From 8ddcc4caf51c3ae911f7789ad21dcb456ebcf193 Mon Sep 17 00:00:00 2001 From: Jean-Philippe Lang Date: Sat, 11 Feb 2012 17:14:56 +0000 Subject: [PATCH] Adds a News#commentable? method to easily specific additional rules. git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@8854 e93f8b46-1217-0410-a6f0-8f06a7374b81 --- app/controllers/comments_controller.rb | 20 +++++++++++++++++++- app/models/news.rb | 5 +++++ app/views/news/show.html.erb | 2 +- test/functional/comments_controller_test.rb | 9 +++++++++ 4 files changed, 34 insertions(+), 2 deletions(-) diff --git a/app/controllers/comments_controller.rb b/app/controllers/comments_controller.rb index 230af5caf..e6cfab798 100644 --- a/app/controllers/comments_controller.rb +++ b/app/controllers/comments_controller.rb @@ -1,3 +1,20 @@ +# Redmine - project management software +# Copyright (C) 2006-2012 Jean-Philippe Lang +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version 2 +# of the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + class CommentsController < ApplicationController default_search_scope :news model_object News @@ -7,6 +24,8 @@ class CommentsController < ApplicationController verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed } def create + raise Unauthorized unless @news.commentable? + @comment = Comment.new(params[:comment]) @comment.author = User.current if @news.comments << @comment @@ -32,5 +51,4 @@ class CommentsController < ApplicationController @comment = nil @news end - end diff --git a/app/models/news.rb b/app/models/news.rb index 78dcc0c8c..eed17945e 100644 --- a/app/models/news.rb +++ b/app/models/news.rb @@ -42,6 +42,11 @@ class News < ActiveRecord::Base !user.nil? && user.allowed_to?(:view_news, project) end + # Returns true if the news can be commented by user + def commentable?(user=User.current) + user.allowed_to?(:comment_news, project) + end + # returns latest news for projects visible by user def self.latest(user = User.current, count = 5) find(:all, :limit => count, diff --git a/app/views/news/show.html.erb b/app/views/news/show.html.erb index 72c18d9a6..b0b5f023e 100644 --- a/app/views/news/show.html.erb +++ b/app/views/news/show.html.erb @@ -53,7 +53,7 @@ <% end if @comments.any? %> -<% if authorize_for 'comments', 'create' %> +<% if @news.commentable? %>

<%= toggle_link l(:label_comment_add), "add_comment_form", :focus => "comment_comments" %>

<% form_tag({:controller => 'comments', :action => 'create', :id => @news}, :id => "add_comment_form", :style => "display:none;") do %>
diff --git a/test/functional/comments_controller_test.rb b/test/functional/comments_controller_test.rb index a04df43f5..e3e99d364 100644 --- a/test/functional/comments_controller_test.rb +++ b/test/functional/comments_controller_test.rb @@ -44,6 +44,15 @@ class CommentsControllerTest < ActionController::TestCase end end + def test_create_should_be_denied_if_news_is_not_commentable + News.any_instance.stubs(:commentable?).returns(false) + @request.session[:user_id] = 2 + assert_no_difference 'Comment.count' do + post :create, :id => 1, :comment => { :comments => 'This is a test comment' } + assert_response 403 + end + end + def test_destroy_comment comments_count = News.find(1).comments.size @request.session[:user_id] = 2 -- 2.39.5