halo-dev/halo · error · AccessDeniedException

problemDetail.comment.turnedOff

problemDetail.comment.turnedOff

Error message

The comment function has been turned off.

What it means

Thrown as an AccessDeniedException (HTTP 403) with code 'problemDetail.comment.turnedOff' during CommentFinderEndpoint.createReply. Before persisting a reply, the endpoint fetches comment settings; if commentSetting.enable is false, replies are refused. This is a configuration gate, not an authentication failure.

Source

Thrown at application/src/main/java/run/halo/app/core/endpoint/theme/CommentFinderEndpoint.java:174

    private <T> RateLimiterOperator<T> createIpBasedRateLimiter(ServerRequest request) {
        var clientIp = IpAddressUtils.getIpAddress(request);
        var rateLimiter = rateLimiterRegistry.rateLimiter("comment-creation-from-ip-" + clientIp, "comment-creation");
        return RateLimiterOperator.of(rateLimiter);
    }

    Mono<ServerResponse> createReply(ServerRequest request) {
        String commentName = request.pathVariable("name");
        return request.bodyToMono(ReplyRequest.class)
                .flatMap(replyRequest -> {
                    Reply reply = replyRequest.toReply();
                    reply.getSpec().setIpAddress(IpAddressUtils.getIpAddress(request));
                    reply.getSpec().setUserAgent(HaloUtils.userAgentFrom(request));
                    return environmentFetcher
                            .fetchComment()
                            .map(commentSetting -> {
                                if (isFalse(commentSetting.getEnable())) {
                                    throw new AccessDeniedException(
                                            "The comment function has been turned off.",
                                            "problemDetail.comment.turnedOff",
                                            null);
                                }
                                if (checkReplyOwner(reply, commentSetting.getSystemUserOnly())) {
                                    throw new AccessDeniedException(
                                            "Allow only system users to comment.",
                                            "problemDetail.comment.systemUsersOnly",
                                            null);
                                }
                                reply.getSpec().setApproved(isFalse(commentSetting.getRequireReviewForNew()));

                                if (reply.getSpec().getHidden() == null) {
                                    reply.getSpec().setHidden(false);
                                }

                                return reply;
                            })

View on GitHub (pinned to d2f5165f9c)

Solutions

1. Have an administrator re-enable comments in Settings > Comment, then retry.
2. Hide/disable the reply form in the theme when comments are turned off so users cannot attempt submission.
3. Handle the 403/code 'problemDetail.comment.turnedOff' in the UI with a friendly 'comments disabled' notice.

Example fix

// before: form always shown; user clicks submit -> 403
// after: theme checks comment enabled flag and hides the reply form when off

// before showing a reply form, fetch comment settings and check enable
boolean commentsEnabled = commentSetting.enable;
if (!commentsEnabled) { hideReplyForm(); }

// handle the 403 with code problemDetail.comment.turnedOff gracefully
try {
    commentApi.createReply(...);
} catch (AccessDeniedException e) {
    if ("problemDetail.comment.turnedOff".equals(e.getCode())) {
        showInfo("Comments are disabled on this site.");
    } else throw e;
}

When it happens

Trigger: POST to the theme comment reply endpoint after an administrator disabled comments in the site's Comment settings (CommentSetting.enable = false).

Common situations: Site owner turned off comments globally; a theme still shows the reply form; cached front-end rendered the form before the setting propagated; admin disabled comments during moderation.

Related errors

• problemDetail.comment.systemUsersOnly
• validation.error.email.pattern
• validation.error.password.size
• The kind must not be null.
• The name must not be null.

AI-assisted analysis of halo-dev/halo@d2f5165f9c (2026-08-14). Data as JSON: /api/errors/65ec9e43d01b5274. Report an issue: GitHub.