From 3c358e5b0b42f9906d5de4e362d13e4b11708cd6 Mon Sep 17 00:00:00 2001
From: Nutomic <me@nutomic.com>
Date: Mon, 4 Mar 2024 15:15:21 +0100
Subject: [PATCH] Mods and admins can comment in locked posts (fixes #4116)
 (#4488)

* Mods and admins can comment in locked posts (fixes #4116)

* fmt

* fix

* fix test
---
 api_tests/src/post.spec.ts            | 8 +++++---
 crates/api_crud/src/comment/create.rs | 6 +++++-
 crates/apub/src/objects/comment.rs    | 8 ++++++--
 3 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/api_tests/src/post.spec.ts b/api_tests/src/post.spec.ts
index dee6c43d6..02080c4cc 100644
--- a/api_tests/src/post.spec.ts
+++ b/api_tests/src/post.spec.ts
@@ -270,8 +270,10 @@ test("Lock a post", async () => {
     post => !!post && post.post.locked,
   );
 
-  // Try to make a new comment there, on alpha
-  await expect(createComment(alpha, alphaPost1.post.id)).rejects.toStrictEqual(
+  // Try to make a new comment there, on alpha. For this we need to create a normal
+  // user account because admins/mods can comment in locked posts.
+  let user = await registerUser(alpha, alphaUrl);
+  await expect(createComment(user, alphaPost1.post.id)).rejects.toStrictEqual(
     Error("locked"),
   );
 
@@ -290,7 +292,7 @@ test("Lock a post", async () => {
   expect(alphaPost2.post.locked).toBe(false);
 
   // Try to create a new comment, on alpha
-  let commentAlpha = await createComment(alpha, alphaPost1.post.id);
+  let commentAlpha = await createComment(user, alphaPost1.post.id);
   expect(commentAlpha).toBeDefined();
 });
 
diff --git a/crates/api_crud/src/comment/create.rs b/crates/api_crud/src/comment/create.rs
index 64f8a3cea..e5a869223 100644
--- a/crates/api_crud/src/comment/create.rs
+++ b/crates/api_crud/src/comment/create.rs
@@ -10,6 +10,7 @@ use lemmy_api_common::{
     check_post_deleted_or_removed,
     generate_local_apub_endpoint,
     get_post,
+    is_mod_or_admin,
     local_site_to_slur_regex,
     process_markdown,
     EndpointType,
@@ -55,7 +56,10 @@ pub async fn create_comment(
   check_post_deleted_or_removed(&post)?;
 
   // Check if post is locked, no new comments
-  if post.locked {
+  let is_mod_or_admin = is_mod_or_admin(&mut context.pool(), &local_user_view.person, community_id)
+    .await
+    .is_ok();
+  if post.locked && !is_mod_or_admin {
     Err(LemmyErrorType::Locked)?
   }
 
diff --git a/crates/apub/src/objects/comment.rs b/crates/apub/src/objects/comment.rs
index 81a618bba..6d8d814bf 100644
--- a/crates/apub/src/objects/comment.rs
+++ b/crates/apub/src/objects/comment.rs
@@ -18,7 +18,7 @@ use activitypub_federation::{
 use chrono::{DateTime, Utc};
 use lemmy_api_common::{
   context::LemmyContext,
-  utils::{local_site_opt_to_slur_regex, process_markdown},
+  utils::{is_mod_or_admin, local_site_opt_to_slur_regex, process_markdown},
 };
 use lemmy_db_schema::{
   source::{
@@ -142,7 +142,11 @@ impl Object for ApubComment {
     verify_is_remote_object(note.id.inner(), context.settings())?;
     verify_person_in_community(&note.attributed_to, &community, context).await?;
     let (post, _) = note.get_parents(context).await?;
-    if post.locked {
+    let creator = note.attributed_to.dereference(context).await?;
+    let is_mod_or_admin = is_mod_or_admin(&mut context.pool(), &creator, community.id)
+      .await
+      .is_ok();
+    if post.locked && !is_mod_or_admin {
       Err(LemmyErrorType::PostIsLocked)?
     } else {
       Ok(())