Merge pull request #66 from jessib/feature/comment_creation_access

Per ISEC informational issue, manually set the private property only in ...

1 files changed, 2 insertions, 0 deletions

diff --git a/help/app/controllers/tickets_controller.rb b/help/app/controllers/tickets_controller.rb
index 094612c..a03ef22 100644
--- a/help/app/controllers/tickets_controller.rb
+++ b/help/app/controllers/tickets_controller.rb
@@ -18,6 +18,7 @@ class TicketsController < ApplicationController
     @ticket = Ticket.new(params[:ticket])
 
     @ticket.comments.last.posted_by = (logged_in? ? current_user.id : nil) #protecting posted_by isn't working, so this should protect it.
+    @ticket.comments.last.private = false unless admin?
     @ticket.created_by = current_user.id if logged_in?
     @ticket.email = current_user.email_address if logged_in? and current_user.email_address
 
@@ -58,6 +59,7 @@ class TicketsController < ApplicationController
 
       if @ticket.comments_changed?
         @ticket.comments.last.posted_by = (current_user ? current_user.id : nil)
+        @ticket.comments.last.private = false unless admin?
       end
 
       if @ticket.changed?