Enable Comments

To enable comments on a publication type, such as a blog posting, first hook the Comments module into the Articles module, for the specific pubtype(s) you want. (Admin > Global > Modules > Configure Hooks > Comments > Articles > and Enable the pubtypes)

Next, configure Comments to allow anonymous posts. (Admin > Content > Comments > Modify Configuration > " Allow anonymous posting")

In my case, I've also selected "Flat" rendering.

Add Fields

We want to capture the user's name. We'll do this using Dynamic Data. Hook the DynamicData module into Comments (Admin > Global > Modules > Configure Hooks > Dynamic Data > Comments > Enable). And add the fields we want: (Admin > Content > Comments > Modify Configuration > Dynamic Data Field Modify, and then:

Label: Name, Type: textbox

Add Privileges

We have to grant permission for anonymous users to submit comments. Go to Add Privilege (Admin > Users > Privileges > Add Privilege) and submit the following:

Name: commentsSubmit
Module: comments
Level: comment

Then assign this privilege to the Everyone Roles group (Admin > Users > Roles, select Everyone group, click View Privileges icon, and assign commentsSubmit.

Modify Templates

To access the DynamicData we use xar:data tags in the templates. In forms, to show the input field for Name:

<xar:data-getitem name="$properties" module="comments" itemtype="0" itemid="0" />
<xar:data-input property="$properties['name']" />

Copy the file modules/comments/xartemplates/includes/input-box.xd to themes/yourtheme/modules/comments/incudes/input-box.xt, and replace instances of #$package['name']# with the xar:data lines shown above.

Similarly, for display, copy the file modules/comments/xartemplates/includes/view-flat.xd to view-flat.xt in your theme. Editing is a bit more complicated because BlockLayout doesn't handle objects very well, so we use temporary variables and > when it complains.

<xar:set name="ii">$loop->item</xar:set>

<xar:data-getitem name="$properties" module="comments" itemtype="0" itemid="$ii['xar_cid']" />

<xar:set name="p">$properties['name']</xar:set>

<xar:if condition="!empty($p-&gt;value)">

	#$p->value#

<xar:else />

	#$loop:item['xar_author']# 

</xar:if>

Replace all instances of #$loop:item['xar_author']# with the above code.

One more thing, extending this to handle the Preview form is more complicated. I just decided to comment out the Preview button (<input type="submit" ... > at bottom of the form).

That's it. This can easily be extended to also get a visitor's email address and website, etc.

Handle Spam Bots

A common way to handle robotic spammers is using a Captcha -- those distorted images that require you type the same text. Another less intrusive way is a service like Akismet. Both would be nice things to add to Xaraya, but for now I'll take a deadly simple route:

Add this little js function to the top of the input-box.xt template:

<script type="text/javascript">
  function checkNotspamBox(f) {
    if (f.notspam.checked == false) {
      alert('Hi. Unless you\'re a spam bot, please let us know you are not');
      return false;
    } else
      return true;
  }
</script>

In the <form> tag, replace the onSubmit attribute with

onSubmit="return checkNotspamBox(this) && submitonce(this);" 

And then in the form add the checkbox:

<input type="checkbox" value="0" name="notspam" id="notspam" />: This is not spam

More about Spambots

This from a recent IRC conversation. Spambots read your form an fill out any fields that look "important". And they go after common field names. So if its smart enough, or lucky 50% of the time it'll check the "notspam" checkbox, and they're in. Here's a better suggestion:

Provide a text field with a name that sounds important, like "website_url" or "email_address", then use CSS to hide the field so it's not visible to a normal browser. The bot will try to fill it in. Your app can check that, if the field has content, then ignore the spambot's post.  

Someone else added that for browsers without CSS (eg accessiblity) include (hidden) text that says "Don't enter anything into this field". 

function checkNameBox(f) {    
    if (f.dd_objectnumberhere.value == "" ) {      
        alert('Hi. Please provide your name or screen name.');      
        return false;    
    } else      
        return true;  
}