diff --git a/core/modules/comment/comment.admin.inc b/core/modules/comment/comment.admin.inc index 0418b1d..488c2f9 100644 --- a/core/modules/comment/comment.admin.inc +++ b/core/modules/comment/comment.admin.inc @@ -262,17 +262,14 @@ function comment_multiple_delete_confirm_submit($form, &$form_state) { /** * Page callback: Shows a confirmation page for comment deletions. * - * @param $cid - * The ID of the comment that is about to be deleted. + * @param \Drupal\comment\Plugin\Core\Entity\Comment $comment + * The comment entity that is about to be deleted. * * @see comment_menu() * @see comment_confirm_delete() */ -function comment_confirm_delete_page($cid) { - if ($comment = comment_load($cid)) { - return drupal_get_form('comment_confirm_delete', $comment); - } - throw new NotFoundHttpException(); +function comment_confirm_delete_page(Comment $comment) { + return drupal_get_form('comment_confirm_delete', $comment); } /** diff --git a/core/modules/comment/comment.module b/core/modules/comment/comment.module index 6f2795a..852666a 100644 --- a/core/modules/comment/comment.module +++ b/core/modules/comment/comment.module @@ -242,13 +242,14 @@ function comment_menu() { 'access arguments' => array('administer comments'), 'type' => MENU_LOCAL_TASK, ); - $items['comment/%'] = array( + $items['comment/%comment'] = array( 'title' => 'Comment permalink', 'page callback' => 'comment_permalink', 'page arguments' => array(1), - 'access arguments' => array('access comments'), + 'access callback' => 'entity_page_access', + 'access arguments' => array(1, 'view'), ); - $items['comment/%/view'] = array( + $items['comment/%comment/view'] = array( 'title' => 'View comment', 'type' => MENU_DEFAULT_LOCAL_TASK, 'weight' => -10, @@ -259,24 +260,26 @@ function comment_menu() { 'title' => 'Edit', 'page callback' => 'comment_edit_page', 'page arguments' => array(1), - 'access callback' => 'comment_access', - 'access arguments' => array('edit', 1), + 'access callback' => 'entity_page_access', + 'access arguments' => array(1, 'update'), 'type' => MENU_LOCAL_TASK, 'weight' => 0, ); - $items['comment/%/approve'] = array( + $items['comment/%comment/approve'] = array( 'title' => 'Approve', 'page callback' => 'comment_approve', 'page arguments' => array(1), - 'access arguments' => array('administer comments'), + 'access callback' => 'entity_page_access', + 'access arguments' => array(1, 'approve'), 'file' => 'comment.pages.inc', 'weight' => 1, ); - $items['comment/%/delete'] = array( + $items['comment/%comment/delete'] = array( 'title' => 'Delete', 'page callback' => 'comment_confirm_delete_page', 'page arguments' => array(1), - 'access arguments' => array('administer comments'), + 'access callback' => 'entity_page_access', + 'access arguments' => array(1, 'delete'), 'type' => MENU_LOCAL_TASK, 'file' => 'comment.admin.inc', 'weight' => 2, @@ -434,15 +437,14 @@ function comment_permission() { * calculates the page number based on current comment settings and returns * the full comment view with the pager set dynamically. * - * @param $cid - * A comment identifier. + * @param \Drupal\comment\Plugin\Core\Entity\Comment $comment + * A comment entity. * * @return * The comment listing set to the page on which the comment appears. */ -function comment_permalink($cid) { - if (($comment = comment_load($cid)) && ($node = $comment->nid->entity)) { - +function comment_permalink(Comment $comment) { + if ($node = $comment->nid->entity) { // Find the current display page for this comment. $page = comment_get_display_page($comment->id(), $node->type); @@ -958,7 +960,7 @@ function comment_links(Comment $comment, Node $node) { } } elseif (user_access('post comments')) { - if (comment_access('edit', $comment)) { + if ($comment->access('update')) { $links['comment-edit'] = array( 'title' => t('edit'), 'href' => "comment/{$comment->id()}/edit", @@ -1336,30 +1338,6 @@ function comment_user_predelete($account) { } /** - * Determines whether the current user has access to a particular comment. - * - * Authenticated users can edit their comments as long they have not been - * replied to. This prevents people from changing or revising their statements - * based on the replies to their posts. - * - * @param $op - * The operation that is to be performed on the comment. Only 'edit' is - * recognized now. - * @param Drupal\comment\Comment $comment - * The comment object. - * - * @return - * TRUE if the current user has acces to the comment, FALSE otherwise. - */ -function comment_access($op, Comment $comment) { - global $user; - - if ($op == 'edit') { - return ($user->uid && $user->uid == $comment->uid->target_id && $comment->status->value == COMMENT_PUBLISHED && user_access('edit own comments')) || user_access('administer comments'); - } -} - -/** * Accepts a submission of new or changed comment content. * * @param Drupal\comment\Comment $comment diff --git a/core/modules/comment/comment.pages.inc b/core/modules/comment/comment.pages.inc index da359a4..ddae32e 100644 --- a/core/modules/comment/comment.pages.inc +++ b/core/modules/comment/comment.pages.inc @@ -5,9 +5,9 @@ * User page callbacks for the Comment module. */ +use Drupal\comment\Plugin\Core\Entity\Comment; use Drupal\node\Plugin\Core\Entity\Node; use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException; -use Symfony\Component\HttpKernel\Exception\NotFoundHttpException; /** * Form constructor for the comment reply form. @@ -102,26 +102,23 @@ function comment_reply(Node $node, $pid = NULL) { /** * Page callback: Publishes the specified comment. * - * @param $cid - * A comment identifier. + * @param \Drupal\comment\Plugin\Core\Entity\Comment $comment + * A comment entity. * * @see comment_menu() */ -function comment_approve($cid) { +function comment_approve(Comment $comment) { // @todo CSRF tokens are validated in page callbacks rather than access // callbacks, because access callbacks are also invoked during menu link // generation. Add token support to routing: http://drupal.org/node/755584. $token = drupal_container()->get('request')->query->get('token'); - if (!isset($token) || !drupal_valid_token($token, "comment/$cid/approve")) { + if (!isset($token) || !drupal_valid_token($token, 'comment/' . $comment->id() . '/approve')) { throw new AccessDeniedHttpException(); } - if ($comment = comment_load($cid)) { - $comment->status->value = COMMENT_PUBLISHED; - comment_save($comment); + $comment->status->value = COMMENT_PUBLISHED; + $comment->save(); - drupal_set_message(t('Comment approved.')); - drupal_goto('node/' . $comment->nid->target_id); - } - throw new NotFoundHttpException(); + drupal_set_message(t('Comment approved.')); + drupal_goto('node/' . $comment->nid->target_id); } diff --git a/core/modules/comment/lib/Drupal/comment/CommentAccessController.php b/core/modules/comment/lib/Drupal/comment/CommentAccessController.php new file mode 100644 index 0000000..791dc4d --- /dev/null +++ b/core/modules/comment/lib/Drupal/comment/CommentAccessController.php @@ -0,0 +1,60 @@ +uid && $account->uid == $entity->uid->value && $entity->status->value == COMMENT_PUBLISHED && user_access('edit own comments', $account)) || user_access('administer comments', $account); + } + + /** + * Overrides \Drupal\Core\Entity\EntityAccessController::deleteAccess(). + */ + public function deleteAccess(EntityInterface $entity, $langcode = LANGUAGE_DEFAULT, User $account = NULL) { + return user_access('administer comments', $account); + } + + /** + * Implements \Drupal\comment\CommentAccessControllerInterface::approveAccess(). + */ + public function approveAccess(EntityInterface $entity, $langcode = LANGUAGE_DEFAULT, User $account = NULL) { + return user_access('administer comments', $account); + } + +} diff --git a/core/modules/comment/lib/Drupal/comment/CommentAccessControllerInterface.php b/core/modules/comment/lib/Drupal/comment/CommentAccessControllerInterface.php new file mode 100644 index 0000000..f611471 --- /dev/null +++ b/core/modules/comment/lib/Drupal/comment/CommentAccessControllerInterface.php @@ -0,0 +1,39 @@ +get_value($values); - if (!comment_access('edit', $comment)) { + if (!$comment->access('update')) { return; }