Does anyone know of a module that would allow me to make the comments of a specific node type write-only?
Here is what I'm trying to do. I have a site that has a "Job Posting" node type, where each node is a job posting to which applicants can apply for using comments. I use the Comment Upload module so they can upload a resume file, but I want to make sure that only the applicant and an HR person can read the comment (including the comment itself and the uploaded file).
I looked at the Comment Permissions module, which allows me to specify the permissions to this node type, but it has no write-only option (just read-only, read-write). It allows me to hide comments from people who don't have permission to post, but on my site, I want to restrict the display of specific comments.
Is there any module that makes a comment either completely write-only (where a user can create a comment, but cannot read it), or better yet, a module that allows only the user to read their own comment but nobody else's unless they have a "read all comments for this node type" type of permission?
If there isn't anything that does what I exactly need, any pointers to an example module that at least can show me how to restrict the read of specific comments within a node by user?
Thanks.
-Brian
Comments
Why not nodes?
Is there some reason why you're doing this with comments? I'd think this would be a lot easier with nodes.
To answer your actual question, I don't know of any module that does write-only comments. Looking at comment_render, it doesn't appear to be possible to do such specific access control. But again, it's easy to do with nodes.
The reason I don't want to
The reason I don't want to use nodes for this is because each job posting is a node, and the responses need to be submitted by authenticated users and connected to the node. As a result, I figured comments are perfect for this, except for the fact that it needs to be restricted so other users cannot see submissions other than their own.
Upon further work this weekend, I did find a possible solution by overriding comment.tpl.php in the theme layer. It is not a very elegant solution I think, but it seems to be working.
I was hoping for a more proper module-based approach, but it sounds like there might not be one without getting too deep in the guts of core.
Thanks.
That does seem like a use
That does seem like a use case for node-reference fields, and with a module like Node Reference URL Widget, each Job Posting node would have a link to create a Response node with the node reference field in the creation form pre-set. The node access system is then much more flexible for controlling access to each node than comments are made to be.
similarities in talk module
I don't know about something that does exactly this, but the talk module does remove comments from the node view and show them elsewhere. You could modify what talk does in hook_nodeapi to show them for only certain users.
You can also use db_rewrite_sql like in cave to hide comments from users in specific ways.
knaddison blog | Morris Animal Foundation
Comment Permissions
I was looking at producing a D7 version of "Comment Permissions" and one of my test cases is to have a user that has "post" permission against a node type but no "view" permission. It works, I just couldn't figure out a use case. Looks like you found one. What I would need to add is to add a "view own comment" permission.
For the time being, the current version doesn't support a "view" permission - just like you found.
you can do it in comment.tpl.php
for anyone wanting to do this without writing a module, you can put the following at the beginning of your theme's comment.tpl.php (this code tested only on d5, but looks like it should also work on d6)
<?phpglobal $user;
if(($comment->uid == $user->uid || $user->uid == 1 || in_array('permitted_role', $user->roles)) && ($comment->status == COMMENT_PUBLISHED)):
?>
What it does: this line of code checks to see if the user is the comment author, or user 1 (the root admin), or has the specified role; then it checks if the comment is published. Typical registered users only see their own comments. User 1 and users with the specified role see all published comments for that node.
What you need to do to use it: substitute permitted_role with the actual name of the role you want to permit. Then of course close the "if" by putting the following at the end of comment.tpl.php
<?phpendif
?>
ownsourcing.com - strategy, training, documentation