ActionItem295: checking access to article

git-svn-id: https://svn.colivre.coop.br/svn/noosfero/trunk@1825 3f533792-8f58-4932-b0fe-aaf55b0a4547

ActionItem295: checking access to article
git-svn-id: https://svn.colivre.coop.br/svn/noosfero/trunk@1825 3f533792-8f58-4932-b0fe-aaf55b0a4547
AntonioTerceiro
1 parent 0b6af513
Showing 3 changed files with 18 additions and 18 deletions Show diff stats
app/controllers/public/content_viewer_controller.rb
app/views/content_viewer/access_denied.rhtml
test/functional/content_viewer_controller_test.rb
@@ -21,6 +21,10 @@ class ContentViewerController &lt; PublicController
       end
     end
+    if !@page.display_to?(user)
+      render :action => 'access_denied', :status => 403
+    end
+
     if @page.mime_type != 'text/html'
       headers['Content-Type'] = @page.mime_type
       data = @page.data
@@ -0,0 +1,5 @@
+<h1><%= _('Access denied') %></h1>
+
+<p>
+<%= _('You are not allowed to view this content.') %>
+</p>
@@ -229,31 +229,22 @@ class ContentViewerControllerTest &lt; Test::Unit::TestCase
     assert_tag :tag => 'div', :attributes => { :class => 'article-tags' }, :descendant => { :content => /This article's tags:/ }
   end
-  should 'not display articles from private content' do
+  should 'not display forbidden articles' do
     profile.articles.create!(:name => 'test')
     profile.update_attributes!(:public_content => false)
+    Article.any_instance.expects(:display_to?).with(anything).returns(false)
     get :view_page, :profile => profile.identifier, :page => [ 'test' ]
     assert_response 403
   end
-  #should 'display articles to its owner' do
-    #profile.articles.create!(:name => 'test')
-    #profile.update_attributes!(:public_content => false)
-
-    #login_as(@profile.identifier)
-    #get :view_page, :profile => profile.identifier, :page => [ 'test' ]
-    #assert_response 200
-  #end
-
-  #should 'display articles to profile members' do
-    #c = Community.create!(:name => 'my community')
-    #c.update_attributes!(:public_content => false)
-    #c.add_member(@profile)
+  should 'display allowed articles' do
+    profile.articles.create!(:name => 'test')
+    profile.update_attributes!(:public_content => false)
-    #login_as(@profile.identifier)
-    #get :view_page, :profile => profile.identifier, :page => [ 'test' ]
-    #assert_response 200
-  #end
+    Article.any_instance.expects(:display_to?).with(anything).returns(true)
+    get :view_page, :profile => profile.identifier, :page => [ 'test' ]
+    assert_response 200
+  end
 end
@@ -0,0 +1,5 @@		@@ -0,0 +1,5 @@
	1	+<h1><%= _('Access denied') %></h1>
	2	+
	3	+<p>
	4	+<%= _('You are not allowed to view this content.') %>
	5	+</p>