Index: modules/comment/comment.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/comment/comment.module,v
retrieving revision 1.867
diff -u -p -r1.867 comment.module
--- modules/comment/comment.module	16 Apr 2010 13:56:45 -0000	1.867
+++ modules/comment/comment.module	21 Apr 2010 04:10:29 -0000
@@ -1274,14 +1274,38 @@ function comment_node_delete($node) {
  * Implements hook_node_update_index().
  */
 function comment_node_update_index($node) {
-  $mode = variable_get('comment_default_mode_' . $node->type, COMMENT_MODE_THREADED);
-  $comments_per_page = variable_get('comment_default_per_page_' . $node->type, 50);
-  if ($node->comment && $cids = comment_get_thread($node, $mode, $comments_per_page)) {
-    $comments = comment_load_multiple($cids);
-    comment_prepare_thread($comments);
-    $build = comment_view_multiple($comments, $node);
+  $index_comments = &drupal_static(__FUNCTION__, NULL);
+
+  if ($index_comments === null) {
+    // Find and save roles that can 'access comments' or 'search content'.
+    $perms = array('access comments' => array(), 'search content' => array());
+    $result = db_query("SELECT rid, permission FROM {role_permission} WHERE permission IN ('access comments', 'search content')");
+    foreach ($result as $record) {
+      $perms[$record->permission][$record->rid] = $record->rid;
+    }
+
+    // Prevent indexing of comments if there are any roles that can search but
+    // not view comments.
+    $index_comments = TRUE;
+    foreach ($perms['search content'] as $rid) {
+      if (!isset($perms['access comments'][$rid])) {
+        $index_comments = FALSE;
+        break;
+      }
+    }
   }
-  return drupal_render($build);
+
+  if ($index_comments) {
+    $mode = variable_get('comment_default_mode_' . $node->type, COMMENT_MODE_THREADED);
+    $comments_per_page = variable_get('comment_default_per_page_' . $node->type, 50);
+    if ($node->comment && $cids = comment_get_thread($node, $mode, $comments_per_page)) {
+      $comments = comment_load_multiple($cids);
+      comment_prepare_thread($comments);
+      $build = comment_view_multiple($comments, $node);
+      return drupal_render($build);
+    }
+  }
+  return '';
 }
 
 /**
@@ -1296,7 +1320,7 @@ function comment_update_index() {
  * Implements hook_node_search_result().
  */
 function comment_node_search_result($node) {
-  if ($node->comment != COMMENT_NODE_HIDDEN) {
+  if (user_access('access comments') && $node->comment != COMMENT_NODE_HIDDEN) {
     $comments = db_query('SELECT comment_count FROM {node_comment_statistics} WHERE nid = :nid', array('nid' => $node->nid))->fetchField();
     return format_plural($comments, '1 comment', '@count comments');
   }
Index: modules/search/search.test
===================================================================
RCS file: /cvs/drupal/drupal/modules/search/search.test,v
retrieving revision 1.59
diff -u -p -r1.59 search.test
--- modules/search/search.test	16 Apr 2010 13:53:43 -0000	1.59
+++ modules/search/search.test	21 Apr 2010 04:10:29 -0000
@@ -538,6 +538,7 @@ class SearchCommentTestCase extends Drup
       'administer permissions',
       'create page content',
       'post comments without approval',
+      'access comments',
     ));
     $this->drupalLogin($this->admin_user);
   }
@@ -558,12 +559,7 @@ class SearchCommentTestCase extends Drup
     // Allow anonymous users to search content.
     $edit = array(
       DRUPAL_ANONYMOUS_RID . '[search content]' => 1,
-      // @todo Comments are added to search index without checking first whether
-      //   anonymous users are allowed to access comments.
       DRUPAL_ANONYMOUS_RID . '[access comments]' => 1,
-      // @todo Without this permission, "Login or register to post comments" is
-      //   added to the search index.  Comment.module is not guilty; that text
-      //   seems to be added via node links.
       DRUPAL_ANONYMOUS_RID . '[post comments]' => 1,
     );
     $this->drupalPost('admin/people/permissions', $edit, t('Save permissions'));
@@ -615,6 +611,96 @@ class SearchCommentTestCase extends Drup
     $this->drupalPost('', $edit, t('Search'));
     $this->assertNoText($comment_body, t('Comment body text not found in search results.'));
   }
+
+
+  /**
+   * Anon user has search permission but no access comments permission,
+   * comments should not be indexed.
+   */
+  function testSearchResultsCommentAnonNoAccess() {
+    $this->setPermissions(TRUE, FALSE, TRUE, TRUE);
+    $this->checkAccess();
+  }
+
+  /**
+   * Anon user has search permission and access comments permission, comments
+   * should be indexed.
+   */
+  function testSearchResultsCommentAnonAccess() {
+    $this->setPermissions(TRUE, TRUE, TRUE, TRUE);
+    $this->checkAccess(TRUE, TRUE);
+  }
+
+  /**
+   * Authenticated user has search permission but no access comments
+   * permission, comments should not be indexed.
+   */
+  function testSearchResultsCommentAuthNoAccess() {
+    $this->setPermissions(FALSE, FALSE, TRUE, FALSE);
+    $this->checkAccess(FALSE, FALSE);
+  }
+
+  /**
+   * Authenticated user has search permission and access comments permission,
+   * comments should be indexed.
+   */
+  function testSearchResultsCommentAuthAccess() {
+    $this->setPermissions(FALSE, FALSE, TRUE, TRUE);
+    $this->checkAccess(FALSE, TRUE);
+  }
+
+  /**
+   * Set permissions
+   */
+  function setPermissions($anon_search, $anon_comments, $auth_search, $auth_comments) {
+    $edit = array();
+    if ($anon_search) {
+      $edit[DRUPAL_ANONYMOUS_RID . '[search content]'] = TRUE;
+    }
+    if ($anon_comments) {
+      $edit[DRUPAL_ANONYMOUS_RID . '[access comments]'] = TRUE;
+    }
+    if ($auth_search) {
+      $edit[DRUPAL_AUTHENTICATED_RID . '[search content]'] = TRUE;
+    }
+    //if ($auth_comments) {
+      $edit[DRUPAL_AUTHENTICATED_RID . '[access comments]'] = $auth_comments;
+    //}
+    $this->drupalPost('admin/people/permissions', $edit, t('Save permissions'));
+  }
+
+  function checkAccess($logout = TRUE, $assume_access = FALSE) {
+    $comment_body = 'Test comment body';
+    variable_set('comment_preview_article', DRUPAL_OPTIONAL);
+
+    // Create a node.
+    $node = $this->drupalCreateNode(array('type' => 'article'));
+    // Post a comment using 'Full HTML' text format.
+    $edit_comment = array();
+    $edit_comment['subject'] = 'Test comment subject';
+    $edit_comment['comment_body[' . LANGUAGE_NONE . '][0][value]'] = '<h1>' . $comment_body . '</h1>';
+    $this->drupalPost('comment/reply/' . $node->nid, $edit_comment, t('Save'));
+
+    // Invoke search index update.
+    if ($logout) {
+      $this->drupalLogout();
+    }
+    $this->cronRun();
+
+    // Search for the comment subject.
+    $edit = array(
+      'search_block_form' => "'" . $edit_comment['subject'] . "'",
+    );
+    $this->drupalPost('', $edit, t('Search'));
+    if ($assume_access) {
+      $this->assertText($node->title, t('Node found in search results.'));
+      $this->assertText($edit_comment['subject'], t('Comment subject found in search results.'));
+    } else {
+      $this->assertNoText($node->title, t('Node not found in search results.'));
+      $this->assertNoText($edit_comment['subject'], t('Comment subject not found in search results.'));
+    }
+  }
+
 }
 
 /**