Comments & reviews

Tiger has built-in comments and star ratings. You can attach a comment thread to a CMS page or a blog post, and modules can attach one to anything else (a shop product, a listing). A review is simply a comment with a star rating, so there is one moderation queue and one set of protections for both.

Comments are off by default: an open comment form is the most-attacked part of any website, so switching it on is a deliberate step.

Turning comments on

Comments are configured in your app's application/configs/application.ini:

Then add a thread where you want it with a shortcode — on a CMS page, or inside a blog post's body:

[comments subject="page:<page id>"]
[comments subject="blog.post:<post id>"]

[stars …] and [rating_summary …] take the same subject and show an item's average rating and its star breakdown.

Who can comment

• Signed-in users comment as themselves. Their name comes from their account, so a renamed user is never shown under an old name.
• Guests (only when allow_guests is on) give a name and an email. The email is never shown publicly.
• Star ratings require a signed-in user. An anonymous score would just be an open ballot box.

Moderation

With the default hold setting, every new comment is pending until an admin approves it. Pending comments are invisible to the public and never change a page's average rating.

The moderation queue is at Admin → Comments (/comment/admin). From there you can Approve, mark as Spam, or Reject each comment, and filter the list by status.

Authors can edit their own comment within the edit window. If comments are held for approval, an edited comment goes back into the queue, so an approved comment can't be quietly rewritten into something else.

Protection against spam and abuse

Each layer below works on its own, so a bot has to get past all of them:

• CSRF tokens on every comment action (post, edit, delete, moderate), so another website can't post or delete comments on your users' behalf.
• reCAPTCHA for guest comments, when reCAPTCHA is configured for your site.
• A honeypot and a time trap: a form filled in by a script, or submitted faster than a person could, is quietly dropped.
• Rate limits: at most 5 comments per 5 minutes, per user and per IP address.
• One rating per person per item, and nobody can rate their own listing.
• Optional AI spam check: if you've connected an AI agent, the moderation screen offers a toggle to have it classify each new comment. Anything it flags goes to the Spam bin; it can never approve a comment.
• Comment text is escaped when it's displayed, so a comment can't inject HTML or scripts into your page.

The person posting is never told that their comment was classified as spam. They see the same "awaiting moderation" message as everyone else.

Replies

Visitors can reply to a comment up to the threading limit (three levels by default). At the limit the Reply link disappears, rather than letting someone write a reply that then fails.