QUESTION/BUG: Edit comment/reply - no authorization, anyone can edit anyones content

[tiblu]

Question

Do I understand correctly that there is no authorization for editing comment/reply? That is, anyone can edit anyones comment/reply?
https://github.com/ether/ep_comments/blob/master/commentManager.js#L272

IF that is true, any suggestions how to approach this, we'd be interested in only original author being able to edit comment/reply.

We MAY PR this.

Related to:

• Topic share link not working citizenos/citizenos-fe#467

[JohnMcLear]

If it's a socket msg the Auth will be same as the Auth on pad socket MSG's. In theory....

[tiblu]

@JohnMcLear IF that is the only layer, then this authorization says "you can edit this pad". that also means you can edit anyones comment/reply, it does not verify the comment/reply you are editing is created by you, thus are authorized to edit.
It is fair from a user to expect that only author of the comment/reply can edit it, specially when the original authors name is persisted when the contents is edited by someone else.

[JohnMcLear]

Yeah I'd guess that's the case then. Welcome to see this change with tests!

[tiblu]

Thanks for the info. Any quick ideas how you would approach?
IF not, we'll probably dig in at some point and hope it suits.

[JohnMcLear]

Check comment.authorID matches authorID of the socket trying to make the change. Shouldn't be too hard to accomplish.

I'm sure there will be gotchas tho ;)

[JohnMcLear]

@tiblu what's your status? 🥇

[tiblu]

@tiblu what's your status? 🥇

Unfortunately no change and no ETA. I haven't done any software development for a while and not sure when I'm back at it. Sorry, thats the way it is.

[JohnMcLear]

@tiblu no problem man, I totally know how that goes 👍

[JohnMcLear]

FWIW @rhansen has fixed this now afaik, or at least some progress has been made, I will let him update :)