security: use 404 instead of 403 in case missing permissions for comment deletion.

- prevents resource discovery

rhodecode/controllers/changeset.py

@@ -448,7 +448,9 @@ class ChangesetController(BaseRepoController):
             Session().commit()
             return True
         else:
-            raise HTTPForbidden()
+            log.warning('No permissions for user %s to delete comment_id: %s',
+                        c.rhodecode_user, comment_id)
+            raise HTTPNotFound()
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.read', 'repository.write',

rhodecode/controllers/pullrequests.py

@@ -1013,4 +1013,6 @@ class PullrequestsController(BaseRepoController):
                     comment.pull_request, c.rhodecode_user, 'review_status_change')
             return True
         else:
-            raise HTTPForbidden()
+            log.warning('No permissions for user %s to delete comment_id: %s',
+                        c.rhodecode_user, comment_id)
+            raise HTTPNotFound()