I allowed anonymous to post comments, but he can't edit/delete or reply.
In that case \Drupal\comment\CommentLazyBuilders::buildLinks adds a forbidden message for anonymous users without checking post comment permission.

CommentFileSizeAuthor
#2 drupal_comment-check_post_access_anonymous-3251544-2.patch800 byteskiseleva.t

Comments

kiseleva.t created an issue. See original summary.

kiseleva.t’s picture

kiseleva.t commented
Status: Needs work » Needs review
StatusFileSize
new drupal_comment-check_post_access_anonymous-3251544-2.patch800 bytes
larowlan’s picture

larowlan
Location 🇦🇺🏝.au GMT+10
commented
Status: Needs review » Postponed (maintainer needs more info)
Issue tags: -permissions +Bug Smash Initiative

Can you please provide steps to reproduce, starting from 'install druoal'. Thanks

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.1.10 (June 4, 2021) and Drupal 9.2.10 (November 24, 2021) were the last bugfix releases of those minor version series. Drupal 9 bug reports should be targeted for the 9.3.x-dev branch from now on, and new development or disruptive changes should be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.15 was released on June 1st, 2022 and is the final full bugfix release for the Drupal 9.3.x series. Drupal 9.3.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.4.x-dev branch from now on, and new development or disruptive changes should be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

tobiasb’s picture

tobiasb
Primary language German
Location Berlin
commented

$entity->access('create') can be used.

quietone’s picture

quietone commented
Status: Postponed (maintainer needs more info) » Closed (works as designed)

It has been almost a year and steps to reproduce have not been supplied. I tried to reproduce the problem with Drupal 10.0, standard install.
I gave permission to anonymous to add comments. I then added comments as anon when approval was needed and when approval was not. In both cases the results were the same. Anonymous can 'reply' but not edit comments.

I brought this up in #bugsmash. tobiasb considered this an edge case bug. However, larowlan pointed out that anon can't edit comments because the 'own comment' means any comment with the same uid. And since anon is always uid 0 it would mean anon can edit all anon comments, which really doesn't make sense. The conclusion was that this is working as designed.

Cheers.