diff options
Diffstat (limited to 'app/controllers')
| -rw-r--r-- | app/controllers/context_menus_controller.rb | 6 | ||||
| -rw-r--r-- | app/controllers/timelog_controller.rb | 1 |
2 files changed, 4 insertions, 3 deletions
diff --git a/app/controllers/context_menus_controller.rb b/app/controllers/context_menus_controller.rb index 4d22b0af9..7c5e76d1c 100644 --- a/app/controllers/context_menus_controller.rb +++ b/app/controllers/context_menus_controller.rb @@ -76,9 +76,9 @@ class ContextMenusController < ApplicationController @projects = @time_entries.collect(&:project).compact.uniq @project = @projects.first if @projects.size == 1 @activities = TimeEntryActivity.shared.active - @can = {:edit => User.current.allowed_to?(:edit_time_entries, @projects), - :delete => User.current.allowed_to?(:edit_time_entries, @projects) - } + + edit_allowed = @time_entries.all? {|t| t.editable_by?(User.current)} + @can = {:edit => edit_allowed, :delete => edit_allowed} @back = back_url @options_by_custom_field = {} diff --git a/app/controllers/timelog_controller.rb b/app/controllers/timelog_controller.rb index 8a8cfeeea..a8d48a707 100644 --- a/app/controllers/timelog_controller.rb +++ b/app/controllers/timelog_controller.rb @@ -234,6 +234,7 @@ private def find_time_entries @time_entries = TimeEntry.where(:id => params[:id] || params[:ids]).to_a raise ActiveRecord::RecordNotFound if @time_entries.empty? + raise Unauthorized unless @time_entries.all? {|t| t.editable_by?(User.current)} @projects = @time_entries.collect(&:project).compact.uniq @project = @projects.first if @projects.size == 1 rescue ActiveRecord::RecordNotFound |