jro_apps/redmine Commit - r8734:8ddcc4caf51c

Adds a News#commentable? method to easily specific additional rules....

Jean-Philippe Lang -

r8734:8ddcc4caf51c

parent child

Context file:

r8734:8ddcc4caf51c

Collapse all files

app/controllers/comments_controller.rb +19 -1

+            # Redmine - project management software
+            # Copyright (C) 2006-2012  Jean-Philippe Lang
+            #
+            # This program is free software; you can redistribute it and/or
+            # modify it under the terms of the GNU General Public License
+            # as published by the Free Software Foundation; either version 2
+            # of the License, or (at your option) any later version.
+            #
+            # This program is distributed in the hope that it will be useful,
+            # but WITHOUT ANY WARRANTY; without even the implied warranty of
+            # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+            # GNU General Public License for more details.
+            #
+            # You should have received a copy of the GNU General Public License
+            # along with this program; if not, write to the Free Software
+            # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class CommentsController < ApplicationController
               default_search_scope :news
               model_object News
               before_filter :find_model_object
               before_filter :find_project_from_association
               before_filter :authorize
               verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
               def create
+                raise Unauthorized unless @news.commentable?
                 @comment = Comment.new(params[:comment])
                 @comment.author = User.current
                 if @news.comments << @comment
                   flash[:notice] = l(:label_comment_added)
                 end
                 redirect_to :controller => 'news', :action => 'show', :id => @news
               end
               verify :method => :delete, :only => :destroy, :render => {:nothing => true, :status => :method_not_allowed }
               def destroy
                 @news.comments.find(params[:comment_id]).destroy
                 redirect_to :controller => 'news', :action => 'show', :id => @news
               end
               private
               # ApplicationController's find_model_object sets it based on the controller
               # name so it needs to be overriden and set to @news instead
               def find_model_object
                 super
                 @news = @object
                 @comment = nil
                 @news
               end
             end

app/models/news.rb +5 0

             # Redmine - project management software
             # Copyright (C) 2006-2011  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class News < ActiveRecord::Base
               belongs_to :project
               belongs_to :author, :class_name => 'User', :foreign_key => 'author_id'
               has_many :comments, :as => :commented, :dependent => :delete_all, :order => "created_on"
               validates_presence_of :title, :description
               validates_length_of :title, :maximum => 60
               validates_length_of :summary, :maximum => 255
               acts_as_attachable :delete_permission => :manage_news
               acts_as_searchable :columns => ['title', 'summary', "#{table_name}.description"], :include => :project
               acts_as_event :url => Proc.new {|o| {:controller => 'news', :action => 'show', :id => o.id}}
               acts_as_activity_provider :find_options => {:include => [:project, :author]},
                                         :author_key => :author_id
               acts_as_watchable
               after_create :add_author_as_watcher
               named_scope :visible, lambda {|*args| {
                 :include => :project,
                 :conditions => Project.allowed_to_condition(args.shift || User.current, :view_news, *args)
               }}
               def visible?(user=User.current)
                 !user.nil? && user.allowed_to?(:view_news, project)
               end
+              # Returns true if the news can be commented by user
+              def commentable?(user=User.current)
+                user.allowed_to?(:comment_news, project)
+              end
               # returns latest news for projects visible by user
               def self.latest(user = User.current, count = 5)
                 find(:all, :limit => count,
                      :conditions => Project.allowed_to_condition(user, :view_news),
                      :include => [ :author, :project ],
                      :order => "#{News.table_name}.created_on DESC")
               end
               private
               def add_author_as_watcher
                 Watcher.create(:watchable => self, :user => author)
               end
             end

app/views/news/show.html.erb +1 -1

             <div class="contextual">
             <%= watcher_tag(@news, User.current) %>
             <%= link_to(l(:button_edit),
                   edit_news_path(@news),
                   :class => 'icon icon-edit',
                   :accesskey => accesskey(:edit),
                   :onclick => 'Element.show("edit-news"); return false;') if User.current.allowed_to?(:manage_news, @project) %>
             <%= link_to(l(:button_delete),
                   news_path(@news),
                   :confirm => l(:text_are_you_sure),
                   :method => :delete,
                   :class => 'icon icon-del') if User.current.allowed_to?(:manage_news, @project) %>
             </div>
             <h2><%= avatar(@news.author, :size => "24") %><%=h @news.title %></h2>
             <% if authorize_for('news', 'edit') %>
             <div id="edit-news" style="display:none;">
             <% labelled_form_for :news, @news, :url => news_path(@news),
                                                        :html => { :id => 'news-form', :multipart => true, :method => :put } do |f| %>
             <%= render :partial => 'form', :locals => { :f => f } %>
             <%= submit_tag l(:button_save) %>
             <%= link_to_remote l(:label_preview),
                                { :url => preview_news_path(:project_id => @project),
                                  :method => 'get',
                                  :update => 'preview',
                                  :with => "Form.serialize('news-form')"
                                }, :accesskey => accesskey(:preview) %> |
             <%= link_to l(:button_cancel), "#", :onclick => 'Element.hide("edit-news"); return false;' %>
             <% end %>
             <div id="preview" class="wiki"></div>
             </div>
             <% end %>
             <p><% unless @news.summary.blank? %><em><%=h @news.summary %></em><br /><% end %>
             <span class="author"><%= authoring @news.created_on, @news.author %></span></p>
             <div class="wiki">
             <%= textilizable(@news, :description) %>
             </div>
             <%= link_to_attachments @news %>
             <br />
             <div id="comments" style="margin-bottom:16px;">
             <h3 class="comments"><%= l(:label_comment_plural) %></h3>
             <% @comments.each do |comment| %>
                 <% next if comment.new_record? %>
                 <div class="contextual">
                 <%= link_to_if_authorized image_tag('delete.png'), {:controller => 'comments', :action => 'destroy', :id => @news, :comment_id => comment},
                                                                    :confirm => l(:text_are_you_sure), :method => :delete, :title => l(:button_delete) %>
                 </div>
                 <h4><%= avatar(comment.author, :size => "24") %><%= authoring comment.created_on, comment.author %></h4>
                 <%= textilizable(comment.comments) %>
             <% end if @comments.any? %>
             </div>
-            <% if authorize_for 'comments', 'create' %>
+            <% if @news.commentable? %>
             <p><%= toggle_link l(:label_comment_add), "add_comment_form", :focus => "comment_comments" %></p>
             <% form_tag({:controller => 'comments', :action => 'create', :id => @news}, :id => "add_comment_form", :style => "display:none;") do %>
             <div class="box">
                 <%= text_area 'comment', 'comments', :cols => 80, :rows => 15, :class => 'wiki-edit' %>
                 <%= wikitoolbar_for 'comment_comments' %>
             </div>
             <p><%= submit_tag l(:button_add) %></p>
             <% end %>
             <% end %>
             <% html_title @news.title -%>
             <% content_for :header_tags do %>
               <%= stylesheet_link_tag 'scm' %>
             <% end %>

test/functional/comments_controller_test.rb +9 0

             # Redmine - project management software
             # Copyright (C) 2006-2011  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.expand_path('../../test_helper', __FILE__)
             class CommentsControllerTest < ActionController::TestCase
               fixtures :projects, :users, :roles, :members, :member_roles, :enabled_modules, :news, :comments
               def setup
                 User.current = nil
               end
               def test_add_comment
                 @request.session[:user_id] = 2
                 post :create, :id => 1, :comment => { :comments => 'This is a test comment' }
                 assert_redirected_to '/news/1'
                 comment = News.find(1).comments.find(:first, :order => 'created_on DESC')
                 assert_not_nil comment
                 assert_equal 'This is a test comment', comment.comments
                 assert_equal User.find(2), comment.author
               end
               def test_empty_comment_should_not_be_added
                 @request.session[:user_id] = 2
                 assert_no_difference 'Comment.count' do
                   post :create, :id => 1, :comment => { :comments => '' }
                   assert_response :redirect
                   assert_redirected_to '/news/1'
                 end
               end
+              def test_create_should_be_denied_if_news_is_not_commentable
+                News.any_instance.stubs(:commentable?).returns(false)
+                @request.session[:user_id] = 2
+                assert_no_difference 'Comment.count' do
+                  post :create, :id => 1, :comment => { :comments => 'This is a test comment' }
+                  assert_response 403
+                end
+              end
               def test_destroy_comment
                 comments_count = News.find(1).comments.size
                 @request.session[:user_id] = 2
                 delete :destroy, :id => 1, :comment_id => 2
                 assert_redirected_to '/news/1'
                 assert_nil Comment.find_by_id(2)
                 assert_equal comments_count - 1, News.find(1).comments.size
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages