非课程成员不可访问课程的作业列表

app/controllers/homework_common_controller.rb

@@ -3,6 +3,7 @@ class HomeworkCommonController < ApplicationController
   before_filter :find_course, :only => [:index,:new,:create]
   before_filter :find_homework, :only => [:edit,:update,:alert_anonymous_comment,:start_anonymous_comment,:stop_anonymous_comment,:destroy]
   before_filter :teacher_of_course, :only => [:new, :create, :edit, :update, :destroy, :start_anonymous_comment, :stop_anonymous_comment, :alert_anonymous_comment]
+  before_filter :member_of_course, :only => [:index]
 
   def index
     homeworks = @course.homework_commons.order("created_at desc")
@@ -203,6 +204,11 @@ class HomeworkCommonController < ApplicationController
     render_403 unless User.current.allowed_to?(:as_teacher,@course) || User.current.admin?
   end
 
+  #当前用户是不是课程的成员
+  def member_of_course
+    render_403 unless User.current.member_of_course?(@course) || User.current.admin?
+  end
+
   def get_assigned_homeworks(student_works, n, index)
     student_works += student_works
     student_works[index + 1 .. index + n]