From 0800574303ca924e4592362f530ca651869fac13 Mon Sep 17 00:00:00 2001
From: cxt <853663049@qq.com>
Date: Thu, 27 Jun 2019 17:42:10 +0800
Subject: [PATCH 1/2] =?UTF-8?q?=E8=B0=83=E6=95=B4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/controllers/graduation_tasks_controller.rb      | 5 ++++-
 app/models/graduation_work.rb                       | 2 +-
 app/views/graduation_tasks/tasks_list.json.jbuilder | 1 +
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/app/controllers/graduation_tasks_controller.rb b/app/controllers/graduation_tasks_controller.rb
index 2e72c57d3..93d3cba3d 100644
--- a/app/controllers/graduation_tasks_controller.rb
+++ b/app/controllers/graduation_tasks_controller.rb
@@ -59,7 +59,8 @@ class GraduationTasksController < ApplicationController
     # 任务发布的情况下： 是老师身份或者任务已截止的情况下公开任务了作品设置的学生也能查看其他人的作品
     if @task.published? && (@user_course_identity < Course::STUDENT ||
         (@user_course_identity == Course::STUDENT && @work.present? && @work.take.work_status > 0 &&
-            @task.status > 1 && @task.open_work))
+            ((!@task.allow_late && @task.status > 1) || (@task.allow_late && @task.late_time && @task.late_time < Time.now)) &&
+            (@task.open_work || @task.open_score)))
       # 如有有分班则看分班内的学生，否则看所有学生的作品
       user_ids =
           if @user_course_identity < Course::STUDENT
@@ -117,6 +118,7 @@ class GraduationTasksController < ApplicationController
         @work_list = @work_list.joins(user: :user_extension).order("user_extensions.#{rorder} #{b_order}")
       end
 
+      @view_work = @task.open_work || @user_course_identity < Course::STUDENT
 
       @work_count = @work_list.count
       @work_excel = @work_list
@@ -150,6 +152,7 @@ class GraduationTasksController < ApplicationController
       end
     else
       @work_list = @work
+      @view_work = false
       @work_count = @work_list.count
       @all_work_count = @work_list.count
       respond_to do |format|
diff --git a/app/models/graduation_work.rb b/app/models/graduation_work.rb
index 49cab19ee..e9be0a43e 100644
--- a/app/models/graduation_work.rb
+++ b/app/models/graduation_work.rb
@@ -63,7 +63,7 @@ class GraduationWork < ApplicationRecord
 
   #用户是否有查看分数的权限
   def check_score_power? current_user, course_identity
-    self.work_score.present? || course_identity < Course::STUDENT || self.user_id = current_user.id
+    self.work_score.present? && (course_identity < Course::STUDENT || self.user_id = current_user.id || graduation_task.open_score)
   end
 
   # 作品是否能够分配指导老师
diff --git a/app/views/graduation_tasks/tasks_list.json.jbuilder b/app/views/graduation_tasks/tasks_list.json.jbuilder
index 62c95901f..7588b6b6e 100644
--- a/app/views/graduation_tasks/tasks_list.json.jbuilder
+++ b/app/views/graduation_tasks/tasks_list.json.jbuilder
@@ -59,6 +59,7 @@ if @task.published? || @user_course_identity < Course::STUDENT
       json.late_penalty work.late_penalty if @task.allow_late
       json.final_score work_final_score work, @current_user, @user_course_identity
       json.assign work.assign_power?(@user_course_identity)
+      json.view_work @view_work || @current_user.id == work.user_id
     end
   end
 end
\ No newline at end of file

From 2a559db5806d151f37f7329f7cb61741bfea2d1d Mon Sep 17 00:00:00 2001
From: cxt <853663049@qq.com>
Date: Thu, 27 Jun 2019 17:57:35 +0800
Subject: [PATCH 2/2] =?UTF-8?q?=E6=AF=95=E8=AE=BE=E4=BD=9C=E5=93=81?=
 =?UTF-8?q?=E8=B0=83=E6=95=B4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/controllers/graduation_works_controller.rb | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/app/controllers/graduation_works_controller.rb b/app/controllers/graduation_works_controller.rb
index 09b9146e8..7cf1a3393 100644
--- a/app/controllers/graduation_works_controller.rb
+++ b/app/controllers/graduation_works_controller.rb
@@ -13,6 +13,7 @@ class GraduationWorksController < ApplicationController
   before_action :published_task, only: [:new, :create, :edit, :update, :search_member_list, :relate_project,
                                         :cancel_relate_project, :revise_attachment]
   before_action :edit_duration, only: [:edit, :update]
+  before_action :open_work, only: [:show, :supply_attachments, :comment_list]
 
   def new
     if @task.task_type == 2 && @task.base_on_project
@@ -489,6 +490,11 @@ class GraduationWorksController < ApplicationController
     tip_exception("已过了修改时间") if @task.end_time && @task.end_time < Time.now
   end
 
+  # 作品是否公开
+  def open_work
+    tip_exception(403,"没有操作权限") unless (@user_course_identity < Course::STUDENT || current_user == @work.user || @task.open_work)
+  end
+
   def update_check work
     tip_exception("作品描述不能为空") if params[:description].blank?
     if @task.task_type == 2