Hide replies to comments that have been spammed or aren't yet moderated

[jywarren]

It looks like replies to comments are not filtered for spam. We should see this message:

“Are you sure? The user will no longer be able to log in or publish, and their content will be hidden except comments.” seems wrong

Example of this happening: https://publiclab.org/notes/bhamster/09-02-2020/public-lab-virtual-event-on-all-things-microplastics

See this reply to a comment:

Instead it should have a message like this, which is working for regular comments (those that reply to a post, not another comment:

ISSUE

(This might be fixed by now...lets write a test to confirm that and fix any failures that may arise from the test):

Replies to comments aren’t filtering out spam comments. We use this replied_comments method in several places, so we may need to make this fix several times.

https://github.com/publiclab/plots2/search?q=replied_comments

We can't do it in the definition because it's actually an ActiveRecord relation, not a custom method we can add filters to:

plots2/app/models/comment.rb

Line 10 in 828321c

has_many :replied_comments, class_name: "Comment", foreign_key: 'reply_to', dependent: :destroy

We should filter out status = 0 in the definition of comment.replied_comments, and also for status = 4 show the message above.

Then, we ought to write some basic tests:

plots2/test/functional/comment_controller_test.rb

Lines 57 to 61 in 876d0fc

	test 'should create a replied comment' do
	UserSession.create(users(:bob))
	initial_count = comments(:first).replied_comments.count
	assert_difference 'Comment.count' do
	post :create, params: { id: nodes(:one).nid, body: '[notes:awesome]', reply_to: comments(:first) }, xhr: true

[noi5e]

This seems somewhat in my wheelhouse! I can break it down into sub-issues at a moment when I feel ahead of my work.

[cesswairimu]

I was testing this locally to break it to a ftos, it looks like the issue is already fixed. Could someone also confirm the same is the case on their end... @noi5e maybe you solved it somewhere in your project..

[noi5e]

@cesswairimu Hmm!! I think someone else did 😅

[noi5e]

@cesswairimu Someone could write a test for this, if I don't get to it? That's a little too complicated for an FTO, but I think writing tests can teach applicants a lot. Also maybe we shouldn't close this issue until a test is written

[cesswairimu]

@noi5e I agree, I will update this to be more of a test-writing issue. Thanks

[jywarren]

Hmm, i'm not sure -- maybe the test can come first to confirm if it's really fixed?

Because we can only filter upon usage, not in the has_many definition, it seems, and I don't see a .where.not(status: 0) on these:

plots2/app/views/notes/_comments.html.erb

Line 8 in ebf57e0

<% comments.includes([:replied_comments, :node]).order('timestamp ASC').each do |comment| %>

plots2/app/views/questions/show.html.erb

Line 69 in 4018744

<% comments.includes([:node, :replied_comments]).order("timestamp ASC").each do |comment| %>

plots2/app/views/notes/_comment.html.erb

Line 162 in ebf57e0

<% comment.replied_comments.order("timestamp ASC").each do |replied_comment| %>

What do you think?

Thanks, all!!! 💯

[jywarren]

ah and i guess on those includes() ones, it would have to be named, so maybe... .where('comments.status != 0') ?

Yes i think that's correct, see usage here:

plots2/app/models/node.rb

Line 1114 in 672d63a

comments.where('comments.status = 1 OR (comments.status = 4 AND comments.uid = ?)', user.uid)

[17sushmita]

@jywarren @cesswairimu @noi5e May I work on writing tests for this?

[noi5e]

@17sushmita Yes, definitely, please go ahead, that would be much appreciated!

[17sushmita]

It looks like replies to comments are not filtered for spam. We should see this message:

“Are you sure? The user will no longer be able to log in or publish, and their content will be hidden except comments.” seems wrong

@jywarren What does this mean by saying this message seems wrong? Is it not supposed to be displayed when moderator tries to mark the comment as spam? Kindly give a little more context to it.

[noi5e]

@17sushmita I'm a little confused by that too. I think maybe Jeffrey meant that text was appearing in yellow in the image below, instead of Moderate first-time comment? If so, that does seem wrong.

While we wait for clarification, you can still go ahead and write a test. I'm just going to post some suggestions here that might be helpful.

To start with, you can insert a spam/first-time-poster comment into the testing database that is a reply to another comment:

nodes(node_name).add_comment({
  uid: user_id,
  body: comment_text
  reply_to: parent_comment_id
  status: 0 # comment status: 0 for banned, 4 for first-time poster (a moderator has to approve the comment)
})

Then write the rest of the test from there, making sure that the method we use to retrieve comments isn't getting comment replies with status 0 or 4.

Something like that! You'll probably have to do some research. Definitely leave a comment here if you get stuck, or need some pointers for where to look in the codebase. We're here to help!

[17sushmita]

@noi5e , Thanks a lot for helping out 😃️!! I need one more clarification. Do I need to create a new file for comment reply tests or make changes in maybe /plots2/test/functional/admin_controller_test.rb or /plots2/test/system/spam2_test.rb or /plots2/test/functional/comment_controller_test.rb or any other file?

[noi5e]

@17sushmita I'm not 100% sure on this, but I'm thinking /test/functional/comment_controller_test.rb. The other place I was thinking was a unit test for comments. Thoughts from anyone else?

In the meantime, feel free to start working on this while we wait for others to weigh in.

[17sushmita]

@17sushmita I'm not 100% sure on this, but I'm thinking /test/functional/comment_controller_test.rb. The other place I was thinking was a unit test for comments. Thoughts from anyone else?

In the meantime, feel free to start working on this while we wait for others to weigh in.

Thanks, I started writing the tests, but one thing I observed is that even after marking the comment as spam, it does show up and according to the software it is correct because while marking it spam, it generates a warning as mentioned by @jywarren above "Are you sure? The user will no longer be able to log in or publish, and their content will be hidden except comments." but, is it really appropriate to display spam marked comments?🤔️

[noi5e]

is it really appropriate to display spam marked comments?🤔️

I don't think so!

This text you mention is pretty interesting:

"Are you sure? The user will no longer be able to log in or publish, and their content will be hidden except comments."

It makes me think that maybe back in the day, we didn't moderate comments. I think that piece of text is just outdated.

Whatever the case I think we all agree that we definitely should filter all comments! So we can avoid the spambots that @jywarren originally mentioned.

I just tested this locally, and to me it looks like this hasn't been fixed. We currently aren't filtering spam or first-time moderated comment REPLIES... Please keep in mind that regular comments (that are not REPLIES to other comments) are being filtered, so this just applies to replies. (I tested for comments that are NOT replies, and those are being moderated)

Going to break this down a little further. Locally, I created a fresh account, and posted a comment on a note. This is what I see when I post a comment. So far so good:

As a user, the "Pending approval by community moderators" message makes me think that my comment won't appear publicly.

However, the comment DOES appear publicly! When I visit the same note in an incognito window that's logged out of the site, the comment appears exactly as it appeared to user cisco:

Banning user cisco doesn't seem to change things much either. The "Pending approval" message disappears, but the comment is still viewable from an incognito window:

So yeah, this definitely needs to change.

@17sushmita Go ahead and keep working on this!

Also, if you haven't found it yet, we have a banned spammer user already created in /test/fixtures/users.yml

[17sushmita]

@noi5e That was a very clear explaination. I too tested very similarly on my local system and the results were the same which made me think so. So, I'll first work to remove the spam comments and then write test for it if it is fixed or not.

[noi5e]

As an aside, it looks like comment replies don't currently appear in admin's spam moderation dashboard:

And if user cisco posts a comment reply, it doesn't make them show up in Active Users:

Potential issue for the Outreachy spam moderation project mentioned in #9257?

[jywarren]

Thank you @17sushmita and @noi5e for so thoroughly unpacking this. My apologies for the unclear note in my original message but @noi5e is completely correct - we just need the simpler "Moderate first-time comment" message.

filtering spam or first-time moderated comment REPLIES

And great catch that still is unsolved for REPLIES.

Super appreciate all your help, both of you. 🎉

I'll note the spam dashboard issue in the new project description!!!

[17sushmita]

Hi @jywarren @noi5e, Sorry for asking again but I had one more confusion. Should we display a comment which is not spam but the user is banned? What to do in such cases?

[jywarren]

Yes, currently the status of banned users doesnt affect visibility of their comments. Thank you!

…

On Wed, Mar 24, 2021, 8:17 AM Sushmita ***@***.***> wrote: Hi @jywarren <https://github.com/jywarren> @noi5e <https://github.com/noi5e>, Sorry for asking again but I had one more confusion. Should we display a comment which is not spam but the user is banned? What to do in such cases? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#8854 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAF6J4WSMFWF64K72GXR5TTFHJ6NANCNFSM4U4TWDIQ> .

[TildaDares]

As an aside, it looks like comment replies don't currently appear in admin's spam moderation dashboard:

And if user cisco posts a comment reply, it doesn't make them show up in Active Users:

Potential issue for the Outreachy spam moderation project mentioned in #9257?

@noi5e I can't reproduce the comment replies issue locally. I logged in as a new user, made a comment reply, logged out and then logged in as admin and then I marked the comment reply as spam. I went to the spam moderation page and I found the comment reply under comments.

Is there something I'm missing?

[jcads]

Hi @TildaDares, i believe this issue has been fixed in #9381

[TildaDares]

Thanks @jcads