Updated Drupal to 8.6. This goes with the following updates because it's possible...

[yaffs-website] / web / core / modules / comment / src / Controller / CommentController.php

diff --git a/web/core/modules/comment/src/Controller/CommentController.php b/web/core/modules/comment/src/Controller/CommentController.php
index c834fa67a1cc818fd5f347105b15aa321549f2d6..ad821e333df1da4eb354e6918cade34d274f6158 100644 (file)
--- a/web/core/modules/comment/src/Controller/CommentController.php
+++ b/web/core/modules/comment/src/Controller/CommentController.php
@@ -82,10 +82,10 @@ class CommentController extends ControllerBase {
    * @return \Symfony\Component\HttpFoundation\RedirectResponse
    */
   public function commentApprove(CommentInterface $comment) {
-    $comment->setPublished(TRUE);
+    $comment->setPublished();
     $comment->save();
 
-    drupal_set_message($this->t('Comment approved.'));
+    $this->messenger()->addStatus($this->t('Comment approved.'));
     $permalink_uri = $comment->permalink();
     $permalink_uri->setAbsolute();
     return new RedirectResponse($permalink_uri->toString());
@@ -279,16 +279,19 @@ class CommentController extends ControllerBase {
     // Check if the user has the proper permissions.
     $access = AccessResult::allowedIfHasPermission($account, 'post comments');
 
+    // If commenting is open on the entity.
     $status = $entity->{$field_name}->status;
     $access = $access->andIf(AccessResult::allowedIf($status == CommentItemInterface::OPEN)
-      ->addCacheableDependency($entity));
+      ->addCacheableDependency($entity))
+      // And if user has access to the host entity.
+      ->andIf(AccessResult::allowedIf($entity->access('view')));
 
     // $pid indicates that this is a reply to a comment.
     if ($pid) {
       // Check if the user has the proper permissions.
       $access = $access->andIf(AccessResult::allowedIfHasPermission($account, 'access comments'));
 
-      /// Load the parent comment.
+      // Load the parent comment.
       $comment = $this->entityManager()->getStorage('comment')->load($pid);
       // Check if the parent comment is published and belongs to the entity.
       $access = $access->andIf(AccessResult::allowedIf($comment && $comment->isPublished() && $comment->getCommentedEntityId() == $entity->id()));