diff --git a/app/controllers/messages_controller.rb b/app/controllers/messages_controller.rb index e840664b4..cdeb17e54 100644 --- a/app/controllers/messages_controller.rb +++ b/app/controllers/messages_controller.rb @@ -103,7 +103,11 @@ class MessagesController < ApplicationController # Edit a message def edit - (render_403; return false) unless @message.editable_by?(User.current) + if @project + (render_403; return false) unless @message.editable_by?(User.current) + else + (render_403; return false) unless @message.course_editable_by?(User.current) + end @message.safe_attributes = params[:message] if request.post? && @message.save attachments = Attachment.attach_files(@message, params[:attachments]) @@ -124,7 +128,11 @@ class MessagesController < ApplicationController # Delete a messages def destroy - (render_403; return false) unless @message.destroyable_by?(User.current) + if @project + (render_403; return false) unless @message.destroyable_by?(User.current) + else + (render_403; return false) unless @message.course_destroyable_by?(User.current) + end r = @message.to_param @message.destroy # modify by nwb diff --git a/app/models/message.rb b/app/models/message.rb index 62bfb34a5..0fdfc5b15 100644 --- a/app/models/message.rb +++ b/app/models/message.rb @@ -127,6 +127,14 @@ class Message < ActiveRecord::Base board.course end + def course_editable_by?(usr) + usr && usr.logged? && (usr.allowed_to?(:edit_messages, course) || (self.author == usr && usr.allowed_to?(:edit_own_messages, course))) + end + + def course_destroyable_by?(usr) + usr && usr.logged? && (usr.allowed_to?(:delete_messages, course) || (self.author == usr && usr.allowed_to?(:delete_own_messages, course))) + end + def editable_by?(usr) usr && usr.logged? && (usr.allowed_to?(:edit_messages, project) || (self.author == usr && usr.allowed_to?(:edit_own_messages, project))) end diff --git a/app/views/courses/show.html.erb b/app/views/courses/show.html.erb index d7d579dd1..a3412142b 100644 --- a/app/views/courses/show.html.erb +++ b/app/views/courses/show.html.erb @@ -2,7 +2,7 @@
- <%= l(:label_date_from_to, :start => format_date(@date_from), :end => format_date(@date_to - 1)) %> + <%#= l(:label_date_from_to, :start => format_date(@date_from), :end => format_date(@date_to - 1)) %>
<% @events_by_day.keys.sort.reverse.each do |day| %> diff --git a/app/views/messages/_course_show.html.erb b/app/views/messages/_course_show.html.erb index 4db903b88..5b8b629d4 100644 --- a/app/views/messages/_course_show.html.erb +++ b/app/views/messages/_course_show.html.erb @@ -148,7 +148,7 @@ "编辑", {:action => 'edit', :id => message}, :title => l(:button_edit) - ) if message.editable_by?(User.current) %> + ) if message.course_editable_by?(User.current) %> <%= link_to( #image_tag('delete.png'), "删除", @@ -156,7 +156,7 @@ :method => :post, :data => {:confirm => l(:text_are_you_sure)}, :title => l(:button_delete) - ) if message.destroyable_by?(User.current) %> + ) if message.course_destroyable_by?(User.current) %>