halo-dev/halo · error · AccessDeniedException

problemDetail.comment.systemUsersOnly

problemDetail.comment.systemUsersOnly

Error message

Allow only system users to comment.

What it means

Thrown as an AccessDeniedException (HTTP 403) with code 'problemDetail.comment.systemUsersOnly' during CommentFinderEndpoint.createReply when commentSetting.systemUserOnly is enabled and checkReplyOwner(reply, true) indicates the reply author is not a system (registered) user. The setting restricts commenting to authenticated system users.

Source

Thrown at application/src/main/java/run/halo/app/core/endpoint/theme/CommentFinderEndpoint.java:180

    Mono<ServerResponse> createReply(ServerRequest request) {
        String commentName = request.pathVariable("name");
        return request.bodyToMono(ReplyRequest.class)
                .flatMap(replyRequest -> {
                    Reply reply = replyRequest.toReply();
                    reply.getSpec().setIpAddress(IpAddressUtils.getIpAddress(request));
                    reply.getSpec().setUserAgent(HaloUtils.userAgentFrom(request));
                    return environmentFetcher
                            .fetchComment()
                            .map(commentSetting -> {
                                if (isFalse(commentSetting.getEnable())) {
                                    throw new AccessDeniedException(
                                            "The comment function has been turned off.",
                                            "problemDetail.comment.turnedOff",
                                            null);
                                }
                                if (checkReplyOwner(reply, commentSetting.getSystemUserOnly())) {
                                    throw new AccessDeniedException(
                                            "Allow only system users to comment.",
                                            "problemDetail.comment.systemUsersOnly",
                                            null);
                                }
                                reply.getSpec().setApproved(isFalse(commentSetting.getRequireReviewForNew()));

                                if (reply.getSpec().getHidden() == null) {
                                    reply.getSpec().setHidden(false);
                                }

                                return reply;
                            })
                            .defaultIfEmpty(reply);
                })
                .flatMap(reply -> replyService.create(commentName, reply))
                .flatMap(comment -> ServerResponse.ok().bodyValue(comment))
                .transformDeferred(createIpBasedRateLimiter(request))
                .onErrorMap(RequestNotPermitted.class, RateLimitExceededException::new);

View on GitHub (pinned to d2f5165f9c)

Solutions

  1. Have the visitor log in as a registered system user before replying.
  2. If guest commenting is intended, have an admin disable the 'system users only' comment setting.
  3. Gate the reply form in the theme on the current user's authenticated status when the setting is on, and surface code 'problemDetail.comment.systemUsersOnly' as a localized message.

Example fix

// before: guest clicks reply -> 403
// after:  theme hides form for anonymous users when systemUserOnly is on, or user logs in first
Defensive patterns

Strategy: validation

Validate before calling

// only show the reply form to system users when systemUserOnly is on
boolean systemUserOnly = commentSetting.systemUserOnly;
if (systemUserOnly && !currentUser.isAuthenticated()) {
    showInfo("Log in to comment.");
    return;
}

Try / catch

// handle the 403 with code problemDetail.comment.systemUsersOnly
try {
    commentApi.createReply(...);
} catch (AccessDeniedException e) {
    if ("problemDetail.comment.systemUsersOnly".equals(e.getCode())) {
        promptLogin();
    } else throw e;
}

Prevention

When it happens

Trigger: POST to the theme comment reply endpoint when CommentSetting.systemUserOnly = true and the requester is anonymous/guest (reply owner is not a registered system user).

Common situations: Admin enabled 'system users only' commenting; a guest visitor tries to reply; the front-end form was shown to a logged-out user; email-based guest commenting was expected but the setting forbids it.

Related errors

AI-assisted analysis of halo-dev/halo@d2f5165f9c (2026-08-14). Data as JSON: /api/errors/7bf274179fe554e4. Report an issue: GitHub.