Forums

Home » Liferay Portal » English » 3. Development

Combination View Flat View Tree View
Threads [ Previous | Next ]
toggle
Shira Rand
Page comments portlet permissions
April 15, 2013 1:57 AM
Answer

Shira Rand

Rank: New Member

Posts: 15

Join Date: February 13, 2013

Recent Posts

Hello,

I'm trying to use the page comments portlet but for some reason any user gets the ability to edit and delete any comment although I didn't set any permissions that allow that behavior.
From what I was able to find there is a connection between this portlet an the message boards portlet, but the permissions there also don't allow such behavior.

Any idea how I can fix this problem?

Thanks!
Shira Rand
RE: Page comments portlet permissions
April 17, 2013 1:19 AM
Answer

Shira Rand

Rank: New Member

Posts: 15

Join Date: February 13, 2013

Recent Posts

It seems that there is a bug in the discussion tag.

If you look at page.jsp on line 435 you see this:
1<c:if test="<%= !hideControls && MBDiscussionPermission.contains(permissionChecker, company.getCompanyId(), scopeGroupId, permissionClassName, permissionClassPK, message.getMessageId(), userId, ActionKeys.UPDATE_DISCUSSION) %>">

Since the userId is passed as the ownerId parameter all users are owners of all the messages in the comments.

I hooked the page and change the userId into message.getUserId() and the link for edit disappeared (except for the message which the user is owner of).

Can anyone confirm that it is really a bug and not a problem with how I use the portlet? Basically I just added it to the page without doing anything else, so maybe I forgot something that gets the portlet to work properly.

P.S.
There is a similar check for delete, so the same change should solve the problem there.