Only admin should have right to edit any comment

[camlafit]

Gitea Version

1.14.1

edited by team members to hide irrelevant information

Description

On organization we have create a team with write permission on repository. Any user in this team can edit any issue comment .

Edition should be move to "administrator access" to prevent any security issue

[wxiaoguang]

Is the behavior the same as GitHub? For example, as a team member, I can edit your comment (I added **edited by team members to hide irrelevant information**)

[JLuc]

I dont see your **edited by team members to hide irrelevant information** edit anywhere except in your own post. Did you mean you edited #17585 (comment) ? There is no such edit in cam's post.

I have edited your original post, including this one -- by wxiaoguang

[wxiaoguang]

[JLuc]

yep. Well i can't do the same.

[lunny]

On a team, if you remove the write permission to issue/pullrequest unit, the team members will not have the permission to edit the comments.

[camlafit]

Hello

Indeed if we disable issues/Pull request right we lost comment edit option. But we lost also some other behavior as manage tag, milestone, ....

If user as write permission looks logic to also edit tag, milestone to qualify code contribution. But edit comment from other contributors looks a bit different.

Should be better to move this behavior "edit comment" if use has admin permission.

[zeripath]

As a non-admin but maintainer of this project - I frequently use my comment editing power to fix up rendering problems in other people's comments, rename issues and pulls, and to make the pull request initial comments closer to what was pulled.

It may seem like putting words into other people's mouths but I think this kind of editing functionality is important. The comments on an issue or PR are not an audit of what was said - they're a form of documentation.

[camlafit]

Hello

Yes I see this use case. In our use case we have a different logic. We want allow default contribution on some organization and we allow write permission.
But editing comment looks a bit too important, with as you said " putting words into other people's mouths" and we want preserve this.

Looks possible in this case to propose a sub option to allow/restrict message edition ? Then we will manage these two use case ?

[lunny]

Issue unit permission is not the same as Code. With read permission of unit Issue/PullRequest, team members could post issue and post comment but cannot edit comment. With write permission of unit Issue/PullRequest, team members could edit issues/comments. I want to know why you want to give all members of org write permission of unit issue/pullrequest.

[camlafit]

Hello

We have a collaborative forge where peer can approve PR/MR/commit on same repository. Then we have open enable write contribution but we don't want user rewrite collaborator content as issue comment.

For example at https://git.spip.net/spip-contrib-extensions all account are set to contrib team. Then all could contribute as any peer but should not be admin (as in this case edit other comment )

[fnordsh]

One way to mitigate this issue would be an edit history like GitHub has. I would be okay with other people editing my comments if these edits are documented and attributable.
Come to think of it, I want this in any case.

[fnordsh]

@lunny

Issue unit permission is not the same as Code. With read permission of unit Issue/PullRequest, team members could post issue and post comment but cannot edit comment. With write permission of unit Issue/PullRequest, team members could edit issues/comments. I want to know why you want to give all members of org write permission of unit issue/pullrequest.

Could you explain how I can allow a group of people to push code, but only post/read issues?

[fnordsh]

@zeripath

As a non-admin but maintainer of this project - I frequently use my comment editing power to fix up rendering problems in other people's comments, rename issues and pulls, and to make the pull request initial comments closer to what was pulled.

It may seem like putting words into other people's mouths but I think this kind of editing functionality is important. The comments on an issue or PR are not an audit of what was said - they're a form of documentation.

Maybe a moderator role would be the right thing for this use case. (But even if editing is restricted to moderators and admins, I still think there should be an indicator that the comment has been edited, and by whom.)

[lunny]

It seems one team cannot implement it. You have to have two teams. One team for people who could push code, another for post/read issues.

[fnordsh]

Thank you! For my current use case this is a feasible workaround, although I don't think this would scale well.
TBH, I find Giteas permission model a bit weird - giving a team the same permissions to every repository it is assigned to seems counter-intuitive to me. Maybe I should read up on the reasoning behind this.

[lunny]

This could be resolved by #16859

[camlafit]

Hello

Yes could be optimized by this issue. 👍 But looks as a big job on long time.

Waiting this evolve is it possible to provide any work around ?

[gmingen]

@camlafit See @lunny's comment above. It's not pretty, but it does work for me.

[lunny]

@camlafit @gmingen I sent a PR #17811 and I think it could be merged into v1.16.