1、用户只可查看自己的作业界面

2、发布作业增加权限判断和登录判断

app/controllers/users_controller.rb

@@ -296,12 +296,16 @@ class UsersController < ApplicationController
 
   #用户作业列表
   def user_homeworks
-    @page = params[:page] ? params[:page].to_i + 1 : 0
-    user_course_ids = "(" + @user.courses.visible.map{|course| course.id}.join(",") + ")"
-    @homework_commons = HomeworkCommon.where("course_id in #{user_course_ids}").order("created_at desc").limit(10).offset(@page * 10)
-    respond_to do |format|
-      format.js
-      format.html {render :layout => 'new_base_user'}
+    if User.current == @user
+      @page = params[:page] ? params[:page].to_i + 1 : 0
+      user_course_ids = "(" + @user.courses.visible.map{|course| course.id}.join(",") + ")"
+      @homework_commons = HomeworkCommon.where("course_id in #{user_course_ids}").order("created_at desc").limit(10).offset(@page * 10)
+      respond_to do |format|
+        format.js
+        format.html {render :layout => 'new_base_user'}
+      end
+    else
+      render_403
     end
   end
 
@@ -345,16 +349,20 @@ class UsersController < ApplicationController
   end
 
   def new_user_commit_homework
-    @user = User.current
-    @homework = HomeworkCommon.find(params[:homework_id])
-    @is_test = params[:is_test] == 'true'
-    @student_work = @homework.student_works.where(user_id: User.current.id).first
-    if @student_work.nil?
-      @student_work = StudentWork.new
-    end
-    respond_to do |format|
-      format.js
-      format.html {render :layout => 'new_base_user'}
+    if User.current.logged?
+      @user = User.current
+      @homework = HomeworkCommon.find(params[:homework_id])
+      @is_test = params[:is_test] == 'true'
+      @student_work = @homework.student_works.where(user_id: User.current.id).first
+      if @student_work.nil?
+        @student_work = StudentWork.new
+      end
+      respond_to do |format|
+        format.js
+        format.html {render :layout => 'new_base_user'}
+      end
+    else
+      render_403
     end
   end
 
@@ -364,53 +372,57 @@ class UsersController < ApplicationController
   end
 
   def user_new_homework
-    if params[:homework_common]
-      homework = HomeworkCommon.new
-      homework.name = params[:homework_common][:name]
-      homework.description = params[:homework_common][:description]
-      homework.end_time = params[:homework_common][:end_time] || Time.now
-      homework.publish_time = Time.now
-      homework.homework_type = params[:homework_type].to_i || 1
-      homework.late_penalty = 2
-      homework.user_id = User.current.id
-      homework.course_id = params[:course_id]
+    if User.current.logged?
+      if params[:homework_common]
+        homework = HomeworkCommon.new
+        homework.name = params[:homework_common][:name]
+        homework.description = params[:homework_common][:description]
+        homework.end_time = params[:homework_common][:end_time] || Time.now
+        homework.publish_time = Time.now
+        homework.homework_type = params[:homework_type].to_i || 1
+        homework.late_penalty = 2
+        homework.user_id = User.current.id
+        homework.course_id = params[:course_id]
 
-      homework.save_attachments(params[:attachments])
-      render_attachment_warning_if_needed(homework)
+        homework.save_attachments(params[:attachments])
+        render_attachment_warning_if_needed(homework)
 
-      #匿评作业相关属性
-      if homework.homework_type == 1
-        homework_detail_manual = HomeworkDetailManual.new
-        homework_detail_manual.ta_proportion = params[:ta_proportion] || 0.6
-        homework_detail_manual.comment_status = 1
-        homework_detail_manual.evaluation_start = Time.now
-        homework_detail_manual.evaluation_end = Time.now
-        homework_detail_manual.evaluation_num = params[:evaluation_num] || 3
-        homework_detail_manual.absence_penalty = 2
-        homework.homework_detail_manual = homework_detail_manual
-      else
-        homework_detail_programing = HomeworkDetailPrograming.new
-        homework.homework_detail_programing = homework_detail_programing
-        homework_detail_programing.ta_proportion = params[:ta_proportion] || 0.6
-        homework_detail_programing.language = params[:program][:language].to_i
+        #匿评作业相关属性
+        if homework.homework_type == 1
+          homework_detail_manual = HomeworkDetailManual.new
+          homework_detail_manual.ta_proportion = params[:ta_proportion] || 0.6
+          homework_detail_manual.comment_status = 1
+          homework_detail_manual.evaluation_start = Time.now
+          homework_detail_manual.evaluation_end = Time.now
+          homework_detail_manual.evaluation_num = params[:evaluation_num] || 3
+          homework_detail_manual.absence_penalty = 2
+          homework.homework_detail_manual = homework_detail_manual
+        else
+          homework_detail_programing = HomeworkDetailPrograming.new
+          homework.homework_detail_programing = homework_detail_programing
+          homework_detail_programing.ta_proportion = params[:ta_proportion] || 0.6
+          homework_detail_programing.language = params[:program][:language].to_i
 
-        inputs = params[:program][:input]
-        if Array === inputs
-          inputs.each_with_index do |val, i|
-            homework.homework_tests << HomeworkTest.new(
-              input: val,
-              output: params[:program][:output][i]
-            )    
+          inputs = params[:program][:input]
+          if Array === inputs
+            inputs.each_with_index do |val, i|
+              homework.homework_tests << HomeworkTest.new(
+                  input: val,
+                  output: params[:program][:output][i]
+              )
+            end
           end
-        end
-        
-      end
 
-      if homework.save
-        homework_detail_manual.save if homework_detail_manual
-        homework_detail_programing.save if homework_detail_programing
-        redirect_to user_homeworks_user_path(User.current.id)
+        end
+
+        if homework.save
+          homework_detail_manual.save if homework_detail_manual
+          homework_detail_programing.save if homework_detail_programing
+          redirect_to user_homeworks_user_path(User.current.id)
+        end
       end
+    else
+      render_403
     end
   end