diff --git a/app/controllers/public/profile_controller.rb b/app/controllers/public/profile_controller.rb
index af3a302..f301223 100644
--- a/app/controllers/public/profile_controller.rb
+++ b/app/controllers/public/profile_controller.rb
@@ -211,7 +211,8 @@ class ProfileController < PublicController
def remove_activity
begin
- activity = current_person.tracked_actions.find(params[:activity_id])
+ raise if !can_edit_profile
+ activity = ActionTracker::Record.find(params[:activity_id])
activity.destroy
render :text => _('Activity successfully removed.')
rescue
@@ -219,6 +220,17 @@ class ProfileController < PublicController
end
end
+ def remove_notification
+ begin
+ raise if !can_edit_profile
+ notification = ActionTrackerNotification.find(:first, :conditions => {:profile_id => profile.id, :action_tracker_id => params[:activity_id]})
+ notification.destroy
+ render :text => _('Notification successfully removed.')
+ rescue
+ render :text => _('You could not remove this notification.')
+ end
+ end
+
def profile_info
begin
@block = profile.blocks.find(params[:block_id])
@@ -320,4 +332,8 @@ class ProfileController < PublicController
20
end
+ def can_edit_profile
+ @can_edit_profile ||= user && user.has_permission?('edit_profile', profile)
+ end
+ helper_method :can_edit_profile
end
diff --git a/app/views/profile/_profile_activities.rhtml b/app/views/profile/_profile_activities.rhtml
index d541b8c..3f2e74f 100644
--- a/app/views/profile/_profile_activities.rhtml
+++ b/app/views/profile/_profile_activities.rhtml
@@ -6,7 +6,7 @@
<%= time_ago_as_sentence(activity.created_at) + ' ' + _('ago') %>
<%= link_to activity.user.name, activity.user.url %> <%= describe activity %>
- <%= button_to_remote(:delete, content_tag(:span, _('Remove')), :url =>{:action => 'remove_activity', :activity_id => activity.id}, :update => "profile-activity-item-#{activity.id}") if logged_in? && current_person == @profile %>
+ <%= button_to_remote(:delete, content_tag(:span, _('Remove')), :url =>{:action => 'remove_activity', :activity_id => activity.id}, :update => "profile-activity-item-#{activity.id}") if can_edit_profile %>
diff --git a/app/views/profile/_profile_network_activities.rhtml b/app/views/profile/_profile_network_activities.rhtml
index 497283d..70959e9 100644
--- a/app/views/profile/_profile_network_activities.rhtml
+++ b/app/views/profile/_profile_network_activities.rhtml
@@ -9,6 +9,7 @@
<%= time_ago_as_sentence(activity.created_at) + ' ' + _('ago') %>
<%= link_to activity.user.name, activity.user.url %> <%= describe activity %>
+ <%= button_to_remote(:delete, content_tag(:span, _('Remove')), :url =>{:action => 'remove_notification', :activity_id => activity.id}, :update => "profile-network-item-#{activity.id}") if can_edit_profile %>
<%= _('In community %s') % link_to(activity.target.name, activity.target.url) if !profile.is_a?(Community) && activity.target.is_a?(Community) %>
diff --git a/test/functional/profile_controller_test.rb b/test/functional/profile_controller_test.rb
index b45c497..79b3e28 100644
--- a/test/functional/profile_controller_test.rb
+++ b/test/functional/profile_controller_test.rb
@@ -1032,14 +1032,43 @@ class ProfileControllerTest < Test::Unit::TestCase
assert_redirected_to :controller => 'account', :action => 'login'
end
- should "not remove an activity of another user" do
- login_as(profile.identifier)
- p1 = fast_create(Person)
- at = fast_create(ActionTracker::Record, :user_id => p1.id)
- atn = fast_create(ActionTrackerNotification, :profile_id => p1.id, :action_tracker_id => at.id)
- count = ActionTrackerNotification.count
- post :remove_activity, :profile => profile.identifier, :activity_id => at.id
- assert_equal count, ActionTrackerNotification.count
+ should "remove an activity of another person if user has permissions to edit it" do
+ user = create_user('owner').person
+ login_as(user.identifier)
+ owner = create_user('owner').person
+ activity = fast_create(ActionTracker::Record, :user_id => owner.id)
+ @controller.stubs(:user).returns(user)
+ @controller.stubs(:profile).returns(owner)
+
+ assert_no_difference ActionTracker::Record, :count do
+ post :remove_activity, :profile => owner.identifier, :activity_id => activity.id
+ end
+
+ owner.environment.add_admin(user)
+
+ assert_difference ActionTracker::Record, :count, -1 do
+ post :remove_activity, :profile => owner.identifier, :activity_id => activity.id
+ end
+ end
+
+ should "remove a notification of another profile if user has permissions to edit it" do
+ user = create_user('owner').person
+ login_as(user.identifier)
+ profile = fast_create(Profile)
+ activity = fast_create(ActionTracker::Record, :user_id => user.id)
+ fast_create(ActionTrackerNotification, :profile_id => profile.id, :action_tracker_id => activity.id)
+ @controller.stubs(:user).returns(user)
+ @controller.stubs(:profile).returns(profile)
+
+ assert_no_difference ActionTrackerNotification, :count do
+ post :remove_notification, :profile => profile.identifier, :activity_id => activity.id
+ end
+
+ profile.environment.add_admin(user)
+
+ assert_difference ActionTrackerNotification, :count, -1 do
+ post :remove_activity, :profile => profile.identifier, :activity_id => activity.id
+ end
end
should "not show the scrap button on network activity if the user don't follow the user" do
--
libgit2 0.21.2