diff --git a/Gemfile.lock b/Gemfile.lock index 6680070a7..e6ee7da71 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -134,7 +134,7 @@ PLATFORMS DEPENDENCIES activerecord-jdbc-adapter (= 1.2.5) activerecord-jdbcmysql-adapter - acts-as-taggable-on + acts-as-taggable-on (= 2.4.1) better_errors! builder (= 3.0.0) coderay (~> 1.0.6) diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index a25b346ca..4b877818b 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -264,6 +264,14 @@ class ApplicationController < ActionController::Base render_404 end + #根据course_id找project + def find_project_by_course_id + @bid = Bid.find params[:course_id] + @project = @bid.courses[0] + rescue ActiveRecord::RecordNotFound + render_404 + end + # Find a project based on params[:project_id] # TODO: some subclasses override this, see about merging their logic def find_optional_project diff --git a/app/controllers/bids_controller.rb b/app/controllers/bids_controller.rb index ff6fda491..cde3eb76a 100644 --- a/app/controllers/bids_controller.rb +++ b/app/controllers/bids_controller.rb @@ -16,6 +16,13 @@ class BidsController < ApplicationController before_filter :memberAccess, only: :show_project + #判断当前角色权限时需先找到当前操作的project + before_filter :find_project_by_project_id, :only => [:edit] + before_filter :find_project_by_course_id, :only => [:homework_destroy] + before_filter :find_project_by_bid_id, :only => [:show_project] + #判断当前角色是否有操作权限 + #勿删 before_filter :authorize, :only => [:edit,:homework_destroy,:show_project] + helper :watchers helper :attachments include AttachmentsHelper @@ -25,7 +32,14 @@ class BidsController < ApplicationController helper :projects helper :words helper :welcome - + + def find_project_by_bid_id + @bid = Bid.find(params[:id]) + @project = @bid.courses[0] + rescue ActiveRecord::RecordNotFound + render_404 + end + def homework_ajax_modal @bid = Bid.find_by_id(params[:id]) # find_bid @@ -526,6 +540,7 @@ class BidsController < ApplicationController message = params[:bid_message][:message] + "\n" + params[:reference_content] else message = params[:bid_message][:message] + @m = message end refer_user_id = params[:bid_message][:reference_user_id].to_i @bid.add_jour(User.current, message, refer_user_id) diff --git a/app/controllers/homework_attach_controller.rb b/app/controllers/homework_attach_controller.rb index 1c3e8cabe..cd7a7870b 100644 --- a/app/controllers/homework_attach_controller.rb +++ b/app/controllers/homework_attach_controller.rb @@ -1,5 +1,23 @@ class HomeworkAttachController < ApplicationController ############################### + #判断当前角色权限时需先找到当前操作的project + before_filter :find_project_by_bid_id, :only => [:new] + before_filter :find_project_by_hoemwork_id, :only => [:edit,:update,:destroy] + #判断当前角色是否有操作权限 + #勿删 before_filter :authorize, :only => [:new,:edit,:update,:destroy] + + def find_project_by_bid_id + @bid = Bid.find(params[:id]) + @project = @bid.courses[0] + rescue ActiveRecord::RecordNotFound + render_404 + end + + def find_project_by_hoemwork_id + @homework = HomeworkAttach.find(params[:id]) + @project = @homework.bid.courses[0] + end + def index @homeworks = HomeworkAttach.all respond_to do |format| diff --git a/app/controllers/projects_controller.rb b/app/controllers/projects_controller.rb index 16d9d71d4..ad3dc3dca 100644 --- a/app/controllers/projects_controller.rb +++ b/app/controllers/projects_controller.rb @@ -37,6 +37,7 @@ class ProjectsController < ApplicationController # before_filter :authorize, :except => [:new_join, :new_homework, :homework, :statistics, :search, :watcherlist, :index, :list, :new, :create, :copy, :archive, :unarchive, :destroy, :member, :focus, :file, # :statistics, :feedback, :course, :enterprise_course, :course_enterprise, :project_respond, :share, # :show_projects_score, :issue_score_index, :news_score_index, :file_score_index, :code_submit_score_index, :projects_topic_score_index] + #此条勿删 课程相关权限 ,:new_homework,:homework,:feedback,,:member before_filter :authorize, :only => [:show, :settings, :edit, :sort_project_members, :update, :modules, :close, :reopen,:view_homework_attaches,:course] before_filter :authorize_global, :only => [:new, :create,:view_homework_attaches] before_filter :require_admin, :only => [ :copy, :archive, :unarchive, :destroy, :calendar] @@ -721,6 +722,9 @@ class ProjectsController < ApplicationController @teachers= searchTeacherAndAssistant(@project) @canShowRealName = isCourseTeacher(User.current.id) end + + #勿删 real_name action为虚拟的该方法并不存在，用来辅助判断真名权限 + #勿删 @canShowRealName = User.current.allowed_to?({:controller => "projects", :action => "real_name"}, @project || @projects, :global => false) respond_to do |format| format.html{render :layout => 'base_courses' if @base_courses_tag==1} format.api diff --git a/app/controllers/zipdown_controller.rb b/app/controllers/zipdown_controller.rb index 5caa97a22..ee5460805 100644 --- a/app/controllers/zipdown_controller.rb +++ b/app/controllers/zipdown_controller.rb @@ -1,7 +1,21 @@ class ZipdownController < ApplicationController + #查找项目（课程） + before_filter :find_project_by_bid_id, :only => [:assort,:download_user_homework] + #检查权限 + #勿删 before_filter :authorize, :only => [:assort,:download_user_homework] SAVE_FOLDER = "#{Rails.root}/files" OUTPUT_FOLDER = "#{Rails.root}/tmp/archiveZip" + #通过作业Id找到项目（课程） + def find_project_by_bid_id + obj_class = params[:obj_class] + obj_id = params[:obj_id] + obj = obj_class.constantize.find(obj_id) + case obj.class.to_s.to_sym + when :Bid + @project = obj.courses[0] + end + end def assort obj_class = params[:obj_class] obj_id = params[:obj_id] diff --git a/app/views/bids/show_project.html.erb b/app/views/bids/show_project.html.erb index c14d2e14c..039de6b7a 100644 --- a/app/views/bids/show_project.html.erb +++ b/app/views/bids/show_project.html.erb @@ -1,8 +1,9 @@ <% if @bid.homework_type == Bid::HomeworkFile %> + <%= render :partial => 'homework' %> <% else %> - +