git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@8854 e93f8b46-1217-0410-a6f0-8f06a7374b81tags/1.4.0
@@ -1,3 +1,20 @@ | |||
# Redmine - project management software | |||
# Copyright (C) 2006-2012 Jean-Philippe Lang | |||
# | |||
# This program is free software; you can redistribute it and/or | |||
# modify it under the terms of the GNU General Public License | |||
# as published by the Free Software Foundation; either version 2 | |||
# of the License, or (at your option) any later version. | |||
# | |||
# This program is distributed in the hope that it will be useful, | |||
# but WITHOUT ANY WARRANTY; without even the implied warranty of | |||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |||
# GNU General Public License for more details. | |||
# | |||
# You should have received a copy of the GNU General Public License | |||
# along with this program; if not, write to the Free Software | |||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. | |||
class CommentsController < ApplicationController | |||
default_search_scope :news | |||
model_object News | |||
@@ -7,6 +24,8 @@ class CommentsController < ApplicationController | |||
verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed } | |||
def create | |||
raise Unauthorized unless @news.commentable? | |||
@comment = Comment.new(params[:comment]) | |||
@comment.author = User.current | |||
if @news.comments << @comment | |||
@@ -32,5 +51,4 @@ class CommentsController < ApplicationController | |||
@comment = nil | |||
@news | |||
end | |||
end |
@@ -42,6 +42,11 @@ class News < ActiveRecord::Base | |||
!user.nil? && user.allowed_to?(:view_news, project) | |||
end | |||
# Returns true if the news can be commented by user | |||
def commentable?(user=User.current) | |||
user.allowed_to?(:comment_news, project) | |||
end | |||
# returns latest news for projects visible by user | |||
def self.latest(user = User.current, count = 5) | |||
find(:all, :limit => count, |
@@ -53,7 +53,7 @@ | |||
<% end if @comments.any? %> | |||
</div> | |||
<% if authorize_for 'comments', 'create' %> | |||
<% if @news.commentable? %> | |||
<p><%= toggle_link l(:label_comment_add), "add_comment_form", :focus => "comment_comments" %></p> | |||
<% form_tag({:controller => 'comments', :action => 'create', :id => @news}, :id => "add_comment_form", :style => "display:none;") do %> | |||
<div class="box"> |
@@ -44,6 +44,15 @@ class CommentsControllerTest < ActionController::TestCase | |||
end | |||
end | |||
def test_create_should_be_denied_if_news_is_not_commentable | |||
News.any_instance.stubs(:commentable?).returns(false) | |||
@request.session[:user_id] = 2 | |||
assert_no_difference 'Comment.count' do | |||
post :create, :id => 1, :comment => { :comments => 'This is a test comment' } | |||
assert_response 403 | |||
end | |||
end | |||
def test_destroy_comment | |||
comments_count = News.find(1).comments.size | |||
@request.session[:user_id] = 2 |