Problem/Motivation
Unpublished comments have a 'Reply' link but clicking it results in a 403/Access Denied page.
Steps to reproduce
- Install Drupal
- Publish an article
- Post a comment on an article and unpublish it (or, post a comment as a user without permission to skip approval)
- View the unpublished comment as admin, see there is a Reply link
- Click the Reply link and see 'Access denied'
Proposed resolution
Don't show the reply link on unpublished comments.
Remaining tasks
- Agree on approach
- Write a patch with tests
- Review
User interface changes
Before:

After:

API changes
N/A
Data model changes
N/A
Release notes snippet
N/A
| Comment | File | Size | Author |
|---|---|---|---|
| #91 | Screenshot 2024-09-10 at 9.59.14 pm.png | 19.18 KB | pameeela |
| #91 | Screenshot 2024-09-10 at 9.59.24 pm.png | 18.97 KB | pameeela |
| #76 | Reply to comment.gif | 3 MB | pameeela |
| #76 | Access denied.gif | 502.93 KB | pameeela |
Issue fork drupal-221761
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #2
ged3000 commentedIt strikes me that from this view, it just takes one click to approve a comment, therefore, the first solution makes most sense to me.
Although this runs into the issue raised at fix comment_form_submit redirect across multiple pages, I think it is less confusing to separate the approve/reply functions. To go with the second suggestion, I think you risk either people replying to comments and approving them without realising that they are doing so, or allowing them to go to a lot of effort to write a reply before realising that replying would approve the comment, that they do not want to happen.
I propose this patch, which simply hides the reply link on unapproved comments, as it is a simple, easy to understand fix, and resolves the problem. As this issue hasn't seen much attention in 12+ months, I wonder whether a a quick, simple fix, followed by a feature request for a more complex solution, similar to the second option suggested above, would be most appropriate?
One variation on my patch could be to alter the 'Approve' link to read 'Approve this comment to reply' or something like that.
Comment #3
dawehnerthere is some codestyle problems here is the the patch which solves this.
One short question: why do you use style font-weight:bold ?
Comment #4
ged3000 commentedThanks very much dereine.
You know, I have no idea why I used font-weight:bold - I think I might have been pondering the idea of using the text 'approve to reply' in a different font or something like that, but then realised that just hiding the reply link probably made just as much sense.
This path has that line removed.
Comment #5
jredding commentedAttaching a new patch updated for HEAD. The last patch does the reported job of removing the reply link on comments that are not published.
Comment #6
jredding commentedAlthough I did just upload the last patch it was nothing more than updating the patch for head, setting this to reviewed & tested.
Comment #7
sun.
Comment #8
dries commentedNot sure -- why should it be impossible to reply to an unpublished comment? That sounds like it could be a valid use case.
I'd say that the "The comment you are replying to does not exist"-message is invalid.
Comment #9
sunGood catch.
Comment #11
stinky commentedIs there a status on this? I'm using drupal 6.15 and would like users to be able to comment on unpublished content.
Comment #14
Tor Arne Thune commentedStill a valid issue in Drupal 7.2.
Comment #15
droplet commented#9: drupal.comment-unpublished.patch queued for re-testing.
Comment #17
dixon_This is a tricky one. By allowing one to reply on unpublished comments, the display of that reply will be a bit off for people that can't see unpublished comments. It will look like the reply was a reply on another node above (see screenshots). I don't know, Dries says in #8 that it could be a valid use, so maybe it is? :)
Anyway, here is a re-roll of sun's patch from #9 that should apply with Git (the last one was from CVS). I also improved the code comment a tiny bit.
Comment #18
dixon_Comment #19
sunI don't think you intended to remove u.signature_format
26 days to next Drupal core point release.
Comment #20
dixon_Thank you! I have no idea how that happened...
Comment #21
sunComment #22
dixon_If we need tests here, more work is also needed. I'll probably take a look at this in the near future.
Comment #23
jibrancomment_replyis gone now.Comment #24
alansaviolobo commented20: 221761-reply-unpublished-comment-20.patch queued for re-testing.
Comment #26
stefank commentedHi,
Here is a re-roll of the patch for D8.
I have not removed the Needs tests tag, as Im not sure if that is covered or not. Seems to be that there is an existing test, which Attempt to reply to an unpublished comment (CommentInterfaceTest.php).
Thanks
Comment #27
stefank commentedComment #28
jhedstromPatch still applies. I think a quick assertion or two could be added to
CommentInterfaceTestto confirm this fix.Comment #29
Anonymous (not verified) commentedAdded test coverage for this use case.
Comment #31
jhedstromThese calls shouldn't be needed since
drupalLogin()will log out the current user.Comment #32
Anonymous (not verified) commentedAh yes. Fixed #31.
Comment #34
jhedstromI'm not sure if the current patch addresses this issue or not. If an administrator replies to a non-published comment, is that reply also unpublished by default, or will it appear published? Not sure if this needs addressing or not, but it does seem confusing.
Comment #35
Anonymous (not verified) commentedYou are right. As we have it now, this fix is not complete yet.
A reply to an unpublished comment is published and shown to the user that has no rights on the first comment. It's confusing, and as I see it, wrong.
With the right permissions:

Withoutout the permissions:

Unpublishing the new comment as you propose, will fix this. We'll also need additional coverage.
Comment #36
Anonymous (not verified) commentedThis patch explicitly sets a reply to an unpublished comment to the unpublished status. It resolves the issue as mentioned in #34 as expected.
Testing that something is not there, is quite hard. I'm not to sure if what I did there is correct.
I also noticed a copy-paste error in the CommentController::getReplyForm() docblock, so I removed that while I was at it.
Comment #37
Anonymous (not verified) commentedActually, the comment change is out of scope here. I made a follow-up issue for that #2460479: CommentController::getReplyForm() docblock has a copy paste error.
I'll make new patches for this issue.
Comment #38
Anonymous (not verified) commentedHere goes.
Comment #39
Anonymous (not verified) commentedAdded a beta eval to the summary.
Comment #42
mscharley commentedLooks fine to me.
Comment #43
Anonymous (not verified) commentedI found an error in the inline comment, so I fixed that.
Comment #45
geertvd commentedThis looks fine for me.
Small nitpick. RTBC after that is fixed.
We need an extra space in this if statement.
Comment #46
deepakaryan1988Hi @geertvd,
I am re-rolling patch#43 with the modification you mentioned.
Comment #47
geertvd commentedDon't forget to set the status to "Needs review" or the testbot won't pick this up.
Change looks good but please consider adding an interdiff in the future.
Will RTBC this when all tests pass.
Comment #48
deepakaryan1988Ok @geertvd !
Thanks for the advice. I will attach interdiff in the future!
Comment #49
geertvd commentedComment #50
alexpottThe code and test looks fine to me.
Assigning to @webchick as product manager to confirm that this is the way things should work. I think the chosen behaviour does make sense but I ponder if it is slightly different to the behaviour when unpublishing a parent comment - do it's children stay published? Looking at the UnpublishComment action it looks like this is the case. Of course if the admin wants their comment to be published then they can just publish their comment. But what's weird is that when the parent comment is published it's children added by the admin will not be.
Comment #51
alexpottIn fact thinking about
I'm not sure that we should allow admins to post replies to unpublished comments.
In #8 @Dries says this is a valid use case - but if the unpublished comment is never seen and not auto published if the parent comment is - what's the point?
Comment #53
deepakaryan1988Removing sprint weekend tag!!
As suggested by @YesCT
Comment #54
mgiffordUnassigning stale issue. Hopefully someone else will pursue this.
Comment #63
pameeela commentedUpdated IS with steps to test and removed outdated code to avoid confusion. This issue still occurs in 9.3.x. Bumping to minor because this does not inhibit functionality.
Comment #67
mohit_aghera commented- Re-roll the patch for the latest 9.3.x
- Ensure that comment reply remains unpublished when commenting on the unpublished comment
- Added test case.
Comment #71
needs-review-queue-bot commentedThe Needs Review Queue Bot tested this issue. It either no longer applies to Drupal core, or fails the Drupal core commit checks. Therefore, this issue status is now "Needs work".
Apart from a re-roll or rebase, this issue may need more work to address feedback in the issue or MR comments. To progress an issue, incorporate this feedback as part of the process of updating the issue. This helps other contributors to know what is outstanding.
Consult the Drupal Contributor Guide to find step-by-step guides for working with issues.
Comment #72
mohit_aghera commentedPicking up again.
- Update the PR destination and base to 10.1.x
- Add additional test case from past patches. Both looks same to me.
Happy to weigh in other opinions and refactor those.
- All the test cases are passing on local now.
Comment #73
mohit_aghera commentedHiding other patches as the one in #43 seems valid.
PR contains all the changes done in #43
Comment #74
smustgrave commentedThis issue is being reviewed by the kind folks in Slack, #needs-review-queue-initiative. We are working to keep the size of Needs Review queue [2700+ issues] to around 400 (1 month or less), following Review a patch or merge request as a guide.
So following the steps in the issue summary with the changes from MR 879 I'm still seeing reply button for unpublished comment.
This is a question so is this the approach that was taken?
Since this is changing the UI before/after screenshots in the issue summary will be needed
Thanks.
Comment #76
pameeela commentedTested manually and this does solve the problem, admins can reply to unpublished comments with the patch.
Before:

After:

Comment #77
smustgrave commentedComment #78
smustgrave commentedTook the gifs from #76 and added to the issue summary user interface section
Ran the test-only feature too
Coverage is definitely there
MR does appear to address the problem described in the summary.
Believe this is good.
Comment #79
xjmComment #80
xjmThanks for your work on this issue! Thanks especially @pameeela for the very clear manual testing. I've updated the issue summary with those images.
There are a few coding standards and best practices issues with the current MR (see my comments therein). I do understand that in some cases these are being copied from existing tests and/or surrounding code, but we should not do the wrong thing for the sake of consistency. (If desired, a followup can be filed to improve the best practices in the rest of these tests.)
I think this is pretty close.
Comment #81
xjmSaving issue credits.
Comment #82
xjmI also just noticed no one actually ever answered @alexpott's question in #50 and #51. NW for that also.
FWIW, I think there is a usecase here, but we should articulate specifically why this is the right approach (vs. removing the link in this case).
If we need to escalate it for further feedback once that reply is given, I think it should go to the usability team and/or comment subsystem maintainers; this is not really a product-level decision. Thanks!
Comment #83
pameeela commentedI was a bit unsure about the solution myself, in testing it seemed a bit odd to reply to an unpublished comment. I am not super clear on the use case for replying before approving.
If an admin replies to an unpublished comment, the reply is unpublished as well and it has to be approved separately (even if they have permission to comment without approval). This makes sense, but you can then approve it meaning you could have a published reply to an unpublished comment. And if the original comment is deleted rather than approved, the reply is also deleted. (Why would you reply to a comment you were going to delete ? Well, exactly. But also why wouldn't you just approve the comment before replying?)
Having said all that, the stakes here seem extremely low. But it makes more sense to me to hide the reply link until the comment is approved.
Comment #84
pameeela commentedComment #85
pameeela commentedComment #86
pameeela commentedUpdated based on the latest suggested approach.
Comment #87
catchAgreed with the new proposed solution, hiding the link seems right.
Comment #89
catchPut up an MR with test coverage.
Comment #91
pameeela commentedWoohoo! Manual test passed, added updated screenshots to the IS.
Comment #92
lendudeSolution and test code look good, could maybe check for the reply link to exist and not just the text to be a little more specific but this works.
Comment #93
alexpottCommitted and pushed 6067ed426c to 11.x and 3b1e465274 to 11.0.x and f096a302e8 to 10.4.x and 71ac91d7ce to 10.3.x. Thanks!