权限访问控制

app/controllers/organizations_controller.rb

@@ -71,6 +71,7 @@ class OrganizationsController < ApplicationController
   def show
     # 组织新类型 show_mode：判断标准 1为新类型，0为旧
     if @organization.show_mode == 1 && params[:org_subfield_id].nil? && params[:type] .nil?
+      if @organization.is_public? || User.current.admin? || User.current.member_of_org?(@organization)
         @subfield_content = @organization.org_subfields.order("priority")
         # 项目两种动态
         @project_issue_acts = get_project_issue_activities_org @organization
@@ -81,6 +82,9 @@ class OrganizationsController < ApplicationController
         @course_acts_message = get_course_message_activities_org @organization
         @course_acts_news = get_course_news_activities_org @organization
         render :layout => 'base_org_newstyle'
+      else
+        render_403
+      end
     else
       if @organization.is_public? || User.current.admin? || User.current.member_of_org?(@organization)
         @organization = Organization.find(params[:id])