!-- Delete comment view -->
+    <!-- Delete comment views -->
     <browser:page
         for="plone.app.discussion.interfaces.IComment"
         name="moderate-delete-comment"
@@ -80,6 +80,14 @@
         permission="plone.app.discussion.ReviewComments"
         />
 
+    <browser:page
+        for="plone.app.discussion.interfaces.IComment"
+        name="delete-own-comment"
+        layer="..interfaces.IDiscussionLayer"
+        class=".moderation.DeleteOwnComment"
+        permission="plone.app.discussion.DeleteOwnComments"
+        />
+
     <!-- Publish comment view -->
     <browser:page
         for="plone.app.discussion.interfaces.IComment"
diff --git a/plone/app/discussion/browser/javascripts/comments.js b/plone/app/discussion/browser/javascripts/comments.js
index 6519202..f0de4b2 100644
--- a/plone/app/discussion/browser/javascripts/comments.js
+++ b/plone/app/discussion/browser/javascripts/comments.js
@@ -193,6 +193,9 @@
                             $(this).remove();
                         });
                     });
+                    // Add delete button to the parent
+                    var parent = comment.prev('[class*="replyTreeLevel' + (treelevel - 1) + '"]');
+                    parent.find('form[name="delete"]').css('display', 'inline');
                     // remove comment
                     $(this).fadeOut('fast', function () {
                         $(this).remove();
diff --git a/plone/app/discussion/browser/moderation.py b/plone/app/discussion/browser/moderation.py
index 4e44a9b..30c5f72 100644
--- a/plone/app/discussion/browser/moderation.py
+++ b/plone/app/discussion/browser/moderation.py
@@ -1,6 +1,8 @@
 # -*- coding: utf-8 -*-
 from Acquisition import aq_inner, aq_parent
 
+from AccessControl import Unauthorized, getSecurityManager
+
 from Products.Five.browser import BrowserView
 from Products.Five.browser.pagetemplatefile import ViewPageTemplateFile
 
@@ -10,6 +12,7 @@ from Products.statusmessages.interfaces import IStatusMessage
 
 from plone.app.discussion.interfaces import _
 from plone.app.discussion.interfaces import IComment
+from plone.app.discussion.interfaces import IReplies
 
 
 class View(BrowserView):
@@ -104,6 +107,34 @@ class DeleteComment(BrowserView):
         return self.context.REQUEST.RESPONSE.redirect(came_from)
 
 
+class DeleteOwnComment(DeleteComment):
+    """Delete an own comment if it has no replies. Following conditions have to be true
+    for a user to be able to delete his comments:
+    * "Delete own comments" permission
+    * no replies to the comment
+    * Owner role directly assigned on the comment object
+    """
+
+    def could_delete(self):
+        """returns true if the comment could be deleted if it had no replies."""
+        sm = getSecurityManager()
+        context = aq_inner(self.context)
+        userid = sm.getUser().getId()
+        return (sm.checkPermission('Delete own comments',
+                                   context)
+                and 'Owner' in context.get_local_roles_for_userid(userid))
+
+    def can_delete(self):
+        return (len(IReplies(aq_inner(self.context))) == 0
+                and self.could_delete())
+
+    def __call__(self):
+        if self.can_delete():
+            super(DeleteOwnComment, self).__call__()
+        else:
+            raise Unauthorized("Your not allowed to delete this comment.")
+
+
 class PublishComment(BrowserView):
     """Publish a comment.
 
diff --git a/plone/app/discussion/permissions.zcml b/plone/app/discussion/permissions.zcml
index c5b090c..2bc2842 100644
--- a/plone/app/discussion/permissions.zcml
+++ b/plone/app/discussion/permissions.zcml
@@ -9,4 +9,9 @@
         title="Review comments"
         />
 
+    <permission
+        id="plone.app.discussion.DeleteOwnComments"
+        title="Delete own comments"
+        />
+
 </configure>
diff --git a/plone/app/discussion/profiles/default/rolemap.xml b/plone/app/discussion/profiles/default/rolemap.xml
index 83318d8..f3ca8c4 100644
--- a/plone/app/discussion/profiles/default/rolemap.xml
+++ b/plone/app/discussion/profiles/default/rolemap.xml
@@ -9,5 +9,11 @@
         <permission name="Reply to item" acquire="False">
             <role name="Authenticated"/>
         </permission>
+        <permission name="Delete own comments" acquire="False">
+            <role name="Manager"/>
+	    <role name="Site Administrator"/>
+            <role name="Reviewer"/>
+            <role name="Owner"/>
+        </permission>
     </permissions>
 </rolemap>

From 2ba35bb0d41e8a1a4854a831bc545fff20d7fe6f Mon Sep 17 00:00:00 2001
From: "Jens W. Klein" <jk@kleinundpartner.at>
Date: Sun, 17 Aug 2014 04:54:12 +0200
Subject: [PATCH 2/8] merge fixed

---
 plone/app/discussion/browser/comments.pt | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/plone/app/discussion/browser/comments.pt b/plone/app/discussion/browser/comments.pt
index fa2c6b2..ceb50de 100644
--- a/plone/app/discussion/browser/comments.pt
+++ b/plone/app/discussion/browser/comments.pt
@@ -89,7 +89,6 @@
                         <form name="delete"
                               action=""
                               method="post"
-                              style="display: inline;"
                               class="commentactionsform"
 		                      tal:condition="python: not canDelete and view.could_delete_own(reply)"
                               tal:attributes="action string:${reply/absolute_url}/@@delete-own-comment;
@@ -104,8 +103,6 @@
                         <form name="delete"
                               action=""
                               method="post"
-                              style="display: inline;"
-                              tal:condition="canReview"
                               class="commentactionsform"
                               tal:condition="python:canDelete"
                               tal:attributes="action string:${reply/absolute_url}/@@moderate-delete-comment">

From a94b3249a9f38f24fe76248810bcd22371aa0a02 Mon Sep 17 00:00:00 2001
From: Thomas Desvenain <thomas.desvenain@gmail.com>
Date: Fri, 5 Sep 2014 11:11:54 +0200
Subject: [PATCH 3/8] fixed can_delete called from parent

---
 plone/app/discussion/browser/moderation.py | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/plone/app/discussion/browser/moderation.py b/plone/app/discussion/browser/moderation.py
index 93f0b97..21aef4a 100644
--- a/plone/app/discussion/browser/moderation.py
+++ b/plone/app/discussion/browser/moderation.py
@@ -132,18 +132,19 @@ class DeleteOwnComment(DeleteComment):
     * Owner role directly assigned on the comment object
     """
 
-    def could_delete(self):
+    def could_delete(self, comment=None):
         """returns true if the comment could be deleted if it had no replies."""
         sm = getSecurityManager()
-        context = aq_inner(self.context)
+        comment = comment or aq_inner(self.context)
         userid = sm.getUser().getId()
         return (sm.checkPermission('Delete own comments',
-                                   context)
-                and 'Owner' in context.get_local_roles_for_userid(userid))
+                                   comment)
+                and 'Owner' in comment.get_local_roles_for_userid(userid))
 
-    def can_delete(self):
-        return (len(IReplies(aq_inner(self.context))) == 0
-                and self.could_delete())
+    def can_delete(self, comment=None):
+        comment = comment or self.context
+        return (len(IReplies(aq_inner(comment))) == 0
+                and self.could_delete(comment=comment))
 
     def __call__(self):
         if self.can_delete():

From 80a9dea1d87d9b42bdd586bcc9fca753ee0fbf16 Mon Sep 17 00:00:00 2001
From: Vincent Fretin <vincent.fretin@gmail.com>
Date: Sat, 20 Sep 2014 14:08:50 +0200
Subject: [PATCH 4/8] no extra debug for plone.app.robotframework

---
 setup.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup.py b/setup.py
index a912d59..2c32684 100644
--- a/setup.py
+++ b/setup.py
@@ -56,7 +56,7 @@ setup(name='plone.app.discussion',
               'plone.contentrules',
               'plone.app.contentrules',
               'plone.app.contenttypes[test]',
-              'plone.app.robotframework[ride,reload,debug]',
+              'plone.app.robotframework[ride,reload]',
           ]
       },
       entry_points="""

From ee28528f556a1e44dc7f65a5c5715ba6e2510718 Mon Sep 17 00:00:00 2001
From: Vincent Fretin <vincent.fretin@gmail.com>
Date: Sat, 20 Sep 2014 14:14:19 +0200
Subject: [PATCH 5/8] Don't use session at all for content rules, set the event
 in the request to be able to access comment attributes. This fixes
 'InvalidObjectReference: A new object is reachable from multiple databases.'
 if comment contains a RichTextValue which contains a RawValueHolder
 (persistent object).

---
 plone/app/discussion/contentrules.py          | 22 ++++++++-----------
 plone/app/discussion/events.py                | 14 ++++--------
 .../app/discussion/tests/test_contentrules.py |  8 -------
 3 files changed, 13 insertions(+), 31 deletions(-)

diff --git a/plone/app/discussion/contentrules.py b/plone/app/discussion/contentrules.py
index 4f2b58e..dfa00fc 100644
--- a/plone/app/discussion/contentrules.py
+++ b/plone/app/discussion/contentrules.py
@@ -28,22 +28,18 @@ class CommentSubstitution(BaseSubstitution):
     """
     def __init__(self, context, **kwargs):
         super(CommentSubstitution, self).__init__(context, **kwargs)
-        self._session = None
 
     @property
-    def session(self):
-        """ User session
+    def event(self):
+        """ event that triggered the content rule
         """
-        if self._session is None:
-            sdm = getattr(self.context, 'session_data_manager', None)
-            self._session = sdm.getSessionData(create=False) if sdm else {}
-        return self._session
+        return self.context.REQUEST.get('event')
 
     @property
     def comment(self):
         """ Get changed inline comment
         """
-        return self.session.get('comment', {})
+        return self.event.comment
 
 class Id(CommentSubstitution):
     """ Comment id string substitution
@@ -54,7 +50,7 @@ class Id(CommentSubstitution):
     def safe_call(self):
         """ Safe call
         """
-        return self.comment.get('comment_id', u'')
+        return getattr(self.comment, 'comment_id', u'')
 
 class Text(CommentSubstitution):
     """ Comment text
@@ -65,7 +61,7 @@ class Text(CommentSubstitution):
     def safe_call(self):
         """ Safe call
         """
-        return self.comment.get('text', u'')
+        return getattr(self.comment, 'text', u'')
 
 class AuthorUserName(CommentSubstitution):
     """ Comment author user name string substitution
@@ -76,7 +72,7 @@ class AuthorUserName(CommentSubstitution):
     def safe_call(self):
         """ Safe call
         """
-        return self.comment.get('author_username', u'')
+        return getattr(self.comment, 'author_username', u'')
 
 class AuthorFullName(CommentSubstitution):
     """ Comment author full name string substitution
@@ -87,7 +83,7 @@ class AuthorFullName(CommentSubstitution):
     def safe_call(self):
         """ Safe call
         """
-        return self.comment.get('author_name', u'')
+        return getattr(self.comment, 'author_name', u'')
 
 class AuthorEmail(CommentSubstitution):
     """ Comment author email string substitution
@@ -98,4 +94,4 @@ class AuthorEmail(CommentSubstitution):
     def safe_call(self):
         """ Safe call
         """
-        return self.comment.get('author_email', u'')
+        return getattr(self.comment, 'author_email', u'')
diff --git a/plone/app/discussion/events.py b/plone/app/discussion/events.py
index 30d49a1..804077a 100644
--- a/plone/app/discussion/events.py
+++ b/plone/app/discussion/events.py
@@ -19,16 +19,10 @@ class DiscussionEvent(object):
         for key, value in kwargs.items():
             setattr(self, key, value)
 
-        # Add comment on session to easily define content-rules dynamic strings
-        sdm = getattr(context, 'session_data_manager', None)
-        session = sdm.getSessionData(create=True) if sdm else None
-
-        if session:
-            sessionComment = dict(
-                (field, getattr(comment, field, None)) for field in IComment
-                if not field.startswith('_')
-            )
-            session.set('comment', sessionComment)
+        # Add event to the request to be able to access comment attributes
+        # in content-rules dynamic strings
+        request = context.REQUEST
+        request.set('event', self)
 
 class CommentAddedEvent(DiscussionEvent):
     """ Event to be triggered when a Comment is added
diff --git a/plone/app/discussion/tests/test_contentrules.py b/plone/app/discussion/tests/test_contentrules.py
index 16618e2..a9e9bf1 100644
--- a/plone/app/discussion/tests/test_contentrules.py
+++ b/plone/app/discussion/tests/test_contentrules.py
@@ -1,9 +1,7 @@
 # -*- coding: utf-8 -*-
 
 import unittest2 as unittest
-from Testing import ZopeTestCase as ztc
 from zope.component import createObject, getAdapter
-from zope.event import notify
 from plone.app.testing import TEST_USER_ID, setRoles
 
 from plone.contentrules.rule.interfaces import IRuleEventType
@@ -25,9 +23,6 @@ class CommentContentRulesTest(unittest.TestCase):
     layer = PLONE_APP_DISCUSSION_INTEGRATION_TESTING
 
     def setUp(self):
-        # Setup session manager
-        ztc.utils.setupCoreSessions(self.layer['app'])
-
         # Setup sandbox
         self.portal = self.layer['portal']
         self.request = self.layer['request']
@@ -94,9 +89,6 @@ class ReplyContentRulesTest(unittest.TestCase):
     layer = PLONE_APP_DISCUSSION_INTEGRATION_TESTING
 
     def setUp(self):
-        # Setup session manager
-        ztc.utils.setupCoreSessions(self.layer['app'])
-
         # Setup sandbox
         self.portal = self.layer['portal']
         self.request = self.layer['request']

From 2a8082cfa7d37c8c247f1a105b7e027cde5e0940 Mon Sep 17 00:00:00 2001
From: Vincent Fretin <vincent.fretin@gmail.com>
Date: Sat, 20 Sep 2014 16:02:48 +0200
Subject: [PATCH 6/8] add delete_own_comment_enabled option in control panel

---
 plone/app/discussion/browser/comments.pt            |  3 ++-
 plone/app/discussion/browser/comments.py            | 10 ++++++++--
 plone/app/discussion/browser/controlpanel.py        |  5 +++++
 .../discussion/browser/javascripts/controlpanel.js  |  2 ++
 plone/app/discussion/browser/moderation.py          |  8 ++++----
 plone/app/discussion/configure.zcml                 |  8 ++++----
 plone/app/discussion/interfaces.py                  | 13 ++++++++++++-
 plone/app/discussion/profiles/default/registry.xml  |  1 +
 plone/app/discussion/tests/test_controlpanel.py     |  8 ++++----
 9 files changed, 42 insertions(+), 16 deletions(-)

diff --git a/plone/app/discussion/browser/comments.pt b/plone/app/discussion/browser/comments.pt
index ceb50de..8e69b15 100644
--- a/plone/app/discussion/browser/comments.pt
+++ b/plone/app/discussion/browser/comments.pt
@@ -2,6 +2,7 @@
                        isDiscussionAllowed view/is_discussion_allowed;
                        isAnonymousDiscussionAllowed view/anonymous_discussion_allowed;
                        isEditCommentAllowed view/edit_comment_allowed;
+                       isDeleteOwnCommentAllowed view/delete_own_comment_allowed;
                        isAnon view/is_anonymous;
                        canReview view/can_review;
                        replies python:view.get_replies(canReview);
@@ -90,7 +91,7 @@
                               action=""
                               method="post"
                               class="commentactionsform"
-		                      tal:condition="python: not canDelete and view.could_delete_own(reply)"
+		                      tal:condition="python:not canDelete and isDeleteOwnCommentAllowed and view.could_delete_own(reply)"
                               tal:attributes="action string:${reply/absolute_url}/@@delete-own-comment;
 			                      style python:view.can_delete_own(reply) and 'display: inline' or 'display: none'">
                             <input name="form.button.DeleteComment"
diff --git a/plone/app/discussion/browser/comments.py b/plone/app/discussion/browser/comments.py
index 21eec9b..fc4a46a 100644
--- a/plone/app/discussion/browser/comments.py
+++ b/plone/app/discussion/browser/comments.py
@@ -346,8 +346,8 @@ class CommentsViewlet(ViewletBase):
                                                     aq_inner(reply))
 
     def can_delete(self, reply):
-        """By default requires 'Review comments'.
-        If 'delete own comments' is enabled, requires 'Edit comments'.
+        """Returns true if current user has the 'Delete comments'
+        permission.
         """
         return getSecurityManager().checkPermission('Delete comments',
                                                     aq_inner(reply))
@@ -482,6 +482,12 @@ class CommentsViewlet(ViewletBase):
         settings = registry.forInterface(IDiscussionSettings, check=False)
         return settings.edit_comment_enabled
 
+    def delete_own_comment_allowed(self):
+        # Check if delete own comments is allowed in the registry
+        registry = queryUtility(IRegistry)
+        settings = registry.forInterface(IDiscussionSettings, check=False)
+        return settings.delete_own_comment_enabled
+
     def show_commenter_image(self):
         # Check if showing commenter image is enabled in the registry
         registry = queryUtility(IRegistry)
diff --git a/plone/app/discussion/browser/controlpanel.py b/plone/app/discussion/browser/controlpanel.py
index 822ca2b..a9d269f 100644
--- a/plone/app/discussion/browser/controlpanel.py
+++ b/plone/app/discussion/browser/controlpanel.py
@@ -54,6 +54,8 @@ class DiscussionSettingsEditForm(controlpanel.RegistryEditForm):
             SingleCheckBoxFieldWidget
         self.fields['edit_comment_enabled'].widgetFactory = \
             SingleCheckBoxFieldWidget
+        self.fields['delete_own_comment_enabled'].widgetFactory = \
+            SingleCheckBoxFieldWidget
         self.fields['anonymous_comments'].widgetFactory = \
             SingleCheckBoxFieldWidget
         self.fields['show_commenter_image'].widgetFactory = \
@@ -130,6 +132,9 @@ class DiscussionSettingsControlPanel(controlpanel.ControlPanelFormWrapper):
         if settings.edit_comment_enabled:
             output.append("edit_comment_enabled")
 
+        if settings.delete_own_comment_enabled:
+            output.append("delte_own_comment_enabled")
+
         # Anonymous comments
         if settings.anonymous_comments:
             output.append("anonymous_comments")
diff --git a/plone/app/discussion/browser/javascripts/controlpanel.js b/plone/app/discussion/browser/javascripts/controlpanel.js
index e379f6f..9d242ce 100644
--- a/plone/app/discussion/browser/javascripts/controlpanel.js
+++ b/plone/app/discussion/browser/javascripts/controlpanel.js
@@ -41,6 +41,7 @@
                 $('#formfield-form-widgets-anonymous_comments'),
                 $('#formfield-form-widgets-moderation_enabled'),
                 $('#formfield-form-widgets-edit_comment_enabled'),
+                $('#formfield-form-widgets-delete_own_comment_enabled'),
                 $('#formfield-form-widgets-text_transform'),
                 $('#formfield-form-widgets-captcha'),
                 $('#formfield-form-widgets-show_commenter_image'),
@@ -54,6 +55,7 @@
                 $('#formfield-form-widgets-anonymous_comments'),
                 $('#formfield-form-widgets-moderation_enabled'),
                 $('#formfield-form-widgets-edit_comment_enabled'),
+                $('#formfield-form-widgets-delete_own_comment_enabled'),
                 $('#formfield-form-widgets-text_transform'),
                 $('#formfield-form-widgets-captcha'),
                 $('#formfield-form-widgets-show_commenter_image'),
diff --git a/plone/app/discussion/browser/moderation.py b/plone/app/discussion/browser/moderation.py
index 21aef4a..ebdb97a 100644
--- a/plone/app/discussion/browser/moderation.py
+++ b/plone/app/discussion/browser/moderation.py
@@ -117,8 +117,8 @@ class DeleteComment(BrowserView):
         return self.context.REQUEST.RESPONSE.redirect(came_from)
 
     def can_delete(self, reply):
-        """By default requires 'Review comments'.
-        If 'delete own comments' is enabled, requires 'Edit comments'.
+        """Returns true if current user has the 'Delete comments'
+        permission.
         """
         return getSecurityManager().checkPermission('Delete comments',
                                                     aq_inner(reply))
@@ -133,7 +133,7 @@ class DeleteOwnComment(DeleteComment):
     """
 
     def could_delete(self, comment=None):
-        """returns true if the comment could be deleted if it had no replies."""
+        """Returns true if the comment could be deleted if it had no replies."""
         sm = getSecurityManager()
         comment = comment or aq_inner(self.context)
         userid = sm.getUser().getId()
@@ -150,7 +150,7 @@ class DeleteOwnComment(DeleteComment):
         if self.can_delete():
             super(DeleteOwnComment, self).__call__()
         else:
-            raise Unauthorized("Your not allowed to delete this comment.")
+            raise Unauthorized("You're not allowed to delete this comment.")
 
 
 class PublishComment(BrowserView):
diff --git a/plone/app/discussion/configure.zcml b/plone/app/discussion/configure.zcml
index 66c5296..8ead976 100644
--- a/plone/app/discussion/configure.zcml
+++ b/plone/app/discussion/configure.zcml
@@ -45,8 +45,8 @@
         />
 
     <genericsetup:upgradeStep
-        title="edit comments"
-        description="reload registry config to enable new field edit_comment_enabled"
+        title="edit comments and delete own comments"
+        description="reload registry config to enable new fields edit_comment_enabled and delete_own_comment_enabled"
         source="100"
         destination="101"
         handler=".upgrades.update_registry"
@@ -55,8 +55,8 @@
     />
 
     <genericsetup:upgradeStep
-        title="delete comments"
-        description="reload rolemap config to enable new permission 'Delete comments'"
+        title="delete comments and delete own comments"
+        description="reload rolemap config to enable new permissions 'Delete comments' and 'Delete own comments'"
         source="101"
         destination="102"
         handler=".upgrades.update_rolemap"
diff --git a/plone/app/discussion/interfaces.py b/plone/app/discussion/interfaces.py
index a807580..c0328b3 100644
--- a/plone/app/discussion/interfaces.py
+++ b/plone/app/discussion/interfaces.py
@@ -247,13 +247,24 @@ class IDiscussionSettings(Interface):
         title=_(u"label_edit_comment_enabled",
                 default="Enable editing of comments"),
         description=_(u"help_edit_comment_enabled",
-                      default=u"If selected, supports editing and deletion "
+                      default=u"If selected, supports editing "
                       "of comments for users with the 'Edit comments' "
                       "permission."),
         required=False,
         default=False,
     )
 
+    delete_own_comment_enabled = schema.Bool(
+        title=_(u"label_delete_own_comment_enabled",
+                default="Enable deleting own comments"),
+        description=_(u"help_delete_own_comment_enabled",
+                      default=u"If selected, supports deleting "
+                      "of own comments for users with the "
+                      "'Delete own comments' permission."),
+        required=False,
+        default=False,
+    )
+
     text_transform = schema.Choice(
         title=_(u"label_text_transform",
                 default="Comment text transform"),
diff --git a/plone/app/discussion/profiles/default/registry.xml b/plone/app/discussion/profiles/default/registry.xml
index 2518c9a..bd6aa5b 100644
--- a/plone/app/discussion/profiles/default/registry.xml
+++ b/plone/app/discussion/profiles/default/registry.xml
@@ -2,5 +2,6 @@
 <registry>
 	<records interface="plone.app.discussion.interfaces.IDiscussionSettings">
 		<value key="edit_comment_enabled">False</value>
+		<value key="delete_own_comment_enabled">False</value>
 	</records>
 </registry>
diff --git a/plone/app/discussion/tests/test_controlpanel.py b/plone/app/discussion/tests/test_controlpanel.py
index 8a2ba47..d672167 100644
--- a/plone/app/discussion/tests/test_controlpanel.py
+++ b/plone/app/discussion/tests/test_controlpanel.py
@@ -89,12 +89,12 @@ class RegistryTest(unittest.TestCase):
                           'IDiscussionSettings.edit_comment_enabled'],
             False)
 
-    def test_edit_comment_enabled(self):
-        # Check edit_comment_enabled record
-        self.assertTrue('edit_comment_enabled' in IDiscussionSettings)
+    def test_delete_own_comment_enabled(self):
+        # Check delete_own_comment_enabled record
+        self.assertTrue('delete_own_comment_enabled' in IDiscussionSettings)
         self.assertEqual(
             self.registry['plone.app.discussion.interfaces.' +
-                          'IDiscussionSettings.edit_comment_enabled'],
+                          'IDiscussionSettings.delete_own_comment_enabled'],
             False)
 
     def test_text_transform(self):

From acacc8281a4c87149bb00550533c29a02ecc8296 Mon Sep 17 00:00:00 2001
From: Vincent Fretin <vincent.fretin@gmail.com>
Date: Sat, 20 Sep 2014 16:21:55 +0200
Subject: [PATCH 7/8] add a test for delete-own-comment view

---
 .../discussion/tests/test_comments_viewlet.py | 56 ++++++++++++++++++-
 1 file changed, 55 insertions(+), 1 deletion(-)

diff --git a/plone/app/discussion/tests/test_comments_viewlet.py b/plone/app/discussion/tests/test_comments_viewlet.py
index 0aff711..6619b1a 100644
--- a/plone/app/discussion/tests/test_comments_viewlet.py
+++ b/plone/app/discussion/tests/test_comments_viewlet.py
@@ -26,7 +26,7 @@ from Products.CMFCore.utils import getToolByName
 
 from Products.CMFPlone.tests import dummy
 
-from plone.app.testing import TEST_USER_ID, setRoles
+from plone.app.testing import TEST_USER_ID, TEST_USER_NAME, setRoles
 from plone.app.testing import logout
 from plone.app.testing import login
 
@@ -266,6 +266,60 @@ class TestCommentForm(unittest.TestCase):
         self.assertEqual(0, len([x for x in conversation.getComments()]))
         setRoles(self.portal, TEST_USER_ID, ['Manager'])
 
+    def test_delete_own_comment(self):
+        """Delete own comment as logged-in user.
+        """
+
+        # Allow discussion
+        self.portal.doc1.allow_discussion = True
+        self.viewlet = CommentsViewlet(self.context, self.request, None, None)
+
+        def make_request(form={}):
+            request = TestRequest()
+            request.form.update(form)
+            alsoProvides(request, IFormLayer)
+            alsoProvides(request, IAttributeAnnotatable)
+            return request
+
+        provideAdapter(
+            adapts=(Interface, IBrowserRequest),
+            provides=Interface,
+            factory=CommentForm,
+            name=u"comment-form"
+        )
+
+        # The form is submitted successfully, if the required text field is
+        # filled out
+        form_request = make_request(form={'form.widgets.text': u'bar'})
+
+        commentForm = getMultiAdapter(
+            (self.context, form_request),
+            name=u"comment-form"
+        )
+
+        commentForm.update()
+        data, errors = commentForm.extractData()  # pylint: disable-msg=W0612
+        self.assertEqual(len(errors), 0)
+        self.assertFalse(commentForm.handleComment(commentForm, "foo"))
+
+        # Delete the last comment
+        conversation = IConversation(self.context)
+        comment = [x for x in conversation.getComments()][-1]
+        deleteView = getMultiAdapter(
+            (comment, self.request),
+            name=u"delete-own-comment"
+        )
+        # try to delete last comment with johndoe
+        setRoles(self.portal, 'johndoe', ['Member'])
+        login(self.portal, 'johndoe')
+        self.assertRaises(Unauthorized, comment.restrictedTraverse, "@@delete-own-comment")
+        self.assertEqual(1, len([x for x in conversation.getComments()]))
+        # try to delete last comment with the same user that created it
+        login(self.portal, TEST_USER_NAME)
+        setRoles(self.portal, TEST_USER_ID, ['Member'])
+        deleteView()
+        self.assertEqual(0, len([x for x in conversation.getComments()]))
+
     def test_add_anonymous_comment(self):
         self.portal.doc1.allow_discussion = True
 

From 06b20b8f81c5e6c379ca111d42b6feec9027c2bd Mon Sep 17 00:00:00 2001
From: Vincent Fretin <vincent.fretin@gmail.com>
Date: Thu, 9 Oct 2014 11:41:00 +0200
Subject: [PATCH 8/8] merge fix from master (Don't execute createReplyForm js
 if there is no in_reply_to button)

---
 CHANGES.rst                                          | 3 +++
 plone/app/discussion/browser/javascripts/comments.js | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/CHANGES.rst b/CHANGES.rst
index 86bcb2c..295f1d4 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -8,6 +8,9 @@ Changelog
   there are no replies yet.
   [gaudenz]
 
+- Don't execute createReplyForm js if there is no in_reply_to button.
+  [vincentfretin]
+
 - Register events as Content Rules Event Types if plone.contentrules is present
   [avoinea]
 
diff --git a/plone/app/discussion/browser/javascripts/comments.js b/plone/app/discussion/browser/javascripts/comments.js
index 3060a3d..7b492c7 100644
--- a/plone/app/discussion/browser/javascripts/comments.js
+++ b/plone/app/discussion/browser/javascripts/comments.js
@@ -106,7 +106,7 @@
         var post_comment_div = $("#commenting");
         var in_reply_to_field =
             post_comment_div.find("input[name='form.widgets.in_reply_to']");
-        if (in_reply_to_field.val() !== "") {
+        if (in_reply_to_field.length !== 0 && in_reply_to_field.val() !== "") {
             var current_reply_id = "#" + in_reply_to_field.val();
             var current_reply_to_div = $(".discussion").find(current_reply_id);
             $.createReplyForm(current_reply_to_div);