MDL-24540, fixed comments UI for not logged in users

comment/comment.js

@@ -138,6 +138,10 @@ bodyContent: '<div class="comment-delete-confirm"><a href="#" id="confirmdelete-
                             }
                             var data = Y.JSON.parse(o.responseText);
                             if (data.error) {
+                                if (data.error == 'require_login') {
+                                    args.callback(id,data,p);
+                                    return true;
+                                }
                                 alert(data.error);
                                 return false;
                             } else {
@@ -193,14 +197,17 @@ bodyContent: '<div class="comment-delete-confirm"><a href="#" id="confirmdelete-
                 var scope = this;
                 var container = Y.one('#comment-ctrl-'+this.client_id);
                 var params = {
+                    'action': 'get',
                     'page': page
                 };
                 this.request({
                     scope: scope,
                     params: params,
                     callback: function(id, ret, args) {
                         var linktext = Y.one('#comment-link-text-'+scope.client_id);
-                        linktext.set('innerHTML', M.str.moodle.comments + ' ('+ret.count+')');
+                        if (ret.count) {
+                            linktext.set('innerHTML', M.str.moodle.comments + ' ('+ret.count+')');
+                        }
                         var container = Y.one('#comment-list-'+scope.client_id);
                         var pagination = Y.one('#comment-pagination-'+scope.client_id);
                         if (ret.pagination) {
@@ -209,7 +216,12 @@ bodyContent: '<div class="comment-delete-confirm"><a href="#" id="confirmdelete-
                             //empty paging bar
                             pagination.set('innerHTML', '');
                         }
-                        var result = scope.render(ret.list);
+                        if (ret.error == 'require_login') {
+                            var result = {};
+                            result.html = M.str.moodle.commentsrequirelogin;
+                        } else {
+                            var result = scope.render(ret.list);
+                        }
                         container.set('innerHTML', result.html);
                         var img = Y.one('#comment-img-'+scope.client_id);
                         img.set('src', M.util.image_url('t/expanded', 'core'));

comment/comment_ajax.php

@@ -29,18 +29,31 @@
 $PAGE->set_context($context);
 $PAGE->set_url('/comment/comment_ajax.php');
 
-$action    = optional_param('action',    '', PARAM_ALPHA);
+$action = optional_param('action', '', PARAM_ALPHA);
 
-// XXX: display comments in frontpage without login
-if ($context->id != get_context_instance(CONTEXT_COURSE, SITEID)->id
-    or $action == 'add'
-    or $action == 'delete') {
-    $ignore_permission = false;
-    require_login($course, true, $cm);
+if (!confirm_sesskey()) {
+    $error = array('error'=>get_string('invalidsesskey'));
+    die(json_encode($error));
+}
+
+if (!isloggedin()) {
+    // display comments on front page without permission check
+    if ($action == 'get') {
+        if ($context->id == get_context_instance(CONTEXT_COURSE, SITEID)->id) {
+            $ignore_permission = true;
+        } else {
+            // tell user to log in to view comments
+            $ignore_permission = false;
+            echo json_encode(array('error'=>'require_login'));
+            die;
+        }
+    } else {
+        // ignore request
+        die;
+    }
 } else {
-    $ignore_permission = true;
+    $ignore_permission = false;
 }
-require_sesskey();
 
 $area      = optional_param('area',      '', PARAM_ALPHAEXT);
 $client_id = optional_param('client_id', '', PARAM_RAW);

comment/lib.php

@@ -225,6 +225,7 @@ public static function init() {
         $PAGE->requires->string_for_js('addcomment', 'moodle');
         $PAGE->requires->string_for_js('deletecomment', 'moodle');
         $PAGE->requires->string_for_js('comments', 'moodle');
+        $PAGE->requires->string_for_js('commentsrequirelogin', 'moodle');
     }
 
     public function set_component($component) {

lang/en/moodle.php

@@ -243,6 +243,7 @@
 $string['collapseall'] = 'Collapse all';
 $string['commentincontext'] = 'Find this comment in context';
 $string['comments'] = 'Comments';
+$string['commentsrequirelogin'] = 'You need to login to view the comments';
 $string['comparelanguage'] = 'Compare and edit current language';
 $string['complete'] = 'Complete';
 $string['completereport'] = 'Complete report';
@@ -312,9 +313,9 @@
 $string['coursemessage'] = 'Message course users';
 $string['coursenotaccessible'] = 'This course does not allow public access';
 $string['courselegacyfiles'] = 'Legacy course files';
-$string['courselegacyfiles_help'] = 'The Course Files area provides some backward compatibility with Moodle 1.9 and earlier.  All files in this area are always accessible to all participants in the course (whether you link to them or not) and there is no way to know where any of these files are being used in Moodle. 
+$string['courselegacyfiles_help'] = 'The Course Files area provides some backward compatibility with Moodle 1.9 and earlier.  All files in this area are always accessible to all participants in the course (whether you link to them or not) and there is no way to know where any of these files are being used in Moodle.
 
-If you use this area to store course files, you can expose yourself to a number of privacy and security issues, as well as experiencing missing files in backups, course imports and any time content is shared or re-used.  It is therefore recommended that you do not use this area unless you really know what you are doing.  
+If you use this area to store course files, you can expose yourself to a number of privacy and security issues, as well as experiencing missing files in backups, course imports and any time content is shared or re-used.  It is therefore recommended that you do not use this area unless you really know what you are doing.
 
 The link below provides more information about all this and will show you some better ways to manage files in Moodle 2.';
 $string['courselegacyfiles_link'] = 'coursefiles2';