1、用户只可查看自己的作业界面

2、发布作业增加权限判断和登录判断

app/controllers/users_controller.rb

@@ -296,6 +296,7 @@ class UsersController < ApplicationController
 
   #用户作业列表
   def user_homeworks
+    if User.current == @user
       @page = params[:page] ? params[:page].to_i + 1 : 0
       user_course_ids = "(" + @user.courses.visible.map{|course| course.id}.join(",") + ")"
       @homework_commons = HomeworkCommon.where("course_id in #{user_course_ids}").order("created_at desc").limit(10).offset(@page * 10)
@@ -303,6 +304,9 @@ class UsersController < ApplicationController
         format.js
         format.html {render :layout => 'new_base_user'}
       end
+    else
+      render_403
+    end
   end
 
   #导入作业
@@ -345,6 +349,7 @@ class UsersController < ApplicationController
   end
 
   def new_user_commit_homework
+    if User.current.logged?
       @user = User.current
       @homework = HomeworkCommon.find(params[:homework_id])
       @is_test = params[:is_test] == 'true'
@@ -356,6 +361,9 @@ class UsersController < ApplicationController
         format.js
         format.html {render :layout => 'new_base_user'}
       end
+    else
+      render_403
+    end
   end
 
   def user_commit_homework
@@ -364,6 +372,7 @@ class UsersController < ApplicationController
   end
 
   def user_new_homework
+    if User.current.logged?
       if params[:homework_common]
         homework = HomeworkCommon.new
         homework.name = params[:homework_common][:name]
@@ -412,6 +421,9 @@ class UsersController < ApplicationController
           redirect_to user_homeworks_user_path(User.current.id)
         end
       end
+    else
+      render_403
+    end
   end
 
   #用户从资源库导入资源到作业