From a2537899b7afa3fd74e6c9ddb2979dab34ccfe6b Mon Sep 17 00:00:00 2001
From: sw <939547590@qq.com>
Date: Fri, 5 Dec 2014 14:39:03 +0800
Subject: [PATCH] =?UTF-8?q?=E8=AF=BE=E7=A8=8B=E9=80=9A=E7=9F=A5=E8=AE=BF?=
 =?UTF-8?q?=E9=97=AE=E5=A2=9E=E5=8A=A0=E6=9D=83=E9=99=90=E6=8E=A7=E5=88=B6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/controllers/news_controller.rb | 34 +++++++++++++++++-------------
 1 file changed, 19 insertions(+), 15 deletions(-)

diff --git a/app/controllers/news_controller.rb b/app/controllers/news_controller.rb
index f1d97cbe7..23f8c18e9 100644
--- a/app/controllers/news_controller.rb
+++ b/app/controllers/news_controller.rb
@@ -65,23 +65,27 @@ class NewsController < ApplicationController
         format.atom { render_feed(@newss, :title => (@project ? @project.name : Setting.app_title) + ": #{l(:label_news_plural)}") }
       end
     elsif @course
-      scope = @course ? @course.news.course_visible : News.course_visible
+      if (User.current.admin? || @course.is_public == 1 || (@course.is_public == 0 && User.current.member_of_course?(@course)))
+        scope = @course ? @course.news.course_visible : News.course_visible
 
-      @news_count = scope.count
-      @news_pages = Paginator.new @news_count, @limit, params['page']
-      @offset ||= @news_pages.offset
-      @newss = scope.all(:include => [:author, :course],
-                         :order => "#{News.table_name}.created_on DESC",
-                         :offset => @offset,
-                         :limit => @limit)
+        @news_count = scope.count
+        @news_pages = Paginator.new @news_count, @limit, params['page']
+        @offset ||= @news_pages.offset
+        @newss = scope.all(:include => [:author, :course],
+                           :order => "#{News.table_name}.created_on DESC",
+                           :offset => @offset,
+                           :limit => @limit)
 
-      respond_to do |format|
-        format.html {
-          @news = News.new
-          render :layout => 'base_courses'
-        }
-        format.api
-        format.atom { render_feed(@newss, :title => (@course ? @course.name : Setting.app_title) + ": #{l(:label_news_plural)}") }
+        respond_to do |format|
+          format.html {
+            @news = News.new
+            render :layout => 'base_courses'
+          }
+          format.api
+          format.atom { render_feed(@newss, :title => (@course ? @course.name : Setting.app_title) + ": #{l(:label_news_plural)}") }
+        end
+      else
+        render_403
       end
     end
    end