How can I prevent anonymous users from seeing unapproved blog comments?

Question

Anonymous users are able to post a blog comment, but are able to see unapproved comments that are simply draft items on the Comments list. This seems like a bug that MS simply has not addressed yet.

We've tried the following configuration unsuccessfully -

1. Anonymous Permission

   • Site Level = Entire Website
   • Posts = View Items
   • Comments = Add Items, View Items

2. Comments List (Advanced Settings)

   • Read Access = Read All Items
   • Create and Edit Access = Create and Edit Items that were created by the user

3. Versioning Settings

   • Require Content Approval for submitted items = Yes
   • Who should see draft items in the list = only users who can approve items

Answer 1

In addition to the configuration changes I described in my question, to enable the moderation of anonymous comments while at the same time preventing anonymous users from seeing each others unmoderated comments, I had to create a custom list event receiver. The ModerationEventReceiver class from SPAdrian's Office 365 Anonymous Access Manager Sandbox Solution was very helpful.

I've included the ItemAdded and ItemUpdated events from my event receiver below...

public override void ItemAdded(SPItemEventProperties properties)
{
    base.ItemAdded(properties);
    // Use elevated privileges
    SPSecurity.RunWithElevatedPrivileges(delegate()
    {
        using (SPSite elevatedSite = new SPSite(properties.Web.Site.ID))
        {
            using (SPWeb elevatedWeb = elevatedSite.AllWebs[properties.RelativeWebUrl])  // Removing permissions on root site since we're in web provisioned and in the subsite
            {
                elevatedWeb.AllowUnsafeUpdates = true;
                SPList elevatedList = elevatedWeb.Lists[properties.List.ID];
                SPListItem elevatedListItem = elevatedList.GetItemById(properties.ListItemId);

                if (string.IsNullOrEmpty(properties.UserLoginName)
                    && elevatedList != null
                    && elevatedList.RootFolder != null)
                {
                    EventFiringEnabled = false;
                    elevatedListItem.BreakRoleInheritance(true);
                    EventFiringEnabled = true;
                }
            }
        }
    });
}

/// <summary>
/// An item was updated
/// </summary>
public override void ItemUpdated(SPItemEventProperties properties)
{
    // Use elevated privileges
    SPSecurity.RunWithElevatedPrivileges(delegate()
    {
        using (SPSite elevatedSite = new SPSite(properties.Web.Site.ID))
        {
            using (SPWeb elevatedWeb = elevatedSite.AllWebs[properties.RelativeWebUrl])  // Removing permissions on root site since we're in web provisioned and in the subsite
            {
                elevatedWeb.AllowUnsafeUpdates = true;
                SPList elevatedList = elevatedWeb.Lists[properties.List.ID];
                SPListItem elevatedListItem = elevatedList.GetItemById(properties.ListItemId);

                if (elevatedList != null
                    && elevatedList.RootFolder != null)
                {
                    base.ItemUpdated(properties);
                    EventFiringEnabled = false;
                    if (string.IsNullOrEmpty(properties.UserLoginName))
                    {
                        //Reset access for anonymous users
                        elevatedListItem.BreakRoleInheritance(true);
                    }
                    else
                    {
                        //Test if someone has approved and reset inheritance
                        if (elevatedListItem.ModerationInformation.Status == SPModerationStatusType.Approved)
                        {
                            elevatedListItem.ResetRoleInheritance();
                        }
                    }
                    EventFiringEnabled = true;
                }
            }
        }
    });
}