Jacaranda Comments for DNN 10: Advanced Edition

Jacaranda Comments Advanced 01.03.00

Jacaranda Comments Advanced is the portal-managed edition of the Jacaranda Comments module for DNN 10.

Version 01.03.00 introduces a simplified central-only configuration model. Comments remain page-specific, but all Jacaranda Comments behaviour is now managed from one portal-wide Comments Administration panel.

Highlights
Central moderation queue for pending comments and replies across the portal
Approve, Reject/Delete, and View Page actions from one administration screen
Portal-wide settings for guest commenting, moderation, CAPTCHA, rate limiting, language filtering, comment length, and email notifications
Emergency controls to disable all new posting or guest posting across the portal
Five-minute correction window for new guest comments and replies while they remain pending moderation
Existing 15-minute editing window for registered users
Private guest email handling
Administrator-controlled language filtering
Page-aware moderator email notifications
Accessible notification panels and improved CAPTCHA field visibility
Threaded replies and page-specific discussions
Parameterised SQL, output encoding, anti-CSRF validation, and server-side permission checks
Central-only configuration

Beginning with 01.03.00, Advanced no longer maintains separate Jacaranda settings for every module instance.

All Advanced modules within a portal use the same configuration from Comments Administration.

DNN's normal module settings remain available for module title, container, visibility, permissions, and other standard DNN properties.

For upgrades from earlier Advanced versions, central configuration is not activated automatically. Administrators can review and save the portal settings first, then explicitly activate central management for the portal.

Existing page-level settings are retained in DNN during the transition and are not deleted.

Central moderation

Pending comments and replies from all Jacaranda Comments modules in the current portal can be reviewed in one place.

Administrators and Superusers can:

Approve individual submissions
Reject/Delete individual submissions
Open the originating page
See page and module information
See guest or registered-user details
See private language-filter indicators

Bulk approval and bulk deletion are intentionally not included.

Guest commenting

Guest posting remains optional.

When enabled:

Guest name and private email are required
Guest submissions are always held for moderation
Guest email addresses are never displayed publicly
New guest comments and replies can be corrected for up to five minutes while still pending approval
Guest editing ends immediately after approval, deletion, expiry, or a portal-wide posting restriction

Guest correction uses a secure temporary ownership credential rather than relying on name, email address, IP address, browser information, or Comment ID alone.

Security

Jacaranda Comments Advanced retains:

Parameterised SQL
Output encoding
Server-side permission checks
Portal, page, and module scope validation
Anti-CSRF security-token validation
Server-side moderation decisions
CAPTCHA support
Honeypot protection
Rate limiting
Character-length validation
Administrator/Superuser-only access to portal-wide administration
Upgrade notes

Back up both the DNN database and website files before upgrading.

For an upgrade from Advanced 01.02.x:

Install the 01.03.00 package through DNN Extensions.
Open Comments Administration.
Review the central settings.
Save them for review.
Confirm existing module behaviour.
Explicitly activate central settings for the portal.
Test comments, replies, moderation, guest editing, CAPTCHA, language filtering, and email notifications.
Check the DNN Event Viewer.
Edition note

Jacaranda Comments Advanced is maintained separately from the Simple edition.

Simple edition: page-level configuration
Advanced edition: portal-wide configuration and moderation

The Simple edition remains available separately for sites that prefer each comments module to manage its own settings.

Jacaranda Comments 01.00.13 Simple Edition

Jacaranda Comments 01.00.13

Jacaranda Comments 01.00.13 is the stable Simple edition of the Jacaranda Comments module for DNN 10.

This release keeps the module focused on page-level commenting and page-level configuration, making it suitable for sites that want each comments module to manage its own behaviour independently.

Highlights

• Page-specific comments and threaded replies
• Optional guest commenting
• Registered-user 15-minute editing window
• Moderator approval and deletion
• Private administrator-controlled language filtering
• Configurable comment-length limits
• CAPTCHA and rate limiting
• Email notifications
• Page-aware moderator email subjects
• Accessible success and error notifications
• Improved CAPTCHA field visibility
• Parameterised SQL, output encoding, anti-CSRF checks, and server-side permission validation
• MIT License included in the DNN installation package

Guest commenting

Guest commenting can be enabled or disabled separately for each module instance.

When guest posting is enabled:

• Guests must provide a display name
• Guests must provide a private email address
• Guest email addresses are not displayed publicly
• Guest comments and replies are always held for moderation
• Guests cannot edit their submissions in the Simple edition

Registered users continue to post using their DNN account identity.

Registered-user editing

Registered users can edit their own comments and replies for up to 15 minutes after the original submission.

Editing is enforced server-side and limited to the original DNN user account.

When moderation applies, an edited submission may be returned to pending approval.

Private language filter

Administrators can optionally configure a private list of terms or phrases for each module.

If a submission matches the configured language filter:

• The original text is not altered
• The submission is not automatically deleted
• It is held for moderator review
• The visitor is not shown which configured term was matched
• Moderators can see that the language filter was triggered

Moderator notifications

Moderator emails identify the DNN page where the submission was made.

For moderated submissions, the subject format is:

Comment awaiting approval — [Page title]

The email body can include:

• Page title
• Page link
• Module title
• Comment ID
• Author details
• Moderation status
• Private guest contact details where applicable
• Private language-filter information

Accessibility improvements

Notification panels have stronger borders and clearer visual distinction to make success and warning messages easier to locate.

Notifications remain within the boundaries of the Jacaranda Comments module, which is particularly useful on multi-column layouts where comments may sit beside a long article.

The CAPTCHA answer field also includes:

• A stronger high-contrast border
• Larger text
• Increased padding
• A more visible keyboard-focus outline

Security

Jacaranda Comments 01.00.13 retains:

• Parameterised SQL
• Output encoding
• Server-side posting and moderation checks
• Anti-CSRF security-token validation
• Portal, page, and module scope validation
• CAPTCHA support
• Honeypot protection
• Rate limiting
• Server-side character limits
• Guest submissions forced into moderation

Licensing

Jacaranda Comments 01.00.13 is released under the MIT License.

The licence is included in the DNN extension package and is displayed during installation.

Edition note

This is the Simple edition of Jacaranda Comments.

• Simple edition 01.00.13: page-level configuration
• Advanced edition: portal-wide configuration and central moderation

The Simple edition is intended for sites that prefer each Jacaranda Comments instance to manage its own settings independently.

Jacaranda Comments 01.00.19 – Public Testing Release

Jacaranda Comments is a DNN 10 WebForms module providing page-level comments, threaded replies, moderation, email notifications, rate limiting, optional CAPTCHA protection, and module-specific settings.

Highlights in version 01.00.19
Improved positioning after posting comments and threaded replies
Immediately published comments return to the newly created comment
Immediately published replies return to the newly created reply
Pending comments and replies return to a clear moderation confirmation
Improved handling of DNN page-layout changes after postback
Middle-right success and validation pop-up notifications
More reliable notification close-button and automatic-dismiss behaviour
Configurable maximum comment and reply length
Character limit configurable separately for each module instance
Default character limit of 4,000 characters
Supported configurable range of 250 to 10,000 characters
Dynamic remaining-character counter
Pasted text is preserved rather than silently truncated
Over-length submissions are rejected before database insertion or email notification
Full entered text remains available for correction
Improved security-token handling for comments, replies, approval, and deletion
Clean redirects after posting and moderation actions
Prevention of browser form-resubmission prompts
Existing moderation, permissions, CAPTCHA, rate limiting, and email-notification behaviour retained
Database changes

There are no database schema changes in this release.

The existing comment text column already supports the configurable character limit. Matching upgrade scripts are included for DNN extension-version tracking.

Testing completed

Version 01.00.19 has been tested on DNN Platform 10.3.2 with:

Clean module installation and upgrades
Normal registered users
Administrators and superusers
New comments
Threaded replies
Comments awaiting moderation
Approval and deletion
Email notifications
CAPTCHA
Rate limiting
Configurable character limits
Over-length validation
Success and error notifications
Page positioning after posting
Default DNN containers
Preliminary custom-theme testing

All tested functions are currently working as expected. Wider testing with additional skins, containers, DNN configurations, browsers, and mobile layouts is welcomed.

Installation

Upload the following package through:

Settings → Extensions → Install Extension

Use:

Jacaranda_Comments_01.00.19_Install.zip

Do not upload the Source ZIP or Repository Update ZIP through DNN Extensions.

Back up the website files and database before installation or upgrade.

After installation:

Add Jacaranda Comments to a test or low-risk page.
Review the module Settings.
Test posting as a normal registered user.
Test replies, moderation, approval, and deletion.
Confirm email notifications if enabled.
Check the DNN Event Viewer for errors.
Feedback requested

Feedback is especially welcome regarding:

Compatibility with custom DNN skins and containers
Desktop and mobile layout
Comment and reply positioning
Pop-up notification placement and accessibility
Character-limit behaviour
CAPTCHA and rate limiting
Moderation and email notifications
DNN Edit Mode and PersonaBar behaviour

When reporting an issue, please include:

DNN Platform version
Browser and device
Skin and container name
Whether the user was registered, administrator, or superuser
Relevant module settings
Steps needed to reproduce the issue
Any DNN Event Viewer details

This is a public testing release. Although it has performed well during testing on DNN Platform 10.3.2, testing on a staging page or one low-risk live page is recommended before wider deployment.

Version 01.02.02

Add a secure five-minute correction window for guest comments and replies while they are still awaiting moderation.

Changes:

Allow guests to edit the text of their own pending comment or reply for up to five minutes after the original submission
Keep the five-minute window tied to the original posting time so editing does not restart the timer
End guest editing immediately when a submission is approved, deleted, guest posting is disabled, or all posting is disabled
Restrict guest editing to comment/reply text only; guest display name and private email remain unchanged
Generate a cryptographically random guest-edit credential and store only its SHA-256 hash with the comment
Keep the raw guest-edit credential out of the database, URLs, query strings, hidden fields, rendered HTML, and moderator emails
Do not use guest name, email, IP address, user-agent, rate-limit key, or Comment ID alone as proof of ownership
Revalidate PortalId, TabId, ModuleId, guest ownership, moderation status, deletion status, token hash, and five-minute expiry during the database update
Keep corrected guest submissions pending moderation
Re-run the private language filter after a guest correction
Preserve the existing 15-minute editing window for registered users
Preserve portal-wide moderation, emergency switches, CAPTCHA, rate limiting, language filtering, email notifications, approval, deletion, and security-token validation
Add GuestEditTokenHash to support secure guest correction
Add and register the 01.02.02 SqlDataProvider upgrade script
Update the manifest, release notes, documentation, resources, and package files

Existing guest comments are not made editable by this upgrade. Only new guest submissions created after 01.02.02 receive the secure correction capability.

This release is part of the Jacaranda Comments Advanced branch. The stable Simple edition remains separate on the main branch.