Update with today's changes

[ikiwiki.git] / doc / plugins / contrib / comments.mdwn

diff --git a/doc/plugins/contrib/comments.mdwn b/doc/plugins/contrib/comments.mdwn
index 0957e74fa7f014ebeedf30097bf30ed7fe900eaa..a7a509ebb2b1f614f60f6b9617f42afffaada6d0 100644 (file)
--- a/doc/plugins/contrib/comments.mdwn
+++ b/doc/plugins/contrib/comments.mdwn
@@ -5,97 +5,11 @@ This plugin adds "blog-style" comments. The intention is that on a non-wiki site
 (like a blog) you can lock all pages for admin-only access, then allow otherwise
 unprivileged (or perhaps even anonymous) users to comment on posts.
 
 (like a blog) you can lock all pages for admin-only access, then allow otherwise
 unprivileged (or perhaps even anonymous) users to comment on posts.
 

-Comments are saved as internal pages, so they can never be edited through the CGI,
-only by direct committers. Currently, comments are always in [[ikiwiki/markdown]].
-
-> So, why do it this way, instead of using regular wiki pages in a
-> namespace, such as `$page/comments/*`? Then you could use [[plugins/lockedit]] to
-> limit editing of comments in more powerful ways. --[[Joey]]
-
->> Er... I suppose so. I'd assumed that these pages ought to only exist as inlines
->> rather than as individual pages (same reasoning as aggregated posts), though.
->>
->> lockedit is actually somewhat insufficient, since `check_canedit()`
->> doesn't distinguish between creation and editing; I'd have to continue to use
->> some sort of odd hack to allow creation but not editing.
->>
->> I also can't think of any circumstance where you'd want a user other than
->> admins (~= git committers) and possibly the commenter (who we can't check for
->> at the moment anyway, I don't think?) to be able to edit comments - I think
->> user expectations for something that looks like ordinary blog comments are
->> likely to include "others can't put words into my mouth".
->>
->> My other objection to using a namespace is that I'm not particularly happy about
->> plugins consuming arbitrary pieces of the wiki namespace - /discussion is bad
->> enough already. Indeed, this very page would accidentally get matched by rules
->> aiming to control comment-posting... :-) --[[smcv]]
-
->> The best reason to keep the pages internal seems to me to be that you
->> don't want the overhead of every comment spawning its own wiki page.
->> The worst problem with it though is that you have to assume the pages
->> are mdwn (or `default_pageext`) and not support other formats.
-
->> By the way, I think that who can post comments should be controllable by
->> the existing plugins opendiscussion, anonok, signinedit, and lockedit. Allowing
->> posting comments w/o any login, while a nice capability, can lead to
->> spam problems. So, use `check_canedit` as at least a first-level check?
->> --[[Joey]]
-

 When using this plugin, you should also enable [[htmlscrubber]] and either [[htmltidy]]
 or [[htmlbalance]]. Directives are filtered out by default, to avoid commenters slowing
 down the wiki by causing time-consuming processing. As long as the recommended plugins
 are enabled, comment authorship should hopefully be unforgeable by CGI users.
 
 When using this plugin, you should also enable [[htmlscrubber]] and either [[htmltidy]]
 or [[htmlbalance]]. Directives are filtered out by default, to avoid commenters slowing
 down the wiki by causing time-consuming processing. As long as the recommended plugins
 are enabled, comment authorship should hopefully be unforgeable by CGI users.
 

-> I'm not sure that raw html should be a problem, as long as the
-> htmlsanitizer and htmlbalanced plugins are enabled. I can see filtering
-> out directives, as a special case. --[[Joey]]
-
->> Right, if I sanitize each post individually, with htmlscrubber and either htmltidy
->> or htmlbalance turned on, then there should be no way the user can forge a comment;
->> I was initially wary of allowing meta directives, but I think those are OK, as long
->> as the comment template puts the \[[!meta author]] at the *end*. Disallowing
->> directives is more a way to avoid commenters causing expensive processing than
->> anything else, at this point.
->>
->> I've rebased the plugin on master, made it sanitize individual posts' content
->> and removed the option to disallow raw HTML. --[[smcv]]
-
->> There might be some use cases for other directives, such as img, in
->> comments.
->> 
->> I don't know if meta is "safe" (ie, guaranteed to be inexpensive and not
->> allow users to do annoying things) or if it will continue to be in the
->> future. Hard to predict really, all that can be said with certainty is
->> all directives will contine to be inexpensive and safe enough that it's
->> sensible to allow users to (ab)use them on open wikis.
->> --[[Joey]]
-
-When comments have been enabled generally, you still need to mark which pages
-can have comments, by including the `\[[!comments]]` directive in them. By default,
-this directive expands to a "post a comment" link plus an `\[[!inline]]` with
-the comments.
-
-> I don't like this, because it's hard to explain to someone why they have
-> to insert this into every post to their blog. Seems that the model used
-> for discussion pages could work -- if comments are enabled, automatically
-> add the comment posting form and comments to the end of each page.
-> --[[Joey]]
-
->> I don't think I'd want comments on *every* page (particularly, not the
->> front page). Perhaps a pagespec in the setup file, where the default is "*"?
->> Then control freaks like me could use "link(tags/comments)" and tag pages
->> as allowing comments.
->>
->>> Yes, I think a pagespec is the way to go. --[[Joey]]
->> 
->> The model used for discussion pages does require patching the existing
->> page template, which I was trying to avoid - I'm not convinced that having
->> every possible feature hard-coded there really scales (and obviously it's
->> rather annoying while this plugin is on a branch). --[[smcv]]
-
->>> Using the template would allow customising the html around the comments
->>> which seems like a good thing?
-

 The plugin adds a new [[ikiwiki/PageSpec]] match type, `postcomment`, for use
 with `anonok_pagespec` from the [[plugins/anonok]] plugin or `locked_pages` from
 the [[plugins/lockedit]] plugin. Typical usage would be something like:
 The plugin adds a new [[ikiwiki/PageSpec]] match type, `postcomment`, for use
 with `anonok_pagespec` from the [[plugins/anonok]] plugin or `locked_pages` from
 the [[plugins/lockedit]] plugin. Typical usage would be something like:


@@ -108,34 +22,62 @@ to allow non-admin users to comment on pages, but not edit anything. You can als
 
 to allow anonymous comments (the IP address will be used as the "author").
 
 
 to allow anonymous comments (the IP address will be used as the "author").
 

-> This is still called postcomment, although I've renamed the rest of the plugin
-> to comments as suggested on #ikiwiki --[[smcv]]
-
-Optional parameters to the comments directive:
-
-* `commit=no`: by default, comments are committed to version control. Use this to
-  disable commits.
-* `allowdirectives=yes`: by default, IkiWiki directives are filtered out. Use this
-  to allow directives (avoid enabling any [[plugins/type/slow]] directives if you
-  do this).
-* `closed=yes`: use this to prevent new comments while still displaying existing ones.
-* `atom`, `rss`, `feeds`, `feedshow`, `timeformat`, `feedonly`: the same as for [[plugins/inline]]
+There are some global options for the setup file:
+
+* `comments_shown_pagespec`: pages where comments will be displayed inline, e.g. `blog/*`
+  or `*/discussion`.
+* `comments_open_pagespec`: pages where new comments can be posted, e.g.
+  `blog/* and created_after(close_old_comments)` or `*/discussion`
+* `comments_pagename`: if this is e.g. `comment_` (the default), then comments on the
+  [[sandbox]] will be called something like `sandbox/comment_12`
+* `comments_allowdirectives`: if true (default false), comments may contain IkiWiki
+  directives
+* `comments_commit`: if true (default true), comments will be committed to the version
+  control system
+* `comments_allowauthor`: if true (default false), anonymous commenters may specify a
+  name for themselves, and the \[[!meta author]] and \[[!meta authorurl]] directives
+  will not be overridden by the comments plugin
+
+Templates that will display comments (by default that means `comments_display.tmpl`)
+can use the following additional `<TMPL_VAR>`s:
+
+* `COMMENTUSER`: the authenticated/verified user name, or undefined if the user was not signed in
+* `COMMENTIP`: the remote IP address, or undefined if not known (this is not currently recorded
+  for users who are signed in, who are assumed to be vaguely accountable)
+* `COMMENTAUTHOR`: a "prettier" version of the authenticated/verified user name (e.g. OpenIDs are
+  formatted the same way as in [[RecentChanges]]), or the result of localizing "Anonymous" if the
+  user was not signed in
+* `COMMENTAUTHORURL`: if the user was signed in with an OpenID, that URL; if the user was signed
+  in with some other username, a CGI URL that redirects to their user page (if any)
+
+This plugin also adds a `\[[!comment]]` directive which is used when storing comments. This
+directive shouldn't be used on pages that are edited in the usual way.

 
 This plugin aims to close the [[todo]] item "[[todo/supporting_comments_via_disussion_pages]]",
 and is currently available from [[smcv]]'s git repository on git.pseudorandom.co.uk (it's the
 
 This plugin aims to close the [[todo]] item "[[todo/supporting_comments_via_disussion_pages]]",
 and is currently available from [[smcv]]'s git repository on git.pseudorandom.co.uk (it's the

-`postcomment` branch). A demo wiki with the plugin enabled is running at
+`comments-rebase1` branch). A demo wiki with the plugin enabled is running at

 <http://www.pseudorandom.co.uk/2008/ikiwiki/demo/>.
 
 Known issues:
 
 * Needs code review
 <http://www.pseudorandom.co.uk/2008/ikiwiki/demo/>.
 
 Known issues:
 
 * Needs code review

-* The access control via postcomment() is rather strange
+* The access control via postcomment() is rather strange (see [[discussion]] for more details)

 * There is some common code cargo-culted from other plugins (notably inline and editpage) which
   should probably be shared
 * There is some common code cargo-culted from other plugins (notably inline and editpage) which
   should probably be shared

-* If the comments directive is removed from a page, comments can still be made on that page,
-  and will be committed but not displayed; to disable comments properly you have to set the
-  closed="yes" directive parameter (and refresh the wiki), *then* remove the directive if
-  desired
+* Joey doesn't think it should necessarily use internal pages (see [[discussion]])
+* `\[[!comment]]` should perhaps be `\[[!_comment]], or a special filter/htmlize hook rather
+  than being a directive at all

 
 > I haven't done a detailed code review, but I will say I'm pleased you
 > avoided re-implementing inline! --[[Joey]]
 
 > I haven't done a detailed code review, but I will say I'm pleased you
 > avoided re-implementing inline! --[[Joey]]

+
+Fixed issues:
+
+* Joey didn't think the `\[[!comments]]` directive was appropriate; comments now appear
+  on pages selected with a [[ikiwiki/pagespec]]
+* Joey thought that raw HTML should always be allowed; it now is
+* tbm wanted anonymous people to be able to enter their name and possibly email
+  address; a name and website can now be supplied
+* There is now an indication of who you're signed in as
+* Each comment is now one big \[[!comment]] directive invocation, avoiding previous
+  issues with unambiguous and un-spoofable metadata