ikiwiki/doc/plugins/contrib/comments.mdwn

[[!template id=plugin name=comments author="[[Simon_McVittie|smcv]]"]]
[[!tag type/useful]]

This plugin adds "blog-style" comments. The intention is that on a non-wiki site
(like a blog) you can lock all pages for admin-only access, then allow otherwise
unprivileged (or perhaps even anonymous) users to comment on posts.

When using this plugin, you should also enable [[htmlscrubber]] and either [[htmltidy]]
or [[htmlbalance]]. Directives are filtered out by default, to avoid commenters slowing
down the wiki by causing time-consuming processing. As long as the recommended plugins
are enabled, comment authorship should hopefully be unforgeable by CGI users.

> I'm not sure that raw html should be a problem, as long as the
> htmlsanitizer and htmlbalanced plugins are enabled. I can see filtering
> out directives, as a special case. --[[Joey]]

>> Right, if I sanitize each post individually, with htmlscrubber and either htmltidy
>> or htmlbalance turned on, then there should be no way the user can forge a comment;
>> I was initially wary of allowing meta directives, but I think those are OK, as long
>> as the comment template puts the \[[!meta author]] at the *end*. Disallowing
>> directives is more a way to avoid commenters causing expensive processing than
>> anything else, at this point.
>>
>> I've rebased the plugin on master, made it sanitize individual posts' content
>> and removed the option to disallow raw HTML. Sanitizing individual posts before
>> they've been htmlized required me to preserve whitespace in the htmlbalance
>> plugin, so I did that. Alternatively, we could htmlize immediately and always
>> save out raw HTML? --[[smcv]]

>> There might be some use cases for other directives, such as img, in
>> comments.
>> 
>> I don't know if meta is "safe" (ie, guaranteed to be inexpensive and not
>> allow users to do annoying things) or if it will continue to be in the
>> future. Hard to predict really, all that can be said with certainty is
>> all directives will contine to be inexpensive and safe enough that it's
>> sensible to allow users to (ab)use them on open wikis.
>> --[[Joey]]

The plugin adds a new [[ikiwiki/PageSpec]] match type, `postcomment`, for use
with `anonok_pagespec` from the [[plugins/anonok]] plugin or `locked_pages` from
the [[plugins/lockedit]] plugin. Typical usage would be something like:

    locked_pages => "!postcomment(*)"

to allow non-admin users to comment on pages, but not edit anything. You can also do

    anonok_pages => "postcomment(*)"

to allow anonymous comments (the IP address will be used as the "author").

There are some global options for the setup file:

* `comments_shown_pagespec`: pages where comments will be displayed inline, e.g. `blog/*`
  or `*/discussion`.
* `comments_open_pagespec`: pages where new comments can be posted, e.g.
  `blog/* and created_after(close_old_comments)` or `*/discussion`
* `comments_pagename`: if this is e.g. `comment_` (the default), then comments on the
  [[sandbox]] will be called something like `sandbox/comment_12`
* `comments_allowdirectives`: if true (default false), comments may contain IkiWiki
  directives
* `comments_commit`: if true (default true), comments will be committed to the version
  control system

This plugin aims to close the [[todo]] item "[[todo/supporting_comments_via_disussion_pages]]",
and is currently available from [[smcv]]'s git repository on git.pseudorandom.co.uk (it's the
`postcomment` branch). A demo wiki with the plugin enabled is running at
<http://www.pseudorandom.co.uk/2008/ikiwiki/demo/>.

Known issues:

* Needs code review
* The access control via postcomment() is rather strange
* There is some common code cargo-culted from other plugins (notably inline and editpage) which
  should probably be shared

> I haven't done a detailed code review, but I will say I'm pleased you
> avoided re-implementing inline! --[[Joey]]

Wishlist:

* tbm would like anonymous people to be able to enter their name and possibly email
  address
* smcv would like an indication of who you're posting as / the ability to log in
  as someone else (even if anonymous comments are allowed, it'd be nice to be
  able to choose to log in with a username or OpenID, like in Livejournal);
  perhaps editpage needs this too