Allow comments only for author of the node and certain role

Question

I'm using Drupal 7. It is possible to disable the comment form for a specific node type for authenticated users? What hooks should I use if I want to allow only the author of the node and the administrator to post comments. The normal users (authenticated role) should only read them.

Thank you

Answer 1

You can probably unset the comment form using hook_form_alter on the basis on certain condition:

function MODULENAME_form_alter(&$form, &$form_state) {
  if ( $form_id == 'comment_form') {
    global $user;
    if (!user_access('administer nodes') {
      // Form alter here to unset comment form
      unset($form);
    } 
  }
}

Answer 2

You could try the Comment Access module.

Comment Access allows your users to control the comments on their posts. It adds permissions to administer, approve, and delete comments on nodes they create without granting full comment administration access. Permissions are granted by node type, so it's a great way to allow your users to manage comments on their own blogs.

Features

• Adds permissions to:
  • Administer comments on own content (for each content type)
  • Delete comments on own content (for each content type)
  • Approve comments on own content (for each content type) User
• Option for e-mail notifications on comments needing approval site
• Administrators can set a custom comment approval message and e-mail
• Unapproved comments are left unpublished, so site administrators can still work with them as normal

Answer 3

If by administrator you mean the user whose ID is 1, I would use the following code.

/*
 * Implements hook_form_FORM_ID_alter().
 */
function mymodule_form_comment_form_alter(&$form, &$form_state) {
  global $user;
  $uid = $user->uid;
  if (($uid !== 1 && !isset($form['#node']) || ($uid !== 1 && $form['#node']->uid == $uid)) {
    $form['access'] = FALSE;
  }
}

If by administrator you mean the users who have the permission to administer comments, I would use use the following code.

/*
 * Implements hook_form_FORM_ID_alter().
 */
function mymodule_form_comment_form_alter(&$form, &$form_state) {
  global $user;
  $permission = user_access('administer permissions');
  if ((!$permission && !isset($form['#node']) || (!$permission && $form['#node']->uid == $user->uid)) {
    $form['access'] = FALSE;
  }
}

If by administrator you mean a user with a different permission, replace 'administer permissions' with the permission you want to check.

In any case:

• Setting $form['access'] to FALSE is better to unset $form, which would throw many warnings because of module accessing a NULL value as it would be an array
• Implementing hook_form_FORM_ID_alter() is better than implementing hook_form_alter() as the latter is invoked for every form, while the first is invoked only of a form type