fix(privacy): fix showing private comments in public threads

discuss_data/ddcomments/models.py

@@ -32,9 +32,7 @@ class Notification(MPTTModel):
 
     uuid = models.UUIDField(default=uuid.uuid4, editable=False)
     notification_type = models.CharField(
-        max_length=4,
-        choices=NOTIFICATION_TYPE_CHOICES,
-        default=PUBLIC,
+        max_length=4, choices=NOTIFICATION_TYPE_CHOICES, default=PUBLIC,
     )
     text = BleachField(max_length=12000)
     date_added = models.DateTimeField(auto_now_add=True)
@@ -98,9 +96,7 @@ class Comment(MPTTModel):
     uuid = models.UUIDField(default=uuid.uuid4, editable=False)
     doi = models.CharField(max_length=200, blank=True)
     comment_type = models.CharField(
-        max_length=4,
-        choices=COMMENT_TYPE_CHOICES,
-        default=PUBLIC,
+        max_length=4, choices=COMMENT_TYPE_CHOICES, default=PUBLIC,
     )
     text = BleachField(max_length=12000)
     date_added = models.DateTimeField(auto_now_add=True)
@@ -133,6 +129,13 @@ class Comment(MPTTModel):
             # self.date_added.strftime("%d.%m.%Y, %H:%M:%S"),
         )
 
+    def is_public(self):
+        if (
+            self.comment_type == Comment.PUBLIC
+            or self.comment_type == Comment.PERMANENT
+        ):
+            return True
+
     def class_name(self):
         return self.__class__.__name__
 

discuss_data/templates/ddcomments/_comment_card.html

 {% load static i18n activity_tags core_tags crispy_forms_tags mptt_tags humanize tz %}
 
+
     <div class="row smallskip comment-card" id="comment-{{ comment.uuid }}">
         <div class="col-md-10">
             <div class="row">
+
                 <div class="col-md-1">
                     {% include 'ddusers/_user-image.html' with user_uuid=comment.owner.uuid user_photo=comment.owner.photo %}
                     <span class="badge badge-{{ comment.get_comment_type_display }}">{{ comment.get_comment_type_display }}</span>
-
                 </div>
                 <div class="col-md-11">
-
                     <span class="comment-name"> {{ comment.owner.get_academic_name }}</span> <span class="comment-naturaltime">{{ comment.date_added | naturaltime }}</span> {% if comment.deleted %}<span class="badge badge-deleted">{% trans "Deleted" %}</span>{% endif %}
 
-                    <div class="comment-text" id="comment-text-{{ comment.uuid }}">
-                        {{ comment.text|linebreaks |urlize | safe }}
-                    </div>
+                    {% with parent=comment|get_parent_comment %}
+                        {% if comment.is_public or request.user == comment.owner or request.user == parent.owner %}
+                            <div class="comment-text" id="comment-text-{{ comment.uuid }}">
+                                {{ comment.text|linebreaks |urlize | safe }}
+                            </div>
 
-                    <span class="comment-date">
-                        {# date comparison without format filter takes even milliseconds into account, which leads to false results #}
-                        {% trans "Created at" %}: {{ comment.date_added|date:"d.m.Y, H:m:s" }}{% if comment.date_edited|date:"d M Y h i s" != comment.date_added|date:"d M Y h i s" %}<br>{% trans "Edited at" %}: {{ comment.date_edited|date:"d.m.Y, H:m:s" }}{% endif %}
-                    </span>
+                            <span class="comment-date">
+                                {# date comparison without format filter takes even milliseconds into account, which leads to false results #}
+                                {% trans "Created at" %}: {{ comment.date_added|date:"d.m.Y, H:m:s" }}{% if comment.date_edited|date:"d M Y h i s" != comment.date_added|date:"d M Y h i s" %}<br>{% trans "Edited at" %}: {{ comment.date_edited|date:"d.m.Y, H:m:s" }}{% endif %}
+                            </span>
 
-                    <div id="comment-text-{{ comment.uuid }}-reply">
-                        <div id="comment-text-{{ comment.uuid }}-buttons">
-                            {% if request.user == comment.owner %}
-                                {% if not comment.deleted %}
-                                {# edit button #}
-                                <button class="btn btn-link" ic-target="#comment-text-{{ comment.uuid }}" ic-get-from="{% url add_url ds.uuid comment.uuid %}">
-                                    {% trans "Edit" %}
-                                </button>
+                            <div id="comment-text-{{ comment.uuid }}-reply">
+                                <div id="comment-text-{{ comment.uuid }}-buttons">
+                                    {% if request.user == comment.owner %}
+                                        {% if not comment.deleted %}
+                                        {# edit button #}
+                                        <button class="btn btn-link" ic-target="#comment-text-{{ comment.uuid }}" ic-get-from="{% url add_url ds.uuid comment.uuid %}">
+                                            {% trans "Edit" %}
+                                        </button>
+
+                                        {# delete button #}
+                                        <button type="button" class="btn btn-link" data-toggle="modal" data-target="#confirmModal{{ comment.uuid }}" title="{% trans 'Delete' %}" ic-get-from="{% url 'core:polling_stop' %}" ic-target="#pollstatus">
+                                            {% trans "Delete" %}
+                                        </button>
+                                        {% endif%}
+                                    {% endif %}
+                                    {# reply button #}
+                                    {% with parent=comment|get_parent_comment %}
+                                        {% if parent %}
+                                        <button class="btn btn-link" ic-target="#comment-text-{{ comment.uuid }}-reply" ic-get-from="{% url reply_url ds.uuid parent.uuid %}">
+                                            {% if parent == comment %}{% trans "Reply to comment" %}{% else %}{% trans "Reply to thread" %}{% endif %}
+                                        </button>
+                                        {% endif %}
+                                    {% endwith %}
+                                </div>
+                            </div>
+                        {% else %}
+                            <div class="comment-text" id="comment-text-{{ comment.uuid }}">
+                                <p><i>{% trans "This comment is private." %}</i></p>
+                            </div>
+                        {% endif%}
+                    {% endwith %}
 
-                                {# delete button #}
-                                <button type="button" class="btn btn-link" data-toggle="modal" data-target="#confirmModal{{ comment.uuid }}" title="{% trans 'Delete' %}" ic-get-from="{% url 'core:polling_stop' %}" ic-target="#pollstatus">
-                                    {% trans "Delete" %}
-                                </button>
-                                {% endif%}
-                            {% endif %}
-                            {# reply button #}
-                            {% with parent=comment|get_parent_comment %}
-                                {% if parent %}
-                                <button class="btn btn-link" ic-target="#comment-text-{{ comment.uuid }}-reply" ic-get-from="{% url reply_url ds.uuid parent.uuid %}">
-                                    {% if parent == comment %}{% trans "Reply to comment" %}{% else %}{% trans "Reply to thread" %}{% endif %}
-                                </button>
-                                {% endif %}
-                            {% endwith %}
-                        </div>
-                    </div>
 
                     {% comment %}
                     {% with prepared_form=comment|prepare_comment_form:request.user %}