souramoo / commentoplusplus

Commento with out of the box patches and updates to add useful features and fixes. Also with one-click deploy to Heroku so you can get up and running fast.
MIT License
391 stars 63 forks source link

Fix guest comments falsely approved later in logic #85

Closed sriegler closed 2 years ago

sriegler commented 2 years ago

This hotfixes a bug, where if moderation of anonymous comments is enabled, guest comments are wrongly approved later on. Because the logic on api/comment_new.go:128 overwrites the comment state and follows a default allow logic.

The bug exists because if using guest posts, there will be a name assigned and the "commenterHex" contains the new guest-name and does not contain "anonymous" anymore. The logic fails to catch this.

Actually all the states assignments beforehand (line 96, 107) are not necessary, if there is some logic block later, which redefines the states.

Could be part of some overhaul, to streamline state assignment.