diff --git a/app/controllers/forums_controller.rb b/app/controllers/forums_controller.rb index 35b681c97..8bcc9f387 100644 --- a/app/controllers/forums_controller.rb +++ b/app/controllers/forums_controller.rb @@ -2,6 +2,8 @@ class ForumsController < ApplicationController # GET /forums # GET /forums.json + before_filter :authenticate_user_edit, :only => [:edit, :update] + before_filter :authenticate_user_destroy, :only => [:destroy] def index @offset, @limit = api_offset_and_limit({:limit => 10}) @@ -100,3 +102,23 @@ class ForumsController < ApplicationController end end end + + private + + + def find_forum + @forum = Forum.find(params[:id]) + rescue ActiveRecord::RecordNotFound + render_404 + nil + end + + def authenticate_user_edit + find_forum + render_403 unless @forum.editable_by? User.current + end + + def authenticate_user_destroy + find_forum + render_403 unless @forum.destroyable_by? User.current + end \ No newline at end of file diff --git a/app/models/forum.rb b/app/models/forum.rb index 277b55dce..3d4c3830d 100644 --- a/app/models/forum.rb +++ b/app/models/forum.rb @@ -21,6 +21,16 @@ class Forum < ActiveRecord::Base self.class.reset_counters!(id) end + def editable_by? user + # user && user.logged? || (self.author == usr && usr.allowed_to?(:edit_own_messages, project)) + self.creator == user || user.admin? + end + + def destroyable_by? user + # user && user.logged? && Forum.find(self.forum_id).creator_id == user.id || user.admin? + user.admin? + end + # Updates topic_count, memo_count and last_memo_id attributes for +board_id+ def self.reset_counters!(forum_id) forum_id = forum_id.to_i diff --git a/app/models/message.rb b/app/models/message.rb index a8252df07..b9f71b0ab 100644 --- a/app/models/message.rb +++ b/app/models/message.rb @@ -33,15 +33,14 @@ class Message < ActiveRecord::Base :date_column => "#{table_name}.created_on" acts_as_event :title => Proc.new {|o| "#{o.board.name}: #{o.subject}"}, :description => :content, - :datetime => :created_on, + # :datetime => "#{Message.table_name}.created_on", :group => :parent, :type => Proc.new {|o| o.parent_id.nil? ? 'message' : 'reply'}, :url => Proc.new {|o| {:controller => 'messages', :action => 'show', :board_id => o.board_id}.merge(o.parent_id.nil? ? {:id => o.id} : {:id => o.parent_id, :r => o.id, :anchor => "message-#{o.id}"})} acts_as_activity_provider :find_options => {:include => [{:board => :project}, :author]}, - :author_key => :author_id, - :timestamp => :created_on + :author_key => :author_id acts_as_watchable validates_presence_of :board, :subject, :content diff --git a/app/views/bids/_project_list.html.erb b/app/views/bids/_project_list.html.erb index e6001590c..2057de64c 100644 --- a/app/views/bids/_project_list.html.erb +++ b/app/views/bids/_project_list.html.erb @@ -1,38 +1,38 @@ - -<%= render_flash_messages %> -<% if @bid.reward_type == 3 %> - <% if User.current.logged?%> - <% if User.current.user_extensions.identity == 1 %> -
<%= l(:label_homework_prompt) %>
-<%= l(:label_homework_prompt_content) %>
-<%= l(:label_homework_project) %>(<%= bidding_project.count%>) | -
- <% if User.current.logged? && (!Member.where('user_id = ? and project_id = ?', User.current.id, @bid.courses.first.id).first.nil? && (Member.where('user_id = ? and project_id = ?', User.current.id, @bid.courses.first.id).first.roles&Role.where('id = ? or id = ? or id = ?',5, 10, 7)).size >0) %>
-
-
- <%= toggle_link l(:label_commit_homework), 'put-bid-form' %>
-
- <% end %>
- |
-
<%= l(:label_bidding_project) %>(<%= bidding_project.count%>) | - <% if User.current.logged? %> -
-
- <%= toggle_link l(:button_bidding), 'put-bid-form' %>
- |
- <% end %>
-
<%= l(:label_homework_prompt) %>
+<%= l(:label_homework_prompt_content) %>
+<%= l(:label_homework_project) %>(<%= bidding_project.count%>) | +
+ <% if User.current.logged? && (!Member.where('user_id = ? and project_id = ?', User.current.id, @bid.courses.first.id).first.nil? && (Member.where('user_id = ? and project_id = ?', User.current.id, @bid.courses.first.id).first.roles&Role.where('id = ? or id = ? or id = ?',5, 10, 7)).size >0) %>
+
+
+ <%= toggle_link l(:label_commit_homework), 'put-bid-form' %>
+
+ <% end %>
+ |
+
<%= l(:label_bidding_project) %>(<%= bidding_project.count%>) | + <% if User.current.logged? %> +
+
+ <%= toggle_link l(:button_bidding), 'put-bid-form' %>
+ |
+ <% end %>
+