Skip to content

fix: filter personal comment page by target visibility before pagination - #1648

Open
ChangkeunJ wants to merge 1 commit into
apache:mainfrom
ChangkeunJ:fix/personal-comment-page-visibility
Open

ChangkeunJ wants to merge 1 commit into
apache:mainfrom
ChangkeunJ:fix/personal-comment-page-visibility

Conversation

@ChangkeunJ

Copy link
Copy Markdown

Fixes #1645

Proposed Changes

  • Add GetPersonalCommentPage to the comment repository. For non-admin viewers it joins the target question or answer (plus the parent question for answers) and filters out targets the viewer cannot see before pagination, mirroring schema.SimpleObjectInfo.CheckVisibility: a question target must be available and shown or owned by the viewer, an answer target must be available or owned by the viewer, and its parent question must be visible the same way.
  • GetCommentPersonalWithPage now uses it, so both the page content and count reflect only the visible comments. In the issue's example, page 1 returns C with count: 1 instead of an empty list with count: 3, and page 2 is empty with count: 1.
  • Qualify the CommentQuery.GetOrderBy columns with the table name so the joined query stays unambiguous; the existing callers without joins are unaffected.
  • Add repo tests (personal_comment_visibility_test.go) that reproduce the issue scenario against a real database, plus answer-target cases: deleted answer, hidden parent question, and the owner and admin/moderator overrides.

Verified with go test ./internal/repo/repo_test (sqlite), go build ./..., go vet and golangci-lint run on the touched packages. The new tests fail against the old behavior (unfiltered page with total = 3) and pass with the fix.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Personal comments can return empty pages and incorrect counts after visibility filtering

1 participant