[$30] Normal users can edit/delete the comments added by others

[sdgun]

Steps
Log in to forums as a normal user (sdguntcqa)
Go to any available challenge forum discussion added by another user (https://vanilla.topcoder-dev.com/discussion/1751/baze-my-discussion#latest)
Click on ellipsis of a comment from another user

This user can perform edit/delete on it

[jmgasper]

@sdgun - I can't reproduce this. Can you try again please?

[sdgun]

@jmgasper This can be reproduced, checked by adding a comment from TCConnCopilot in https://vanilla.topcoder-dev.com/discussion/1777/3rd and then log in as user sdguntcqa(pw-T0pc0der@123)

Delete comments issue.zip

[jmgasper]

Contest https://www.topcoder.com/challenges/30154852 has been created for this ticket.

This is an automated message for ghostar via Topcoder X

[jmgasper]

@atelomycterus - I checked this in the permissions. sdguntcqa has roles Vanilla Member and Topcoder User, but neither seem to have rights to edit comments / discussions - only add / view.

[jmgasper]

Contest https://www.topcoder.com/challenges/30154852 has been updated - it has been assigned to obog.

This is an automated message for ghostar via Topcoder X

[atelomycterus]

@jmgasper yes, you are right. User doesn't have permisisons. I've checked what permisisons loaded:

I've found a bug in Vanilla CommentModel canEdit().

[atelomycterus]

@jmgasper Fixed. please apply PRs:
#249
topcoder-platform/forums-plugins#51
topcoder-platform/forums-groups-plugin#35
Thanks!

Testing

Don't use TonyJ account for testing because this account has several admin roles with Comments.Edit/Comments.Delete permissions. Please test with group members (copilot, member and so on)

Vanilla user/Topcoder User:

How Vanilla works by default

The Edit option is displayed if

• User has 'Vanilla.Comments.Edit' permission
• Discussion is closed, but Moderators (role type= moderator) can edit comments
• User(Non-Moderator/Non-Admin) can edit if User is the author.
  

The Delete option is displayed if

• User has 'Vanilla.Comments.Delete' permission
• User (Non-Moderator/Non-Admin) is the Author + Vanilla.Comments.AllowSelfDelete=true
  'Vanilla.Comments.AllowSelfDelete' is false by default. So 'Delete' shouldn't be displayed for Vanilla User/Topcoder User.

[jmgasper]

Payment task has been updated: https://software.topcoder.com/review/actions/ViewProjectDetails?pid=30154852

This is an automated message for ghostar via Topcoder X

[sdgun]

Verified from normal user, copilot, con admin and manager.
normal user(sdguntcqa)/manager(TCConManager) - can reply anyone's comments and edit his comments
copilot(TCConnCopilot) - can reply/delete anyone's comments and edit/reply/delete his comments
con admin(TCConAdmin) - can edit/reply/delete anyone's comments and his comments