Repository navigation
Reject reply_to pointing to a comment on another object (main) - #573
Open
PetrDlouhy wants to merge 1 commit into
Open
PetrDlouhy wants to merge 1 commit into
PetrDlouhy wants to merge 1 commit into
Conversation
XtdCommentForm accepted any reply_to, and the REST API only checked that the parent comment exists. A reply takes its parent's thread and level, so a comment posted to object A with reply_to pointing at a comment on object B is stored on A but joins B's CommentThread: - B's ancestors get their nested_count bumped for a reply that never shows under B. - Withholding or publishing B's comment (publish_or_withhold_nested_comments) hides or publishes the reply on A. - When A's model allows no threads (max_thread_level 0) but B's does, the API passes validation (it checks B's limit) and save() raises MaxThreadLevelExceededException: a 500. Both the form (HTML endpoint) and WriteCommentSerializer.validate() (API endpoint) now require the parent to be one of XtdComment.objects.for_model(target), and answer 400 otherwise. The serializer needs its own check because it only acts on the form's security errors and would otherwise fail in save() with a ValueError. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PetrDlouhy
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Same fix as #572, for
main: a reply whosereply_topoints to a comment on another object no longer joins that object's thread.The form rejects it, and
WriteCommentSerializer.validate()repeats the check, because onmainthe serializer acts only on the form's security errors (without it the API would still answer 500).Tests added, CHANGELOG updated.
🤖 Generated with Claude Code