diff --git a/api_tests/src/post.spec.ts b/api_tests/src/post.spec.ts index dee6c43d6..02080c4cc 100644 --- a/api_tests/src/post.spec.ts +++ b/api_tests/src/post.spec.ts @@ -270,8 +270,10 @@ test("Lock a post", async () => { post => !!post && post.post.locked, ); - // Try to make a new comment there, on alpha - await expect(createComment(alpha, alphaPost1.post.id)).rejects.toStrictEqual( + // Try to make a new comment there, on alpha. For this we need to create a normal + // user account because admins/mods can comment in locked posts. + let user = await registerUser(alpha, alphaUrl); + await expect(createComment(user, alphaPost1.post.id)).rejects.toStrictEqual( Error("locked"), ); @@ -290,7 +292,7 @@ test("Lock a post", async () => { expect(alphaPost2.post.locked).toBe(false); // Try to create a new comment, on alpha - let commentAlpha = await createComment(alpha, alphaPost1.post.id); + let commentAlpha = await createComment(user, alphaPost1.post.id); expect(commentAlpha).toBeDefined(); }); diff --git a/crates/api_crud/src/comment/create.rs b/crates/api_crud/src/comment/create.rs index 64f8a3cea..e5a869223 100644 --- a/crates/api_crud/src/comment/create.rs +++ b/crates/api_crud/src/comment/create.rs @@ -10,6 +10,7 @@ use lemmy_api_common::{ check_post_deleted_or_removed, generate_local_apub_endpoint, get_post, + is_mod_or_admin, local_site_to_slur_regex, process_markdown, EndpointType, @@ -55,7 +56,10 @@ pub async fn create_comment( check_post_deleted_or_removed(&post)?; // Check if post is locked, no new comments - if post.locked { + let is_mod_or_admin = is_mod_or_admin(&mut context.pool(), &local_user_view.person, community_id) + .await + .is_ok(); + if post.locked && !is_mod_or_admin { Err(LemmyErrorType::Locked)? } diff --git a/crates/apub/src/objects/comment.rs b/crates/apub/src/objects/comment.rs index 81a618bba..6d8d814bf 100644 --- a/crates/apub/src/objects/comment.rs +++ b/crates/apub/src/objects/comment.rs @@ -18,7 +18,7 @@ use activitypub_federation::{ use chrono::{DateTime, Utc}; use lemmy_api_common::{ context::LemmyContext, - utils::{local_site_opt_to_slur_regex, process_markdown}, + utils::{is_mod_or_admin, local_site_opt_to_slur_regex, process_markdown}, }; use lemmy_db_schema::{ source::{ @@ -142,7 +142,11 @@ impl Object for ApubComment { verify_is_remote_object(note.id.inner(), context.settings())?; verify_person_in_community(¬e.attributed_to, &community, context).await?; let (post, _) = note.get_parents(context).await?; - if post.locked { + let creator = note.attributed_to.dereference(context).await?; + let is_mod_or_admin = is_mod_or_admin(&mut context.pool(), &creator, community.id) + .await + .is_ok(); + if post.locked && !is_mod_or_admin { Err(LemmyErrorType::PostIsLocked)? } else { Ok(())