🔒(backend) prevent admins from rewriting other users comments

Admins/owners could overwrite another user's comment text and silently
take ownership of it.
Split write permissions: destroy stays broad (author + admin/owner) for
moderation.
    
Signed-off-by: Mohamed El Amine BOUKERFA <boukerfa.ma@gmail.com>

src/backend/core/api/serializers.py

@@ -911,12 +911,7 @@ class CommentSerializer(serializers.ModelSerializer):
 
     def validate(self, attrs):
         """Validate comment data."""
-
-        request = self.context.get("request")
-        user = getattr(request, "user", None)
-
         attrs["thread_id"] = self.context["thread_id"]
-        attrs["user_id"] = user.id if user else None
         return attrs
 
     def get_abilities(self, obj):

src/backend/core/api/viewsets.py

@@ -3004,6 +3004,11 @@ class CommentViewSet(
         context["thread_id"] = self.kwargs["thread_id"]
         return context
 
+    def perform_create(self, serializer):
+        """Attach the request user as the comment author."""
+        user = self.request.user if self.request.user.is_authenticated else None
+        serializer.save(user=user)
+
     @drf.decorators.action(
         detail=True,
         methods=["post", "delete"],