🔒(backend) prevent admins from rewriting other users comments

Admins/owners could overwrite another user's comment text and silently
take ownership of it.
Split write permissions: destroy stays broad (author + admin/owner) for
moderation.
    
Signed-off-by: Mohamed El Amine BOUKERFA <boukerfa.ma@gmail.com>
This commit is contained in:
Amine BOUKERFA
2026-05-26 10:26:31 +02:00
committed by GitHub
parent 8d42f814b7
commit 3264e29941
7 changed files with 33 additions and 28 deletions
-5
View File
@@ -911,12 +911,7 @@ class CommentSerializer(serializers.ModelSerializer):
def validate(self, attrs):
"""Validate comment data."""
request = self.context.get("request")
user = getattr(request, "user", None)
attrs["thread_id"] = self.context["thread_id"]
attrs["user_id"] = user.id if user else None
return attrs
def get_abilities(self, obj):