Adds a News#commentable? method to easily specific additional rules.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@8854 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang 2012-02-11 17:14:56 +00:00
parent 9678e335a4
commit 8ddcc4caf5
4 changed files with 34 additions and 2 deletions

View File

@ -1,3 +1,20 @@
# Redmine - project management software
# Copyright (C) 2006-2012 Jean-Philippe Lang
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
class CommentsController < ApplicationController
default_search_scope :news
model_object News
@ -7,6 +24,8 @@ class CommentsController < ApplicationController
verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
def create
raise Unauthorized unless @news.commentable?
@comment = Comment.new(params[:comment])
@comment.author = User.current
if @news.comments << @comment
@ -32,5 +51,4 @@ class CommentsController < ApplicationController
@comment = nil
@news
end
end

View File

@ -42,6 +42,11 @@ class News < ActiveRecord::Base
!user.nil? && user.allowed_to?(:view_news, project)
end
# Returns true if the news can be commented by user
def commentable?(user=User.current)
user.allowed_to?(:comment_news, project)
end
# returns latest news for projects visible by user
def self.latest(user = User.current, count = 5)
find(:all, :limit => count,

View File

@ -53,7 +53,7 @@
<% end if @comments.any? %>
</div>
<% if authorize_for 'comments', 'create' %>
<% if @news.commentable? %>
<p><%= toggle_link l(:label_comment_add), "add_comment_form", :focus => "comment_comments" %></p>
<% form_tag({:controller => 'comments', :action => 'create', :id => @news}, :id => "add_comment_form", :style => "display:none;") do %>
<div class="box">

View File

@ -44,6 +44,15 @@ class CommentsControllerTest < ActionController::TestCase
end
end
def test_create_should_be_denied_if_news_is_not_commentable
News.any_instance.stubs(:commentable?).returns(false)
@request.session[:user_id] = 2
assert_no_difference 'Comment.count' do
post :create, :id => 1, :comment => { :comments => 'This is a test comment' }
assert_response 403
end
end
def test_destroy_comment
comments_count = News.find(1).comments.size
@request.session[:user_id] = 2