Adds a News#commentable? method to easily specific additional rules.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@8854 e93f8b46-1217-0410-a6f0-8f06a7374b81

app/controllers/comments_controller.rb

@@ -1,3 +1,20 @@
+# Redmine - project management software
+# Copyright (C) 2006-2012  Jean-Philippe Lang
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
 class CommentsController < ApplicationController
   default_search_scope :news
   model_object News
@@ -7,6 +24,8 @@ class CommentsController < ApplicationController
 
   verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
   def create
+    raise Unauthorized unless @news.commentable?
+
     @comment = Comment.new(params[:comment])
     @comment.author = User.current
     if @news.comments << @comment
@@ -32,5 +51,4 @@ class CommentsController < ApplicationController
     @comment = nil
     @news
   end
-
 end

app/models/news.rb

@@ -42,6 +42,11 @@ class News < ActiveRecord::Base
     !user.nil? && user.allowed_to?(:view_news, project)
   end
 
+  # Returns true if the news can be commented by user
+  def commentable?(user=User.current)
+    user.allowed_to?(:comment_news, project)
+  end
+
   # returns latest news for projects visible by user
   def self.latest(user = User.current, count = 5)
     find(:all, :limit => count,

app/views/news/show.html.erb

@@ -53,7 +53,7 @@
 <% end if @comments.any? %>
 </div>
 
-<% if authorize_for 'comments', 'create' %>
+<% if @news.commentable? %>
 <p><%= toggle_link l(:label_comment_add), "add_comment_form", :focus => "comment_comments" %></p>
 <% form_tag({:controller => 'comments', :action => 'create', :id => @news}, :id => "add_comment_form", :style => "display:none;") do %>
 <div class="box">

test/functional/comments_controller_test.rb

@@ -44,6 +44,15 @@ class CommentsControllerTest < ActionController::TestCase
     end
   end
 
+  def test_create_should_be_denied_if_news_is_not_commentable
+    News.any_instance.stubs(:commentable?).returns(false)
+    @request.session[:user_id] = 2
+    assert_no_difference 'Comment.count' do
+      post :create, :id => 1, :comment => { :comments => 'This is a test comment' }
+      assert_response 403
+    end
+  end
+
   def test_destroy_comment
     comments_count = News.find(1).comments.size
     @request.session[:user_id] = 2