Advanced settings - #1
Open
Forro-54 wants to merge 4 commits into
Open
Conversation
Create the Advanced release line from the stable Jacaranda Comments 01.01.03 code base and add portal-wide administration. Changes: Add a portal-scoped Site-wide Jacaranda Comments Settings panel Add portal-wide emergency controls for all posting and guest posting Add central defaults for moderation, guest access, language filtering, comment length, rate limiting, CAPTCHA and email notifications Add explicit per-module inheritance of portal defaults Keep inheritance disabled by default so existing module instances retain their current local settings Restrict the central panel to DNN Superusers and members of the portal’s built-in Administrators role Create no additional DNN security roles Add server-side portal isolation, permission checks and anti-CSRF validation Use parameterised SQL for all central-settings database operations Add audit details recording who changed the central settings and when Add the portal-scoped JacarandaCommentsPortalSettings database table Preserve existing comments, replies and module settings Preserve guest commenting, registered-user editing, moderation, language filtering, CAPTCHA, rate limiting, email notifications and accessibility improvements Rename the unpublished 01.01.04 development work to Advanced 01.02.00 Update the manifest, SQL upgrade script, release notes, documentation, resources and package files The stable Simple edition remains on the main branch at version 01.01.03. This Advanced edition retains the existing DNN package identity and is an alternative upgrade path rather than a separate side-by-side module.
Add a secure five-minute correction window for guest comments and replies while they are still awaiting moderation. Changes: Allow guests to edit the text of their own pending comment or reply for up to five minutes after the original submission Keep the five-minute window tied to the original posting time so editing does not restart the timer End guest editing immediately when a submission is approved, deleted, guest posting is disabled, or all posting is disabled Restrict guest editing to comment/reply text only; guest display name and private email remain unchanged Generate a cryptographically random guest-edit credential and store only its SHA-256 hash with the comment Keep the raw guest-edit credential out of the database, URLs, query strings, hidden fields, rendered HTML, and moderator emails Do not use guest name, email, IP address, user-agent, rate-limit key, or Comment ID alone as proof of ownership Revalidate PortalId, TabId, ModuleId, guest ownership, moderation status, deletion status, token hash, and five-minute expiry during the database update Keep corrected guest submissions pending moderation Re-run the private language filter after a guest correction Preserve the existing 15-minute editing window for registered users Preserve portal-wide moderation, emergency switches, CAPTCHA, rate limiting, language filtering, email notifications, approval, deletion, and security-token validation Add GuestEditTokenHash to support secure guest correction Add and register the 01.02.02 SqlDataProvider upgrade script Update the manifest, release notes, documentation, resources, and package files Existing guest comments are not made editable by this upgrade. Only new guest submissions created after 01.02.02 receive the secure correction capability. This release is part of the Jacaranda Comments Advanced branch. The stable Simple edition remains separate on the main branch.
Introduced a secure five-minute correction window for guest comments and replies awaiting moderation. Enhanced guest editing capabilities while maintaining existing features and security measures.
Move the Advanced edition to a central-only configuration model while preserving all existing page-specific comment data and moderation features. Changes: Make Comments Administration the single location for Jacaranda Comments Advanced configuration Remove editable page-level Jacaranda settings from individual module instances Keep standard DNN module settings such as title, container, visibility, and permissions unchanged Add a safe one-time activation process for central configuration Preserve existing 01.02.x local module settings during migration Keep existing module behaviour unchanged until an Administrator explicitly activates central settings Add CentralSettingsActive to the portal settings table Keep portal-wide emergency posting and guest-posting switches active throughout migration Apply central settings portal-wide after activation Centralise guest commenting, moderation, CAPTCHA, rate limiting, language filtering, maximum comment length, and moderator email settings Preserve portal-wide moderation and the pending comments queue Preserve Approve, Reject/Delete, and View Page actions Preserve the five-minute guest correction window Preserve the 15-minute registered-user editing window Preserve guest email privacy, output encoding, anti-CSRF validation, portal isolation, and parameterised SQL Keep existing comments, replies, approval states, guest credentials, and stored module settings intact Update the manifest, SqlDataProvider upgrade script, release notes, documentation, resources, and package files This release establishes the Advanced edition as the portal-managed version of Jacaranda Comments, while the Simple edition remains the page-managed version on the main branch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Development of Jacaranda Comments has continued, and the Advanced branch has now reached version 01.02.02.
Jacaranda Comments is a page-level comments module for DNN Platform 10. It was originally designed as a straightforward way to add comments and threaded replies to individual DNN pages, but the Advanced branch is now developing into a more complete site-wide comment-management system.
The Simple edition remains separately maintained on the main branch at version 01.01.03, while the Advanced features are developed on the advanced-settings branch.
Central Comments Administration
One of the biggest additions to the Advanced edition is the new Comments Administration panel.
Administrators no longer need to visit every page individually to discover whether a comment is waiting for approval.
The central moderation queue brings together pending comments and replies from every Jacaranda Comments module within the current DNN portal.
For each pending submission, the administrator can see information including:
the DNN page title;
the module title;
whether the submission is a comment or reply;
the author or guest name;
the submission date;
the comment text;
whether the private language filter was triggered.
From the same central panel, an administrator can:
Approve a pending comment;
Reject / Delete a submission;
View Page to open the DNN page where the comment was submitted.
Moderation is deliberately performed one comment at a time. There is currently no “Approve All” or “Delete All” function, reducing the possibility of an administrator accidentally changing a large number of comments with a single click.
Portal-wide controls
The Advanced edition also includes central settings that can affect every Jacaranda Comments instance in the current portal.
Two particularly useful emergency controls are available.
Disable all new posting
An administrator can stop new comments and replies across the entire portal while leaving existing discussions visible.
This could be useful during a spam attack, site maintenance, or another situation where new submissions need to be temporarily suspended.
Disable guest posting
Guest commenting can also be disabled across the entire portal without affecting registered-user commenting.
This provides a quick response if guest posting starts attracting unwanted submissions.
Central defaults with page-level flexibility
A central administration system should not remove the flexibility that makes a page-level module useful.
For that reason, individual Jacaranda Comments modules can either continue using their own local settings or deliberately inherit the site's central defaults.
Existing modules do not automatically switch to central settings during an upgrade.
This is important because an established site should not suddenly find that its moderation, guest access, CAPTCHA, rate limiting, or email behaviour has changed merely because the Advanced edition was installed.
Five-minute guest correction window
Version 01.02.02 introduces another useful feature: guests can now correct mistakes in their own submissions.
A guest who notices a typo or poorly worded sentence immediately after posting has up to five minutes to correct the text.
There are important limitations.
The guest can edit only:
the comment or reply text.
They cannot change:
their display name;
their private email address.
The five-minute period begins when the original submission is made and does not restart after an edit.
Guest editing also ends immediately if:
the five minutes expire;
a moderator approves the submission;
the submission is deleted;
guest posting is disabled centrally;
all posting is disabled centrally.
Most importantly, a guest can edit a comment only while it is still awaiting moderation.
This prevents a guest from submitting harmless text, having it approved, and then replacing the approved public comment with different content.
Secure guest ownership
Allowing an unauthenticated visitor to edit a comment creates an obvious security question:
How does the module know that the person requesting the edit is really the guest who submitted the comment?
Jacaranda Comments does not rely on the guest's name, email address, IP address, browser information, or Comment ID as proof of ownership.
Instead, the server creates a cryptographically random temporary edit credential when the guest submits the comment.
Only a SHA-256 hash of that credential is stored with the comment.
The original credential is not placed in:
the database;
the page URL;
query strings;
hidden form fields;
rendered comment HTML;
moderator emails.
When a guest attempts to edit the submission, the server checks the credential along with the portal, page, module, comment identity, moderation status, deletion status and five-minute time limit.
These checks are repeated at the database update stage rather than trusting values supplied by the browser.
Existing guest comments created before the upgrade do not suddenly become editable because they do not possess the required guest-edit credential.
Registered-user editing remains available
Registered DNN users continue to receive the existing 15-minute editing window for their own comments and replies.
Registered ownership is based on the authenticated DNN UserId, while guests use the temporary secure correction mechanism.
This provides a useful distinction between registered and guest participation while still giving guests a short opportunity to correct genuine mistakes.
Guest commenting and moderation
Guest commenting remains optional.
When enabled:
guests provide a display name and private email address;
guest comments and replies are always held for moderation;
guest email addresses are not displayed publicly;
moderator notifications can contain the private guest contact details;
guest submissions cannot make themselves approved through modified browser values.
The site administrator can disable guest participation at any time through the Advanced central administration panel.
Private language filtering
Jacaranda Comments also includes an optional administrator-controlled language filter.
Administrators can enter terms or phrases that they do not want automatically published.
When a comment matches the list:
the original text is not automatically censored;
the submission is not deleted;
it is held for moderation;
the visitor is not told which term caused the match;
authorised moderators can see that the language filter was triggered.
This allows the filter to assist human moderation rather than attempting to replace it.
Guest corrections are rechecked by the language filter before being saved.
Page-aware moderator notifications
Moderator emails identify which DNN page generated the submission.
For example:
Comment awaiting approval — Understanding Grace
The notification body can also include the page title, page link, module title, Comment ID, author details and moderation status.
This becomes increasingly useful as the same comments module is deployed across many pages.
Accessibility improvements
Accessibility has also been considered during development.
Success and error notifications remain within the boundaries of the Jacaranda Comments module rather than appearing over unrelated content elsewhere on the page.
This is particularly useful on layouts where a long article and its comments appear in separate columns.
Notification panels include stronger borders, clearer visual distinction and prominent close controls.
The CAPTCHA answer field also has a stronger high-contrast border, increased size and a clear keyboard-focus indicator to make it easier to locate for visitors with limited vision.
Security remains a priority
Adding guest access and central administration increases the importance of server-side security.
Jacaranda Comments continues to use:
parameterised SQL;
server-side permission checks;
output encoding;
anti-CSRF security tokens;
portal, page and module scope validation;
rate limiting;
CAPTCHA support;
honeypot protection;
server-side character limits;
forced moderation for guest submissions.
Central administration is restricted to:
DNN Superusers;
members of the portal's built-in Administrators role.
No additional DNN security role is required.
Portal-wide moderation and settings are scoped to the server-derived PortalId, helping prevent an administrator from one portal changing another portal's comments or settings.
Two development paths
Jacaranda Comments is now being maintained in two development lines.
Simple edition
The main branch remains the simpler page-level module at:
Jacaranda Comments 01.01.03
This edition is intended for sites that want individual page-level configuration without central administration.
Advanced edition
The advanced-settings branch currently contains:
Jacaranda Comments Advanced 01.02.02
The Advanced edition adds:
portal-wide administration;
central moderation;
emergency posting controls;
inherited site defaults;
secure guest correction;
additional administration and auditing features.
The Advanced edition retains the same underlying DNN module identity and is intended as an upgrade path rather than as a second copy of Jacaranda Comments installed side by side.
Current testing status
The earlier Advanced revisions have been trialled successfully on a DNN test site, including the central administration and portal-wide moderation workflows.
Version 01.02.02 is the latest development revision and introduces the new five-minute guest correction capability.
As with any DNN extension upgrade, administrators should back up both the website files and database and test the release on a staging site or low-risk page before wider deployment.
The DNN Event Viewer should also be checked after installation and during testing.
Feedback is welcome
Jacaranda Comments continues to grow through practical use and careful incremental development.
Feedback is particularly welcome regarding:
guest commenting;
the five-minute guest correction window;
central moderation;
multi-page installations;
accessibility;
different DNN skins and containers;
email notifications;
spam and abuse prevention;
security concerns;
upgrade behaviour.
The aim is to keep the module useful, understandable and secure without turning it into an unnecessarily complicated system.
Jacaranda Comments Advanced 01.02.02 represents another step towards providing DNN site owners with a practical comments system that can scale from a single page to a site containing many active discussions.
Project website: https://forrestitservices.org/
GitHub: [Insert Jacaranda Comments repository link]