From fe39b69c1f626e09bc5066b9e76a9f29aab14a8d Mon Sep 17 00:00:00 2001
From: Dan Brown <development@danb.me>
Date: Wed, 1 Jul 2026 10:20:32 +0100
Subject: [PATCH] Comments: Added visibility check to comment delete

Aligns it with other actions/endpoints, and ensures an extra layer of
control against malicious use.

Thanks to mfk25 for reporting.
---
 app/Activity/Controllers/CommentController.php | 11 ++++-------
 tests/Activity/CommentStoreTest.php            | 17 +++++++++++++++++
 2 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/app/Activity/Controllers/CommentController.php b/app/Activity/Controllers/CommentController.php
index f61a2c8df..8474d9eb1 100644
--- a/app/Activity/Controllers/CommentController.php
+++ b/app/Activity/Controllers/CommentController.php
@@ -59,8 +59,7 @@ class CommentController extends Controller
             'html' => ['required', 'string'],
         ]);
 
-        $comment = $this->commentRepo->getById($commentId);
-        $this->checkOwnablePermission(Permission::PageView, $comment->entity);
+        $comment = $this->commentRepo->getVisibleById($commentId);
         $this->checkOwnablePermission(Permission::CommentUpdate, $comment);
 
         $comment = $this->commentRepo->update($comment, $input['html']);
@@ -76,8 +75,7 @@ class CommentController extends Controller
      */
     public function archive(int $id)
     {
-        $comment = $this->commentRepo->getById($id);
-        $this->checkOwnablePermission(Permission::PageView, $comment->entity);
+        $comment = $this->commentRepo->getVisibleById($id);
         if (!userCan(Permission::CommentUpdate, $comment) && !userCan(Permission::CommentDelete, $comment)) {
             $this->showPermissionError();
         }
@@ -96,8 +94,7 @@ class CommentController extends Controller
      */
     public function unarchive(int $id)
     {
-        $comment = $this->commentRepo->getById($id);
-        $this->checkOwnablePermission(Permission::PageView, $comment->entity);
+        $comment = $this->commentRepo->getVisibleById($id);
         if (!userCan(Permission::CommentUpdate, $comment) && !userCan(Permission::CommentDelete, $comment)) {
             $this->showPermissionError();
         }
@@ -116,7 +113,7 @@ class CommentController extends Controller
      */
     public function destroy(int $id)
     {
-        $comment = $this->commentRepo->getById($id);
+        $comment = $this->commentRepo->getVisibleById($id);
         $this->checkOwnablePermission(Permission::CommentDelete, $comment);
 
         $this->commentRepo->delete($comment);
diff --git a/tests/Activity/CommentStoreTest.php b/tests/Activity/CommentStoreTest.php
index 2296f91a9..04624e4d5 100644
--- a/tests/Activity/CommentStoreTest.php
+++ b/tests/Activity/CommentStoreTest.php
@@ -105,6 +105,23 @@ class CommentStoreTest extends TestCase
         $this->assertActivityExists(ActivityType::COMMENT_DELETE);
     }
 
+    public function test_comment_delete_requires_view_permission_to_page()
+    {
+        $editor = $this->users->editor();
+        $this->permissions->grantUserRolePermissions($editor, ['comment-delete-all']);
+        $page = $this->entities->page();
+        $this->actingAs($editor);
+
+        $commentData = Comment::factory()->make();
+        $this->postJson("/comment/$page->id", $commentData->getAttributes());
+        $comment = $page->comments()->first();
+        $this->permissions->disableEntityInheritedPermissions($page);
+
+        $resp = $this->deleteJson("/comment/$comment->id");
+        $resp->assertStatus(404);
+        $this->assertDatabaseHas('comments', ['id' => $comment->id]);
+    }
+
     public function test_comment_archive_and_unarchive()
     {
         $this->asAdmin();