Development of Jacaranda Comments has continued, and the Advanced branch has now reached version 01.02.02.

Jacaranda Comments is a page-level comments module for DNN Platform 10. It was originally designed as a straightforward way to add comments and threaded replies to individual DNN pages, but the Advanced branch is now developing into a more complete site-wide comment-management system.

The Simple edition remains separately maintained on the main branch at version 01.01.03, while the Advanced features are developed on the advanced-settings branch.

Central Comments Administration

One of the biggest additions to the Advanced edition is the new Comments Administration panel.

Administrators no longer need to visit every page individually to discover whether a comment is waiting for approval.

The central moderation queue brings together pending comments and replies from every Jacaranda Comments module within the current DNN portal.

For each pending submission, the administrator can see information including:

• the DNN page title;
• the module title;
• whether the submission is a comment or reply;
• the author or guest name;
• the submission date;
• the comment text;
• whether the private language filter was triggered.

From the same central panel, an administrator can:

• Approve a pending comment;
• Reject / Delete a submission;
• View Page to open the DNN page where the comment was submitted.

Moderation is deliberately performed one comment at a time. There is currently no “Approve All” or “Delete All” function, reducing the possibility of an administrator accidentally changing a large number of comments with a single click.

Portal-wide controls

The Advanced edition also includes central settings that can affect every Jacaranda Comments instance in the current portal.

Two particularly useful emergency controls are available.

Disable all new posting

An administrator can stop new comments and replies across the entire portal while leaving existing discussions visible.

This could be useful during a spam attack, site maintenance, or another situation where new submissions need to be temporarily suspended.

Disable guest posting

Guest commenting can also be disabled across the entire portal without affecting registered-user commenting.

This provides a quick response if guest posting starts attracting unwanted submissions.

Central defaults with page-level flexibility

A central administration system should not remove the flexibility that makes a page-level module useful.

For that reason, individual Jacaranda Comments modules can either continue using their own local settings or deliberately inherit the site's central defaults.

Existing modules do not automatically switch to central settings during an upgrade.

This is important because an established site should not suddenly find that its moderation, guest access, CAPTCHA, rate limiting, or email behaviour has changed merely because the Advanced edition was installed.

Five-minute guest correction window

Version 01.02.02 introduces another useful feature: guests can now correct mistakes in their own submissions.

A guest who notices a typo or poorly worded sentence immediately after posting has up to five minutes to correct the text.

There are important limitations.

The guest can edit only:

• the comment or reply text.

They cannot change:

• their display name;
• their private email address.

The five-minute period begins when the original submission is made and does not restart after an edit.

Guest editing also ends immediately if:

• the five minutes expire;
• a moderator approves the submission;
• the submission is deleted;
• guest posting is disabled centrally;
• all posting is disabled centrally.

Most importantly, a guest can edit a comment only while it is still awaiting moderation.

This prevents a guest from submitting harmless text, having it approved, and then replacing the approved public comment with different content.

Secure guest ownership

Allowing an unauthenticated visitor to edit a comment creates an obvious security question:

How does the module know that the person requesting the edit is really the guest who submitted the comment?

Jacaranda Comments does not rely on the guest's name, email address, IP address, browser information, or Comment ID as proof of ownership.

Instead, the server creates a cryptographically random temporary edit credential when the guest submits the comment.

Only a SHA-256 hash of that credential is stored with the comment.

The original credential is not placed in:

• the database;
• the page URL;
• query strings;
• hidden form fields;
• rendered comment HTML;
• moderator emails.

When a guest attempts to edit the submission, the server checks the credential along with the portal, page, module, comment identity, moderation status, deletion status and five-minute time limit.

These checks are repeated at the database update stage rather than trusting values supplied by the browser.

Existing guest comments created before the upgrade do not suddenly become editable because they do not possess the required guest-edit credential.

Registered-user editing remains available

Registered DNN users continue to receive the existing 15-minute editing window for their own comments and replies.

Registered ownership is based on the authenticated DNN UserId, while guests use the temporary secure correction mechanism.

This provides a useful distinction between registered and guest participation while still giving guests a short opportunity to correct genuine mistakes.

Guest commenting and moderation

Guest commenting remains optional.

When enabled:

• guests provide a display name and private email address;
• guest comments and replies are always held for moderation;
• guest email addresses are not displayed publicly;
• moderator notifications can contain the private guest contact details;
• guest submissions cannot make themselves approved through modified browser values.

The site administrator can disable guest participation at any time through the Advanced central administration panel.

Private language filtering

Jacaranda Comments also includes an optional administrator-controlled language filter.

Administrators can enter terms or phrases that they do not want automatically published.

When a comment matches the list:

• the original text is not automatically censored;
• the submission is not deleted;
• it is held for moderation;
• the visitor is not told which term caused the match;
• authorised moderators can see that the language filter was triggered.

This allows the filter to assist human moderation rather than attempting to replace it.

Guest corrections are rechecked by the language filter before being saved.

Page-aware moderator notifications

Moderator emails identify which DNN page generated the submission.

For example:

Comment awaiting approval — Understanding Grace

The notification body can also include the page title, page link, module title, Comment ID, author details and moderation status.

This becomes increasingly useful as the same comments module is deployed across many pages.

Accessibility improvements

Accessibility has also been considered during development.

Success and error notifications remain within the boundaries of the Jacaranda Comments module rather than appearing over unrelated content elsewhere on the page.

This is particularly useful on layouts where a long article and its comments appear in separate columns.

Notification panels include stronger borders, clearer visual distinction and prominent close controls.

The CAPTCHA answer field also has a stronger high-contrast border, increased size and a clear keyboard-focus indicator to make it easier to locate for visitors with limited vision.

Security remains a priority

Adding guest access and central administration increases the importance of server-side security.

Jacaranda Comments continues to use:

• parameterised SQL;
• server-side permission checks;
• output encoding;
• anti-CSRF security tokens;
• portal, page and module scope validation;
• rate limiting;
• CAPTCHA support;
• honeypot protection;
• server-side character limits;
• forced moderation for guest submissions.

Central administration is restricted to:

• DNN Superusers;
• members of the portal's built-in Administrators role.

No additional DNN security role is required.

Portal-wide moderation and settings are scoped to the server-derived PortalId, helping prevent an administrator from one portal changing another portal's comments or settings.

Two development paths

Jacaranda Comments is now being maintained in two development lines.

Simple edition

The main branch remains the simpler page-level module at:

Jacaranda Comments 01.01.03

This edition is intended for sites that want individual page-level configuration without central administration.

Advanced edition

The advanced-settings branch currently contains:

Jacaranda Comments Advanced 01.02.02

The Advanced edition adds:

• portal-wide administration;
• central moderation;
• emergency posting controls;
• inherited site defaults;
• secure guest correction;
• additional administration and auditing features.

The Advanced edition retains the same underlying DNN module identity and is intended as an upgrade path rather than as a second copy of Jacaranda Comments installed side by side.

Current testing status

The earlier Advanced revisions have been trialled successfully on a DNN test site, including the central administration and portal-wide moderation workflows.

Version 01.02.02 is the latest development revision and introduces the new five-minute guest correction capability.

As with any DNN extension upgrade, administrators should back up both the website files and database and test the release on a staging site or low-risk page before wider deployment.

The DNN Event Viewer should also be checked after installation and during testing.

Feedback is welcome

Jacaranda Comments continues to grow through practical use and careful incremental development.

Feedback is particularly welcome regarding:

• guest commenting;
• the five-minute guest correction window;
• central moderation;
• multi-page installations;
• accessibility;
• different DNN skins and containers;
• email notifications;
• spam and abuse prevention;
• security concerns;
• upgrade behaviour.

The aim is to keep the module useful, understandable and secure without turning it into an unnecessarily complicated system.

Jacaranda Comments Advanced 01.02.02 represents another step towards providing DNN site owners with a practical comments system that can scale from a single page to a site containing many active discussions.

Project website: https://forrestitservices.org

GitHub: https://github.com/Forro-54/Jacaranda-Comments-Module