编辑评论
+#{{.Floor}} · 返回帖子
+ {{template "base/alert" .}} + +" + html.EscapeString(plain) + "
" + _, enteredPending, err := d.Comment.Update(ctx.UserID(), cm.ID, ctx.IsAdmin(), ctx.SkipsModeration(), safe) + if err != nil { + d.renderCommentEdit(ctx, err.Error(), postID, cm, plain) + return + } + if enteredPending { + ctx.SetFlash("评论已更新，审核通过后公开显示") + } else { + ctx.SetFlash("评论已更新") + } + ctx.Redirect(fmt.Sprintf("/post/%d#floor-%d", postID, cm.Floor)) +} + +// CommentDeletePost 软删评论 +func (d Deps) CommentDeletePost(c *gin.Context) { + ctx := d.ctx(c) + postID, err := parsePostID(c, d) + if err != nil || postID == 0 { + d.render404(ctx) + return + } + cid, err := strconv.ParseUint(c.Param("cid"), 10, 64) + if err != nil || cid == 0 { + d.render404(ctx) + return + } + if !ctx.CheckCSRF() { + ctx.SetFlash("无效请求，请重试") + ctx.Redirect(fmt.Sprintf("/post/%d#comments", postID)) + return + } + cm, err := d.Comment.GetByID(uint(cid)) + if err != nil || cm.PostID != postID { + d.render404(ctx) + return + } + if !d.Comment.CanUserDeleteComment(cm, ctx.UserID(), ctx.IsAdmin()) { + ctx.SetFlash(services.ErrPermissionDenied.Error()) + ctx.Redirect(fmt.Sprintf("/post/%d#comments", postID)) + return + } + if err := d.Comment.Delete(ctx.UserID(), cm.ID, ctx.IsAdmin()); err != nil { + ctx.SetFlash(err.Error()) + ctx.Redirect(fmt.Sprintf("/post/%d#floor-%d", postID, cm.Floor)) + return + } + ctx.SetFlash("评论已删除") + ctx.Redirect(fmt.Sprintf("/post/%d#comments", postID)) +} + +func (d Deps) loadEditableComment(ctx *webctx.Context, c *gin.Context) (postID uint, cm *models.Comment, errMsg string) { + pid, err := parsePostID(c, d) + if err != nil || pid == 0 { + return 0, nil, "帖子不存在" + } + cid, err := strconv.ParseUint(c.Param("cid"), 10, 64) + if err != nil || cid == 0 { + return pid, nil, "评论不存在" + } + cm, err = d.Comment.GetByID(uint(cid)) + if err != nil || cm.PostID != pid { + return pid, nil, "评论不存在" + } + if !d.Comment.CanUserEditComment(cm, ctx.UserID(), ctx.IsAdmin()) { + return pid, cm, "无权编辑该评论或已超过可编辑时限" + } + return pid, cm, "" +} + +func (d Deps) renderCommentEdit(ctx *webctx.Context, errMsg string, postID uint, cm *models.Comment, content string) { + chrome := d.chrome(ctx, "编辑评论 · "+d.Settings.SiteBranding().Name, "", "") + chrome.Error = errMsg + ctx.HTML(http.StatusOK, "post/comment_edit", commentEditData{ + PageChrome: chrome, + PostID: postID, + CommentID: cm.ID, + Floor: cm.Floor, + Content: content, + }) +} + +// commentHTMLToPlain 发评存的是转义后的…
，编辑时还原为纯文本 +func commentHTMLToPlain(s string) string { + s = strings.TrimSpace(s) + s = strings.TrimPrefix(s, "") + s = strings.TrimSuffix(s, "
") + return html.UnescapeString(s) +} + func parsePostID(c *gin.Context, d Deps) (uint, error) { idStr := stripIDParam(c.Param("id"), d.Settings.Permalink().Ext) id, err := strconv.ParseUint(idStr, 10, 64) diff --git a/services/comment.go b/services/comment.go index d21c987..15cd29a 100644 --- a/services/comment.go +++ b/services/comment.go @@ -369,12 +369,52 @@ func (s *CommentService) ListPending(page, size int) ([]models.Comment, int64, e } func (s *CommentService) Delete(userID, commentID uint, isAdmin bool) error { - if !isAdmin { + var comment models.Comment + if err := models.DB.First(&comment, commentID).Error; err != nil { + return ErrCommentNotFound + } + if !isAdmin && (comment.UserID == 0 || comment.UserID != userID) { return ErrPermissionDenied } return s.AdminDelete(commentID) } +// CanUserEditComment 作者在编辑时限内，或管理员 +func (s *CommentService) CanUserEditComment(comment *models.Comment, userID uint, isAdmin bool) bool { + window := 3 + if s != nil && s.settings != nil { + window = s.settings.CommentEditWindowMinutes() + } + return canEditComment(comment, userID, isAdmin, window) +} + +// CanUserDeleteComment 作者或管理员可软删 +func (s *CommentService) CanUserDeleteComment(comment *models.Comment, userID uint, isAdmin bool) bool { + if comment == nil || userID == 0 { + return false + } + if isAdmin { + return true + } + return comment.UserID > 0 && comment.UserID == userID +} + +func canEditComment(comment *models.Comment, userID uint, isAdmin bool, windowMin int) bool { + if comment == nil || userID == 0 { + return false + } + if isAdmin { + return true + } + if comment.UserID == 0 || comment.UserID != userID { + return false + } + if windowMin > 0 && time.Since(comment.CreatedAt) > time.Duration(windowMin)*time.Minute { + return false + } + return true +} + func (s *CommentService) Update(userID, commentID uint, isAdmin, skipModeration bool, content string) (string, bool, error) { var comment models.Comment if err := models.DB.First(&comment, commentID).Error; err != nil { diff --git a/services/comment_edit_test.go b/services/comment_edit_test.go new file mode 100644 index 0000000..3e0ce78 --- /dev/null +++ b/services/comment_edit_test.go @@ -0,0 +1,47 @@ +package services + +import ( + "testing" + "time" + + "git.iioio.com/freefire/jiang13-forum/models" +) + +func TestCanEditComment(t *testing.T) { + now := time.Now() + c := &models.Comment{UserID: 7, CreatedAt: now} + if !canEditComment(c, 7, false, 3) { + t.Fatal("author within window") + } + if canEditComment(c, 8, false, 3) { + t.Fatal("other user") + } + if !canEditComment(c, 1, true, 3) { + t.Fatal("admin always") + } + old := &models.Comment{UserID: 7, CreatedAt: now.Add(-10 * time.Minute)} + if canEditComment(old, 7, false, 3) { + t.Fatal("expired") + } + if !canEditComment(old, 7, true, 3) { + t.Fatal("admin ignores window") + } +} + +func TestCanUserDeleteComment(t *testing.T) { + s := &CommentService{} + c := &models.Comment{UserID: 3} + if !s.CanUserDeleteComment(c, 3, false) { + t.Fatal("author") + } + if s.CanUserDeleteComment(c, 4, false) { + t.Fatal("other") + } + if !s.CanUserDeleteComment(c, 1, true) { + t.Fatal("admin") + } + guest := &models.Comment{UserID: 0} + if s.CanUserDeleteComment(guest, 1, false) { + t.Fatal("guest author id 0") + } +} diff --git a/templates/post/body.tmpl b/templates/post/body.tmpl index acd33da..1676b02 100644 --- a/templates/post/body.tmpl +++ b/templates/post/body.tmpl @@ -116,6 +116,15 @@ {{if not $.CommentsLocked}} {{end}} + {{if .CanEdit}} + 编辑 + {{end}} + {{if .CanDelete}} + + {{end}} {{if .CanReport}}#{{.Floor}} · 返回帖子
+ {{template "base/alert" .}} + +