##// END OF EJS Templates
Do not render hidden news edit form if user is not allowed to edit (closes #4068)....
Jean-Philippe Lang -
r2840:04ae25f6b0ce
parent child
Show More
@@ -1,63 +1,65
1 1 <div class="contextual">
2 2 <%= link_to_if_authorized l(:button_edit),
3 3 {:controller => 'news', :action => 'edit', :id => @news},
4 4 :class => 'icon icon-edit',
5 5 :accesskey => accesskey(:edit),
6 6 :onclick => 'Element.show("edit-news"); return false;' %>
7 7 <%= link_to_if_authorized l(:button_delete), {:controller => 'news', :action => 'destroy', :id => @news}, :confirm => l(:text_are_you_sure), :method => :post, :class => 'icon icon-del' %>
8 8 </div>
9 9
10 10 <h2><%=h @news.title %></h2>
11 11
12 <% if authorize_for('news', 'edit') %>
12 13 <div id="edit-news" style="display:none;">
13 14 <% labelled_tabular_form_for :news, @news, :url => { :action => "edit", :id => @news },
14 15 :html => { :id => 'news-form' } do |f| %>
15 16 <%= render :partial => 'form', :locals => { :f => f } %>
16 17 <%= submit_tag l(:button_save) %>
17 18 <%= link_to_remote l(:label_preview),
18 19 { :url => { :controller => 'news', :action => 'preview', :project_id => @project },
19 20 :method => 'post',
20 21 :update => 'preview',
21 22 :with => "Form.serialize('news-form')"
22 23 }, :accesskey => accesskey(:preview) %> |
23 <%= link_to l(:button_cancel), "#", :onclick => 'Element.hide("edit-news")' %>
24 <%= link_to l(:button_cancel), "#", :onclick => 'Element.hide("edit-news"); return false;' %>
24 25 <% end %>
25 26 <div id="preview" class="wiki"></div>
26 27 </div>
28 <% end %>
27 29
28 30 <p><em><% unless @news.summary.blank? %><%=h @news.summary %><br /><% end %>
29 31 <span class="author"><%= authoring @news.created_on, @news.author %></span></em></p>
30 32 <div class="wiki">
31 33 <%= textilizable(@news.description) %>
32 34 </div>
33 35 <br />
34 36
35 37 <div id="comments" style="margin-bottom:16px;">
36 38 <h3 class="icon22 icon22-comment"><%= l(:label_comment_plural) %></h3>
37 39 <% @comments.each do |comment| %>
38 40 <% next if comment.new_record? %>
39 41 <div class="contextual">
40 42 <%= link_to_if_authorized image_tag('delete.png'), {:controller => 'news', :action => 'destroy_comment', :id => @news, :comment_id => comment},
41 43 :confirm => l(:text_are_you_sure), :method => :post, :title => l(:button_delete) %>
42 44 </div>
43 45 <h4><%= authoring comment.created_on, comment.author %></h4>
44 46 <%= textilizable(comment.comments) %>
45 47 <% end if @comments.any? %>
46 48 </div>
47 49
48 50 <% if authorize_for 'news', 'add_comment' %>
49 51 <p><%= toggle_link l(:label_comment_add), "add_comment_form", :focus => "comment_comments" %></p>
50 52 <% form_tag({:action => 'add_comment', :id => @news}, :id => "add_comment_form", :style => "display:none;") do %>
51 53 <div class="box">
52 54 <%= text_area 'comment', 'comments', :cols => 80, :rows => 15, :class => 'wiki-edit' %>
53 55 <%= wikitoolbar_for 'comment_comments' %>
54 56 </div>
55 57 <p><%= submit_tag l(:button_add) %></p>
56 58 <% end %>
57 59 <% end %>
58 60
59 61 <% html_title @news.title -%>
60 62
61 63 <% content_for :header_tags do %>
62 64 <%= stylesheet_link_tag 'scm' %>
63 65 <% end %>
General Comments 0
You need to be logged in to leave comments. Login now