Even if you disallow anonymous comments at the site level, you can still place anonymous comments on artefacts

Anonymous comments function is enabled on artefact page of public share page that disallow anonymous comments.

Here's how to replicate the specific bug:

0. Clean install of Mahara
1. Log in as admin
2. Got to Administration -> Configure site -> Ste options -> User Settings
3. Set [Anonymous comments] OFF
4. Go to Portfolio -> Create a new Page -> Store a picture on this page.
5. Edit this new page access -> Enable [Share with public] and [Allow comments].
6. Log out.
7. Open this page as guest role.
8. Click one picture of this page.
9. [Anonymous comments] function is enabled on artefact page.

I found the cause of this bug.

In /artefact/artefact.php, Line 149
==================================================
if ($artefact->get('allowcomments'))
    $addfeedbackform = pieform(ArtefactTypeComment::add_comment_form(false, $artefact->get('approvecomments')));
    $extrastylesheets[] = 'style/jquery.rating.css';
    $javascript[] = 'jquery.rating';
}
==================================================================

I suggest

if ($artefact->get('allowcomments'))

change to:

if ($artefact->get('allowcomments') && ( $USER->is_logged_in() || (!$USER->is_logged_in() && get_config('anonymouscomments')))) {