Adds a News#commentable? method to easily specific additional rules.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@8854 e93f8b46-1217-0410-a6f0-8f06a7374b81

1 files changed, 19 insertions, 1 deletions

diff --git a/app/controllers/comments_controller.rb b/app/controllers/comments_controller.rb
index 230af5caf..e6cfab798 100644
--- a/app/controllers/comments_controller.rb
+++ b/app/controllers/comments_controller.rb
@@ -1,3 +1,20 @@
+# Redmine - project management software
+# Copyright (C) 2006-2012  Jean-Philippe Lang
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
 class CommentsController < ApplicationController
   default_search_scope :news
   model_object News
@@ -7,6 +24,8 @@ class CommentsController < ApplicationController
 
   verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
   def create
+    raise Unauthorized unless @news.commentable?
+
     @comment = Comment.new(params[:comment])
     @comment.author = User.current
     if @news.comments << @comment
@@ -32,5 +51,4 @@ class CommentsController < ApplicationController
     @comment = nil
     @news
   end
-
 end