From 0f7476c9bde4aecefcb1ace31e24aa746c4b28fe Mon Sep 17 00:00:00 2001 From: dartcafe Date: Sat, 22 Aug 2026 11:02:43 +0200 Subject: [PATCH 1/4] fix confidential comments for public users Signed-off-by: dartcafe --- CHANGELOG.md | 3 +++ lib/Controller/PublicController.php | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2e1c86b858..d82ecbacdf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,9 @@ # Changelog All notable changes to this project will be documented in this file. ## [Unreleased] +### Fixed + - Public users could not add confidential comments + ### Added - OpenAPI spec diff --git a/lib/Controller/PublicController.php b/lib/Controller/PublicController.php index 6a895c21ec..5d43c03fb2 100644 --- a/lib/Controller/PublicController.php +++ b/lib/Controller/PublicController.php @@ -314,9 +314,9 @@ public function getComments(): JSONResponse { #[ShareTokenRequired] #[OpenAPI(OpenAPI::SCOPE_IGNORE)] #[FrontpageRoute(verb: 'POST', url: '/s/{token}/comment')] - public function addComment(string $message): JSONResponse { + public function addComment(string $message, ?bool $confidential = false): JSONResponse { return $this->response(fn () => [ - 'comment' => $this->commentService->add($message, $this->userSession->getShare()->getPollIdOrFail()) + 'comment' => $this->commentService->add($message, $this->userSession->getShare()->getPollIdOrFail(), $confidential) ]); } From 0c41a7a91d93f2e9b628ec67fda6b234cf6427a5 Mon Sep 17 00:00:00 2001 From: dartcafe Date: Sat, 22 Aug 2026 11:06:43 +0200 Subject: [PATCH 2/4] API as well Signed-off-by: dartcafe --- lib/Controller/CommentApiController.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/Controller/CommentApiController.php b/lib/Controller/CommentApiController.php index d20c036005..2b844327da 100644 --- a/lib/Controller/CommentApiController.php +++ b/lib/Controller/CommentApiController.php @@ -55,8 +55,8 @@ public function list(int $pollId): DataResponse { #[NoAdminRequired] #[NoCSRFRequired] #[ApiRoute(verb: 'POST', url: '/api/v1.0/poll/{pollId}/comment')] - public function add(int $pollId, string $comment): DataResponse { - return $this->response(fn () => ['comment' => $this->commentService->add($comment, $pollId)->jsonSerialize()]); + public function add(int $pollId, string $comment, ?bool $confidential = false): DataResponse { + return $this->response(fn () => ['comment' => $this->commentService->add($comment, $pollId, $confidential)->jsonSerialize()]); } /** From 98effbd602d8995027adf9883651b649fb4ecb73 Mon Sep 17 00:00:00 2001 From: dartcafe Date: Sat, 22 Aug 2026 11:08:18 +0200 Subject: [PATCH 3/4] param is mandatory for public API Signed-off-by: dartcafe --- lib/Controller/PublicController.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/Controller/PublicController.php b/lib/Controller/PublicController.php index 5d43c03fb2..802831a0e0 100644 --- a/lib/Controller/PublicController.php +++ b/lib/Controller/PublicController.php @@ -314,7 +314,7 @@ public function getComments(): JSONResponse { #[ShareTokenRequired] #[OpenAPI(OpenAPI::SCOPE_IGNORE)] #[FrontpageRoute(verb: 'POST', url: '/s/{token}/comment')] - public function addComment(string $message, ?bool $confidential = false): JSONResponse { + public function addComment(string $message, bool $confidential = false): JSONResponse { return $this->response(fn () => [ 'comment' => $this->commentService->add($message, $this->userSession->getShare()->getPollIdOrFail(), $confidential) ]); From 445589d5a9100f5271287d5b7a9df74f002fc5a8 Mon Sep 17 00:00:00 2001 From: dartcafe Date: Sat, 22 Aug 2026 11:17:11 +0200 Subject: [PATCH 4/4] update docs ans specs Signed-off-by: dartcafe --- lib/Controller/CommentApiController.php | 3 ++- lib/Controller/CommentController.php | 1 + lib/Controller/PublicController.php | 1 + openapi-full.json | 5 +++++ openapi.json | 5 +++++ 5 files changed, 14 insertions(+), 1 deletion(-) diff --git a/lib/Controller/CommentApiController.php b/lib/Controller/CommentApiController.php index 2b844327da..06568f41da 100644 --- a/lib/Controller/CommentApiController.php +++ b/lib/Controller/CommentApiController.php @@ -49,13 +49,14 @@ public function list(int $pollId): DataResponse { * 200: Comment added * @param int $pollId Poll id * @param string $comment Comment text to add + * @param bool $confidential Whether the comment is only visible to the poll owner and the author * @return DataResponse */ #[CORS] #[NoAdminRequired] #[NoCSRFRequired] #[ApiRoute(verb: 'POST', url: '/api/v1.0/poll/{pollId}/comment')] - public function add(int $pollId, string $comment, ?bool $confidential = false): DataResponse { + public function add(int $pollId, string $comment, bool $confidential = false): DataResponse { return $this->response(fn () => ['comment' => $this->commentService->add($comment, $pollId, $confidential)->jsonSerialize()]); } diff --git a/lib/Controller/CommentController.php b/lib/Controller/CommentController.php index 7c2343e71b..c4914743a8 100644 --- a/lib/Controller/CommentController.php +++ b/lib/Controller/CommentController.php @@ -42,6 +42,7 @@ public function list(int $pollId): JSONResponse { * Write a new comment to the db and returns the new comment as array * @param int $pollId Poll id * @param string $message Comment text to add + * @param bool $confidential Whether the comment is only visible to the poll owner and the author */ #[NoAdminRequired] #[FrontpageRoute(verb: 'POST', url: '/poll/{pollId}/comment')] diff --git a/lib/Controller/PublicController.php b/lib/Controller/PublicController.php index 802831a0e0..a2964b9989 100644 --- a/lib/Controller/PublicController.php +++ b/lib/Controller/PublicController.php @@ -309,6 +309,7 @@ public function getComments(): JSONResponse { /** * Write a new comment to the db and returns the new comment as array * @param string $message Comment text to add + * @param bool $confidential Whether the comment is only visible to the poll owner and the author */ #[PublicPage] #[ShareTokenRequired] diff --git a/openapi-full.json b/openapi-full.json index 9b6fa1e3e5..0a52a1566b 100644 --- a/openapi-full.json +++ b/openapi-full.json @@ -1205,6 +1205,11 @@ "comment": { "type": "string", "description": "Comment text to add" + }, + "confidential": { + "type": "boolean", + "default": false, + "description": "Whether the comment is only visible to the poll owner and the author" } } } diff --git a/openapi.json b/openapi.json index e75af3f96c..343ea76790 100644 --- a/openapi.json +++ b/openapi.json @@ -1205,6 +1205,11 @@ "comment": { "type": "string", "description": "Comment text to add" + }, + "confidential": { + "type": "boolean", + "default": false, + "description": "Whether the comment is only visible to the poll owner and the author" } } }