Page comments portlet permissions

[Shira Rand, módosítva 11 év-val korábban]

Hello,

I'm trying to use the page comments portlet but for some reason any user gets the ability to edit and delete any comment although I didn't set any permissions that allow that behavior.
From what I was able to find there is a connection between this portlet an the message boards portlet, but the permissions there also don't allow such behavior.

Any idea how I can fix this problem?

Thanks!

[Shira Rand, módosítva 11 év-val korábban]

It seems that there is a bug in the discussion tag.

If you look at page.jsp on line 435 you see this:

<c:if test="<%= !hideControls &amp;&amp; MBDiscussionPermission.contains(permissionChecker, company.getCompanyId(), scopeGroupId, permissionClassName, permissionClassPK, message.getMessageId(), userId, ActionKeys.UPDATE_DISCUSSION) %>"></c:if>

Since the userId is passed as the ownerId parameter all users are owners of all the messages in the comments.

I hooked the page and change the userId into message.getUserId() and the link for edit disappeared (except for the message which the user is owner of).

Can anyone confirm that it is really a bug and not a problem with how I use the portlet? Basically I just added it to the page without doing anything else, so maybe I forgot something that gets the portlet to work properly.

P.S.
There is a similar check for delete, so the same change should solve the problem there.