Repository navigation
Reject reply_to pointing to a comment on another object - #572
Open
PetrDlouhy wants to merge 1 commit into
Open
PetrDlouhy wants to merge 1 commit into
PetrDlouhy wants to merge 1 commit into
Conversation
XtdCommentForm accepted any reply_to, and the REST API only checked that the parent comment exists. A reply takes its parent's thread_id and level, so a comment posted to object A with reply_to pointing at a comment on object B is stored on A but threaded into B's thread: - B's ancestors get their nested_count bumped for a reply that never shows under B. - A's comment tree (get_xtdcomment_tree / render_xtdcomment_tree) breaks: the misplaced level-1 comment sorts by B's thread_id, and tree_from_queryset drops every comment of A it cannot attach to it. One such reply can hide all of A's comments. - Moderating B's comment (publish_or_unpublish_nested_comments) publishes or hides the reply on A. - When A's model allows no threads (max_thread_level 0) but B's does, the API passes validation (it checks B's limit) and save() raises MaxThreadLevelExceededException: a 500. The form now requires the parent to be a comment on the target object. The API serializer validates through the same form, so both the HTML and the API endpoints answer 400 instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PetrDlouhy
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A comment posted to object A can set
reply_toto a comment on object B. It is saved on A but placed in B's thread. This breaks A's comment tree (A's own comments can vanish from the rendered tree), inflates B'snested_count, and raises a 500 when A doesn't allow threads.XtdCommentForm.clean_reply_to()now requires the parent comment to belong to the same object. The API uses the form, so both endpoints are covered.Tests added for the form and the API. Same fix for
main: #573.🤖 Generated with Claude Code