课程通知访问增加权限控制

app/controllers/news_controller.rb

@@ -65,6 +65,7 @@ class NewsController < ApplicationController
         format.atom { render_feed(@newss, :title => (@project ? @project.name : Setting.app_title) + ": #{l(:label_news_plural)}") }
       end
     elsif @course
+      if (User.current.admin? || @course.is_public == 1 || (@course.is_public == 0 && User.current.member_of_course?(@course)))
         scope = @course ? @course.news.course_visible : News.course_visible
 
         @news_count = scope.count
@@ -83,6 +84,9 @@ class NewsController < ApplicationController
           format.api
           format.atom { render_feed(@newss, :title => (@course ? @course.name : Setting.app_title) + ": #{l(:label_news_plural)}") }
         end
+      else
+        render_403
+      end
     end
    end