课程留言、讨论区增加权限控制

app/controllers/boards_controller.rb

@@ -39,13 +39,18 @@ class BoardsController < ApplicationController
       end
       render :layout => false if request.xhr?
     elsif @course
-      @boards = @course.boards.includes(:last_message => :author).all
+      if (User.current.admin? || @course.is_public == 1 || (@course.is_public == 0 && User.current.member_of_course?(@course)))
-      @boards = [] << @boards[0] if @boards.any?
+        @boards = @course.boards.includes(:last_message => :author).all
-      if @boards.size == 1
+        @boards = [] << @boards[0] if @boards.any?
-        @board = @boards.first
+        if @boards.size == 1
-        show and return
+          @board = @boards.first
+          show and return
+        end
+        render :layout => 'base_courses'
+      else
+        render_403
       end
-      render :layout => 'base_courses'
+
     end
 
   end

app/controllers/courses_controller.rb

@@ -669,24 +669,29 @@ class CoursesController < ApplicationController
   end
 
   def feedback
-    page = params[:page]
+    if (User.current.admin? || @course.is_public == 1 || (@course.is_public == 0 && User.current.member_of_course?(@course)))
-    # Find the page of the requested reply
+      page = params[:page]
-    @jours = @course.journals_for_messages.where('m_parent_id IS NULL').order('created_on DESC')
+      # Find the page of the requested reply
-    @limit =  10
+      @jours = @course.journals_for_messages.where('m_parent_id IS NULL').order('created_on DESC')
-    if params[:r] && page.nil?
+      @limit =  10
-      offset = @jours.count(:conditions => ["#{JournalsForMessage.table_name}.id > ?", params[:r].to_i])
+      if params[:r] && page.nil?
-      page = 1 + offset / @limit
+        offset = @jours.count(:conditions => ["#{JournalsForMessage.table_name}.id > ?", params[:r].to_i])
+        page = 1 + offset / @limit
+      end
+
+      #@feedback_count = @jours.count
+      #@feedback_pages = Paginator.new @feedback_count, @limit, page
+      #@offset ||= @feedback_pages.offset
+      @jour = paginateHelper @jours,10
+      @state = false
+      respond_to do |format|
+        format.html{render :layout => 'base_courses'}
+        format.api
+      end
+    else
+      render_403
     end
 
-    #@feedback_count = @jours.count
-    #@feedback_pages = Paginator.new @feedback_count, @limit, page
-    #@offset ||= @feedback_pages.offset
-    @jour = paginateHelper @jours,10
-    @state = false
-    respond_to do |format|
-      format.html{render :layout => 'base_courses'}
-      format.api
-    end
   end