[MGNLFORUM-259] Creating thread- and forum-node should not require moderator-rights Created: 28/Apr/14  Updated: 14/May/14  Resolved: 07/May/14

Status: Closed
Project: Forum (closed)
Component/s: security
Affects Version/s: 3.3
Fix Version/s: 3.3.1

Type: Bug Priority: Blocker
Reporter: Christoph Meier Assignee: Christoph Meier
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
dependency
is depended upon by MGNLCMNT-107 pagecommenting per locale and/or per ... Closed
is depended upon by MGNLCMNT-108 Anonymous user cannot add the first c... Closed
Template:
Acceptance criteria:
Empty
Date of First Response:

 Description   

Since the introduction of the "simple security model", a user with "some basic forum rights" should be able to create a thread (or forum, on EE with multi-site or multi-locale).

What means "some basic forum right"?
The issue poped-up because currently anonmyous user cannot create a 1st comment on page-commenting.
When entering the 1st comment to a page, a thread-node is created in the pagecommenting-Forum-Node.
On EE, with multi-site and/or multi-locale, it is required to create a forum-node by anonymous user.

Note, that anonymous-user has the role "forum-pagecomments-user".
Since we do no more check speficially for every created forum (per ACL), it should be possible to create a thread with the role "forum_ALL-user".
Now ... either anonymous-user also should get "forum_ALL-user" (which i think is wrong) ... or for the creation of a thread, it should be checked, whether the user has
"forum-pagecomments-user" or "forum_ALL-user" -role.

During the very last changes on MGNLFORUM-253 there has been added a check in DefaultForumManager#createThread.
isModerator currently prevents anonymous-user to create the thread (or the forum-node).



 Comments   
Comment by Christoph Meier [ 06/May/14 ]

isModerator() has been removed from the methods which are responsible to create thread- or forum-node; doesn't really make sense to have it there.

Comment by Christoph Meier [ 06/May/14 ]

Commited onto branch "MGNLFORUM-259".
(See https://git.magnolia-cms.com/gitweb/?p=modules/forum.git;a=commit;h=39488aaaf5a09d03dd7f4c1ff04df522af38cece )

Comment by Daniel Lipp [ 07/May/14 ]
  • pls add the unit-tests that's only succeeding after applying the change
  • line 202 (//isModerator(hm,forum)): we shouldn't comment it out but drop the line
Comment by Christoph Meier [ 07/May/14 ]

Added test; removed commented line.
https://git.magnolia-cms.com/gitweb/?p=modules/forum.git;a=commit;h=6794fabdb24678e302a43bfe32a175d66e8b7a0e

Generated at Mon Feb 12 02:02:12 CET 2024 using Jira 9.4.2#940002-sha1:46d1a51de284217efdcb32434eab47a99af2938b.