hopefully this will go over a bit better - check post owner permissions as well as local owner permissions for comments during submission, since the comment was being blindly accepted on the local system due to only checking the profile owner. Also change collections query to include only top-level posts by a member of the collection.

1 files changed, 9 insertions, 1 deletions

diff --git a/mod/item.php b/mod/item.php
index 895784ff9..2ebb02869 100644
--- a/mod/item.php
+++ b/mod/item.php
@@ -153,11 +153,19 @@ function item_post(&$a) {
 
 	}
 
+	$observer = $a->get_observer();
+
+
 	if($parent) {
 		logger('mod_item: item_post parent=' . $parent);
+		if(! can_comment_on_post($observer['xchan_hash'],$parent_item)) {
+			notice( t('Permission denied.') . EOL) ;
+			if(x($_REQUEST,'return')) 
+				goaway($a->get_baseurl() . "/" . $return_path );
+			killme();
+		}
 	}
 
-	$observer = $a->get_observer();
 
 	if(! perm_is_allowed($profile_uid,$observer['xchan_hash'],(($parent) ? 'post_comments' : 'post_wall'))) {
 		notice( t('Permission denied.') . EOL) ;