{"record":{"id":"7bf274179fe554e4","repo":"halo-dev/halo","slug":"problemdetail-comment-systemusersonly","errorCode":"problemDetail.comment.systemUsersOnly","errorMessage":"Allow only system users to comment.","messagePattern":"Allow only system users to comment\\.","errorType":"http","errorClass":"AccessDeniedException","httpStatus":403,"severity":"error","filePath":"application/src/main/java/run/halo/app/core/endpoint/theme/CommentFinderEndpoint.java","lineNumber":180,"sourceCode":"\n    Mono<ServerResponse> createReply(ServerRequest request) {\n        String commentName = request.pathVariable(\"name\");\n        return request.bodyToMono(ReplyRequest.class)\n                .flatMap(replyRequest -> {\n                    Reply reply = replyRequest.toReply();\n                    reply.getSpec().setIpAddress(IpAddressUtils.getIpAddress(request));\n                    reply.getSpec().setUserAgent(HaloUtils.userAgentFrom(request));\n                    return environmentFetcher\n                            .fetchComment()\n                            .map(commentSetting -> {\n                                if (isFalse(commentSetting.getEnable())) {\n                                    throw new AccessDeniedException(\n                                            \"The comment function has been turned off.\",\n                                            \"problemDetail.comment.turnedOff\",\n                                            null);\n                                }\n                                if (checkReplyOwner(reply, commentSetting.getSystemUserOnly())) {\n                                    throw new AccessDeniedException(\n                                            \"Allow only system users to comment.\",\n                                            \"problemDetail.comment.systemUsersOnly\",\n                                            null);\n                                }\n                                reply.getSpec().setApproved(isFalse(commentSetting.getRequireReviewForNew()));\n\n                                if (reply.getSpec().getHidden() == null) {\n                                    reply.getSpec().setHidden(false);\n                                }\n\n                                return reply;\n                            })\n                            .defaultIfEmpty(reply);\n                })\n                .flatMap(reply -> replyService.create(commentName, reply))\n                .flatMap(comment -> ServerResponse.ok().bodyValue(comment))\n                .transformDeferred(createIpBasedRateLimiter(request))\n                .onErrorMap(RequestNotPermitted.class, RateLimitExceededException::new);","sourceCodeStart":162,"sourceCodeEnd":198,"githubUrl":"https://github.com/halo-dev/halo/blob/d2f5165f9c8f055ffcb3fa9c3f4032821a7b68c8/application/src/main/java/run/halo/app/core/endpoint/theme/CommentFinderEndpoint.java#L162-L198","documentation":"Thrown as an AccessDeniedException (HTTP 403) with code 'problemDetail.comment.systemUsersOnly' during CommentFinderEndpoint.createReply when commentSetting.systemUserOnly is enabled and checkReplyOwner(reply, true) indicates the reply author is not a system (registered) user. The setting restricts commenting to authenticated system users.","triggerScenarios":"POST to the theme comment reply endpoint when CommentSetting.systemUserOnly = true and the requester is anonymous/guest (reply owner is not a registered system user).","commonSituations":"Admin enabled 'system users only' commenting; a guest visitor tries to reply; the front-end form was shown to a logged-out user; email-based guest commenting was expected but the setting forbids it.","solutions":["Have the visitor log in as a registered system user before replying.","If guest commenting is intended, have an admin disable the 'system users only' comment setting.","Gate the reply form in the theme on the current user's authenticated status when the setting is on, and surface code 'problemDetail.comment.systemUsersOnly' as a localized message."],"exampleFix":"// before: guest clicks reply -> 403\n// after:  theme hides form for anonymous users when systemUserOnly is on, or user logs in first","handlingStrategy":"validation","validationCode":"// only show the reply form to system users when systemUserOnly is on\nboolean systemUserOnly = commentSetting.systemUserOnly;\nif (systemUserOnly && !currentUser.isAuthenticated()) {\n    showInfo(\"Log in to comment.\");\n    return;\n}","typeGuard":null,"tryCatchPattern":"// handle the 403 with code problemDetail.comment.systemUsersOnly\ntry {\n    commentApi.createReply(...);\n} catch (AccessDeniedException e) {\n    if (\"problemDetail.comment.systemUsersOnly\".equals(e.getCode())) {\n        promptLogin();\n    } else throw e;\n}","preventionTips":["Gate the reply form on authentication when systemUserOnly is enabled.","Prompt login on the systemUsersOnly code."],"tags":["comment","access-denied","configuration","i18n","authentication"],"backgroundTag":null,"analyzedSha":"d2f5165f9c8f055ffcb3fa9c3f4032821a7b68c8","analyzedAt":"2026-08-14T00:18:38.915Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}