I noticed that the "create comment content" user access control settings for the regular node module can override the settings for the nodecomment module. So essentially, there are two places where access is granted to create comments. The site administrator could easily forget or overlook this when setting a site's commenting permissions.
Since it would be difficult to disable the "create comment content" functionality in the core node module, I believe something should be done to remove this duplication of access control in nodecomment. If this is undesirable, then there should at least be some kind of warning to the administrator.

Comments

robertdouglass’s picture

Status: Active » Postponed

I agree and am going to start a separate issue for a general access audit of this module.

crea’s picture

Status: Postponed » Closed (fixed)

D5 branch is not supported anymore. Closing.
Please reopen if the issue is relevant with Nodecomment 6.x-2 branch.