[aur-dev] [PATCH] Make deleted comments visible to Trusted Users
This allows Trusted Users to check whether a user posted a politically incorrect comment, even if he already deleted it. Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de> --- web/html/css/aur.css | 4 ++++ web/lib/credentials.inc.php | 2 ++ web/lib/pkgbasefuncs.inc.php | 20 ++++++++++++++------ web/lib/pkgfuncs.inc.php | 3 ++- web/template/pkg_comments.php | 12 ++++++++---- 5 files changed, 30 insertions(+), 11 deletions(-) diff --git a/web/html/css/aur.css b/web/html/css/aur.css index 9435e22..654116a 100644 --- a/web/html/css/aur.css +++ b/web/html/css/aur.css @@ -68,3 +68,7 @@ padding: 0; border: none; } + +.comment-deleted { + color: #999; +} diff --git a/web/lib/credentials.inc.php b/web/lib/credentials.inc.php index 47dd3fd..efc203d 100644 --- a/web/lib/credentials.inc.php +++ b/web/lib/credentials.inc.php @@ -7,6 +7,7 @@ define("CRED_ACCOUNT_EDIT_DEV", 3); define("CRED_ACCOUNT_LAST_LOGIN", 4); define("CRED_ACCOUNT_SEARCH", 5); define("CRED_COMMENT_DELETE", 6); +define("CRED_COMMENT_VIEW_DELETED", 22); define("CRED_PKGBASE_ADOPT", 7); define("CRED_PKGBASE_CHANGE_CATEGORY", 8); define("CRED_PKGBASE_DELETE", 9); @@ -55,6 +56,7 @@ function has_credential($credential, $approved_users=array()) { case CRED_ACCOUNT_LAST_LOGIN: case CRED_ACCOUNT_SEARCH: case CRED_COMMENT_DELETE: + case CRED_COMMENT_VIEW_DELETED: case CRED_PKGBASE_ADOPT: case CRED_PKGBASE_CHANGE_CATEGORY: case CRED_PKGBASE_DELETE: diff --git a/web/lib/pkgbasefuncs.inc.php b/web/lib/pkgbasefuncs.inc.php index 0d6b22b..cf0b09b 100644 --- a/web/lib/pkgbasefuncs.inc.php +++ b/web/lib/pkgbasefuncs.inc.php @@ -25,10 +25,11 @@ function pkgbase_categories() { * Get the number of non-deleted comments for a specific package base * * @param string $base_id The package base ID to get comment count for + * @param bool $include_deleted True if deleted comments should be included * * @return string The number of comments left for a specific package */ -function pkgbase_comments_count($base_id) { +function pkgbase_comments_count($base_id, $include_deleted) { $base_id = intval($base_id); if (!$base_id) { return null; @@ -37,7 +38,9 @@ function pkgbase_comments_count($base_id) { $dbh = DB::connect(); $q = "SELECT COUNT(*) FROM PackageComments "; $q.= "WHERE PackageBaseID = " . $base_id . " "; - $q.= "AND DelUsersID IS NULL"; + if (!$include_deleted) { + $q.= "AND DelUsersID IS NULL"; + } $result = $dbh->query($q); if (!$result) { return null; @@ -51,10 +54,11 @@ function pkgbase_comments_count($base_id) { * * @param int $base_id The package base ID to get comments for * @param int $limit Maximum number of comments to return (0 means unlimited) + * @param bool $include_deleted True if deleted comments should be included * * @return array All package comment information for a specific package base */ -function pkgbase_comments($base_id, $limit) { +function pkgbase_comments($base_id, $limit, $include_deleted) { $base_id = intval($base_id); $limit = intval($limit); if (!$base_id) { @@ -63,10 +67,13 @@ function pkgbase_comments($base_id, $limit) { $dbh = DB::connect(); $q = "SELECT PackageComments.ID, UserName, UsersID, Comments, "; - $q.= "CommentTS FROM PackageComments LEFT JOIN Users "; + $q.= "CommentTS, DelUsersID FROM PackageComments LEFT JOIN Users "; $q.= "ON PackageComments.UsersID = Users.ID "; $q.= "WHERE PackageBaseID = " . $base_id . " "; - $q.= "AND DelUsersID IS NULL ORDER BY CommentTS DESC"; + if (!$include_deleted) { + $q.= "AND DelUsersID IS NULL "; + } + $q.= "ORDER BY CommentTS DESC"; if ($limit > 0) { $q.=" LIMIT " . $limit; } @@ -242,7 +249,8 @@ function pkgbase_display_details($base_id, $row, $SID="") { } $limit = isset($_GET['comments']) ? 0 : 10; - $comments = pkgbase_comments($base_id, $limit); + $include_deleted = has_credential(CRED_COMMENT_VIEW_DELETED); + $comments = pkgbase_comments($base_id, $limit, $include_deleted); if (!empty($comments)) { include('pkg_comments.php'); } diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index 8c2a67d..69b1c94 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -436,7 +436,8 @@ function pkg_display_details($id=0, $row, $SID="") { } $limit = isset($_GET['comments']) ? 0 : 10; - $comments = pkgbase_comments($base_id, $limit); + $include_deleted = has_credential(CRED_COMMENT_VIEW_DELETED); + $comments = pkgbase_comments($base_id, $limit, $include_deleted); if (!empty($comments)) { include('pkg_comments.php'); } diff --git a/web/template/pkg_comments.php b/web/template/pkg_comments.php index 9961554..3e99d9b 100644 --- a/web/template/pkg_comments.php +++ b/web/template/pkg_comments.php @@ -6,7 +6,8 @@ if (isset($row['BaseID'])) { /* On a package base details page. */ $base_id = $row['ID']; } -$count = pkgbase_comments_count($base_id); +$include_deleted = has_credential(CRED_COMMENT_VIEW_DELETED); +$count = pkgbase_comments_count($base_id, $include_deleted); ?> <div id="news"> <h3> @@ -18,8 +19,8 @@ $count = pkgbase_comments_count($base_id); <?php if ($row['UserName'] && $SID): $row['UserName'] = "<a href=\"" . get_user_uri($row['UserName']) . "\">{$row['UserName']}</a>"; endif; ?> - <h4> - <?php if (can_delete_comment_array($row)): ?> + <h4<?php if ($row['DelUsersID']): ?> class="comment-deleted"<?php endif; ?>> + <?php if (!$row['DelUsersID'] && can_delete_comment_array($row)): ?> <form method="post" action="<?= htmlspecialchars(get_pkgbase_uri($pkgbase_name), ENT_QUOTES); ?>"> <fieldset style="display:inline;"> <input type="hidden" name="action" value="do_DeleteComment" /> @@ -39,10 +40,13 @@ $count = pkgbase_comments_count($base_id); <?php else: ?> <?= __('Anonymous comment') ?> <?php endif; ?> + <?php if ($row['DelUsersID']): ?> + (<?= __('deleted') ?>) + <?php endif; ?> <?php endif; ?> </h4> <p class="timestamp"><?= gmdate('Y-m-d H:i', $row['CommentTS']) ?></p> - <div class="article-content"> + <div class="article-content<?php if ($row['DelUsersID']): ?> comment-deleted<?php endif; ?>"> <p> <?= parse_comment($row['Comments']) ?> </p> -- 2.0.2
On 2014-07-25 11:31 +0200 Lukas Fleischer wrote:
This allows Trusted Users to check whether a user posted a politically incorrect comment, even if he already deleted it.
Why keep "deleted" comments? How long are they kept?
On 2014-07-25 19:49 +0200 Lukas Fleischer wrote:
On Fri, 25 Jul 2014 at 18:42:22, Xyne wrote:
On 2014-07-25 11:31 +0200 Lukas Fleischer wrote:
This allows Trusted Users to check whether a user posted a politically incorrect comment, even if he already deleted it.
Why keep "deleted" comments? How long are they kept?
Yes. Forever.
Is there some technical reason for not deleting comments? If not, please (re)consider actually deleting them. Keeping them is simultaneously a waste of bits and a bit creepy.
On Sat, 26 Jul 2014 at 15:39:13, Xyne wrote:
On 2014-07-25 19:49 +0200 Lukas Fleischer wrote:
On Fri, 25 Jul 2014 at 18:42:22, Xyne wrote:
On 2014-07-25 11:31 +0200 Lukas Fleischer wrote:
This allows Trusted Users to check whether a user posted a politically incorrect comment, even if he already deleted it.
Why keep "deleted" comments? How long are they kept?
Yes. Forever.
Is there some technical reason for not deleting comments? If not, please (re)consider actually deleting them. Keeping them is simultaneously a waste of bits and a bit creepy.
Obviously, there is no way to check whether a user insulted someone else (or misbehaved in some other way) and deleted the comments afterwards if we remove them immediately. Some users even suggested to drop the comment deletion feature [1], although for slightly different reasons. I personally think it is fine to keep deleted comments and only show them to Trusted Users -- they are trusted after all. Regarding the "waste of bits" argument, I would have guessed that the amount of deleted comments is negligibly small but it turns out that these comments account for ~10% of all AUR comments. So maybe we should clean them up occasionally? [1] https://bugs.archlinux.org/task/14840
So maybe we should clean them up occasionally?
Makes sense. A TU's hardly going to receive complaints about abuse 12 -- or even 6 -- months after the incident. -- David Phillips GPG Key 0x7BF3D17D0884BF5B Fingerprint 2426 235A 7831 AA2F 56AF 4BC0 7BF3 D17D 0884 BF5B
On 2014-07-27 11:29 +1200 David Phillips wrote:
So maybe we should clean them up occasionally?
Makes sense. A TU's hardly going to receive complaints about abuse 12 -- or even 6 -- months after the incident.
Even 3 months would be enough to report abuse. Alternatively, add a "report abuse" button that stores a copy of the comment. It can then be reviewed even if the original comment is deleted. The copy can be deleted when the report is closed (or after some interval). This would also be less tedious than scanning through all the duplicate comments posted due to the absence of an edit function.
On 2014-07-27 11:29 +1200 David Phillips wrote:
So maybe we should clean them up occasionally? Makes sense. A TU's hardly going to receive complaints about abuse 12 -- or even 6 -- months after the incident. Even 3 months would be enough to report abuse.
Alternatively, add a "report abuse" button that stores a copy of the comment. It can then be reviewed even if the original comment is deleted. The copy can be deleted when the report is closed (or after some interval). This would also be less tedious than scanning through all the duplicate comments posted due to the absence of an edit function. I much prefer the idea of storing reported comments. This confirms that
On 2014-07-27 21:12, Xyne wrote: the comment was posted while not keeping deleted comments. Another option would be to allow a window in which comments can be deleted without penalty, then disallowing deletion after some threshold. TUs would still be able to delete comments then, but the users that posted them wouldn't. I don't like the idea of keeping deleted comments not because there's any useful/private information in them, but out of principle that you shouldn't keep content from a user that they chose to delete without a good reason to do so.
On Mon, 28 Jul 2014 at 09:29:53, Alex Charron wrote:
On 2014-07-27 21:12, Xyne wrote:
On 2014-07-27 11:29 +1200 David Phillips wrote:
So maybe we should clean them up occasionally? Makes sense. A TU's hardly going to receive complaints about abuse 12 -- or even 6 -- months after the incident. Even 3 months would be enough to report abuse.
Alternatively, add a "report abuse" button that stores a copy of the comment. It can then be reviewed even if the original comment is deleted. The copy can be deleted when the report is closed (or after some interval). This would also be less tedious than scanning through all the duplicate comments posted due to the absence of an edit function.
I am not sure about that. Users could delete their comment before anyone has a chance to report it and subscribers would still have the insult in their incoming mail. Then again, you could argue that the abuser could just as well have send a private email to everyone... Let me describe another scenario that happened: A package maintainer did not want to update a completely broken AUR package and told the users that the package is fine and that he won't do anything. After some discussion, one of the upset users filed an orphan request. Thereupon, the package maintainer deleted all of his comments, claiming that he would never have said something like that. And indeed, it was very hard to tell whether the maintainer replied to the comments or not (without having a look at the deleted ones). Would a "Report Abuse" button help here?
I much prefer the idea of storing reported comments. This confirms that the comment was posted while not keeping deleted comments. Another option would be to allow a window in which comments can be deleted without penalty, then disallowing deletion after some threshold. TUs would still be able to delete comments then, but the users that posted them wouldn't.
I don't like the idea of keeping deleted comments not because there's any useful/private information in them, but out of principle that you shouldn't keep content from a user that they chose to delete without a good reason to do so.
This contradicts itself. You want to give the user the freedom to delete their comments but on the other hand you disallow deleting comments after a short period of time. Right now, a user can (at any time) delete everything he posted in AUR comments so that only a very small group of trusted people (~50) will still be able to read it. When implementing the time window idea, everyone will be able to read the comments if you do not act quickly enough. Note that I will not change the comments deletion feature before the 3.4.0 release but I am open for suggestions and discussion. Maybe we can reach a consensus that allows us to close FS#14840 [1] and FS#34690 [2]. Regards, Lukas [1] https://bugs.archlinux.org/task/14840 [2] https://bugs.archlinux.org/task/34690
On 2014-07-28 11:10 +0200 Lukas Fleischer wrote:
I am not sure about that. Users could delete their comment before anyone has a chance to report it and subscribers would still have the insult in their incoming mail. Then again, you could argue that the abuser could just as well have send a private email to everyone...
In that case the email can be forwarded to a TU or to aur-general.
Let me describe another scenario that happened: A package maintainer did not want to update a completely broken AUR package and told the users that the package is fine and that he won't do anything. After some discussion, one of the upset users filed an orphan request. Thereupon, the package maintainer deleted all of his comments, claiming that he would never have said something like that. And indeed, it was very hard to tell whether the maintainer replied to the comments or not (without having a look at the deleted ones). Would a "Report Abuse" button help here?
A user could have reported a refusal to fix the broken package, yes. We could have a general "report" button, not just one for reporting verbal abuse against other users.
Note that I will not change the comments deletion feature before the 3.4.0 release but I am open for suggestions and discussion. Maybe we can reach a consensus that allows us to close FS#14840 [1] and FS#34690 [2].
[1] https://bugs.archlinux.org/task/14840 [2] https://bugs.archlinux.org/task/34690
If comments are delible then they should also be editable as both can disturb the flow on the page. Personally I'm not worried about the flow of comments on the page as it should be limited to packaging issues which in turn should be fixed as soon as there is a solution. I really think that comments should be both editable and delible. The AUR is not a collection of holy stone tablets to be preserved for all posterity nor should it chronicle the full history of every package. If that was its purpose then we would be crying out for more advanced commenting features (e.g. codeblocks, quotes). If some important data goes missing someone else will repost it. A report button would work well with editable comments (just store a copy of the actionable edit). Keeping previous versions alongside the current version would probably be more complicated. In either case, at some point we should expunge the old cruft. Persistent trolls will keep making trollish comments and reformed trolls can be ignored.
participants (4)
-
Alex Charron
-
David Phillips
-
Lukas Fleischer
-
Xyne