课程教师列表增加权限控制

app/controllers/courses_controller.rb

@@ -198,22 +198,26 @@ class CoursesController < ApplicationController
 
   def member
     ## 有角色参数的才是课程，没有的就是项目
-    @render_file = 'member_list'
+    if User.current.member_of_course?(@course) || User.current.admin?
-    @teachers= searchTeacherAndAssistant(@course)
+      @render_file = 'member_list'
-    @canShowCode = isCourseTeacher(User.current.id,@course) && params[:role] != '1'
+      @teachers= searchTeacherAndAssistant(@course)
-    case params[:role]
+      @canShowCode = isCourseTeacher(User.current.id,@course) && params[:role] != '1'
-      when '1'
+      case params[:role]
-        @subPage_title = l :label_teacher_list
+        when '1'
-        @members = searchTeacherAndAssistant(@course)
+          @subPage_title = l :label_teacher_list
-      when '2'
+          @members = searchTeacherAndAssistant(@course)
-        @subPage_title = l :label_student_list
+        when '2'
-        @members = searchStudent(@course)
+          @subPage_title = l :label_student_list
-      else
+          @members = searchStudent(@course)
-        @subPage_title = ''
+        else
-        @members = @course.member_principals.includes(:roles, :principal).all.sort
+          @subPage_title = ''
+          @members = @course.member_principals.includes(:roles, :principal).all.sort
+      end
+      @members = paginateHelper @members
+      render :layout => 'base_courses'
+    else
+       render_403
     end
-    @members = paginateHelper @members
-    render :layout => 'base_courses'
   end
 
   #判断指定用户是否为课程教师