diff --git a/app/controllers/my_profile/profile_editor_controller.rb b/app/controllers/my_profile/profile_editor_controller.rb index 934479d..b656411 100644 --- a/app/controllers/my_profile/profile_editor_controller.rb +++ b/app/controllers/my_profile/profile_editor_controller.rb @@ -10,6 +10,7 @@ class ProfileEditorController < MyProfileController def index @pending_tasks = Task.to(profile).pending.without_spam.select{|i| user.has_permission?(i.permission, profile)} + @show_appearance_option = user.is_admin?(environment) || !environment.enabled?('disable_appearance') end helper :profile diff --git a/app/controllers/themes_controller.rb b/app/controllers/themes_controller.rb index c12ec08..656b5b9 100644 --- a/app/controllers/themes_controller.rb +++ b/app/controllers/themes_controller.rb @@ -1,6 +1,7 @@ class ThemesController < ApplicationController before_filter :login_required + before_filter :check_user_can_edit_appearance, :only => [:index] no_design_blocks @@ -39,4 +40,11 @@ class ThemesController < ApplicationController redirect_to :action => 'index' end + private + + def check_user_can_edit_appearance + disable_appearance_enabled = !user.is_admin?(environment) && environment.enabled?('disable_appearance') + redirect_to request.referer || "/" if disable_appearance_enabled + end + end diff --git a/app/models/environment.rb b/app/models/environment.rb index e5d8109..5b306ff 100644 --- a/app/models/environment.rb +++ b/app/models/environment.rb @@ -123,6 +123,7 @@ class Environment < ActiveRecord::Base 'disable_asset_events' => _('Disable search for events'), 'disable_categories' => _('Disable categories'), 'disable_header_and_footer' => _('Disable header/footer editing by users'), + 'disable_appearance' => _('Disable appearance editing by users'), 'disable_gender_icon' => _('Disable gender icon'), 'disable_categories_menu' => _('Disable the categories menu'), 'disable_select_city_for_contact' => _('Disable state/city select for contact form'), @@ -158,7 +159,7 @@ class Environment < ActiveRecord::Base 'allow_change_of_redirection_after_login' => _('Allow users to set the page to redirect after login'), 'display_my_communities_on_user_menu' => _('Display on menu the list of communities the user can manage'), 'display_my_enterprises_on_user_menu' => _('Display on menu the list of enterprises the user can manage'), - 'restrict_to_members' => _('Show content only to members') + 'restrict_to_members' => _('Show content only to members'), } end diff --git a/app/views/profile_editor/index.html.erb b/app/views/profile_editor/index.html.erb index 7d3db97..a20bdac 100644 --- a/app/views/profile_editor/index.html.erb +++ b/app/views/profile_editor/index.html.erb @@ -22,7 +22,7 @@ <%= control_panel_button(_('Edit sideboxes'), 'blocks', :controller => 'profile_design', :action => 'index') %> - <%= control_panel_button(_('Edit Appearance'), 'design-editor', :controller => 'profile_themes', :action => 'index') %> + <%= control_panel_button(_('Edit Appearance'), 'design-editor', :controller => 'profile_themes', :action => 'index') if @show_appearance_option %> <%= control_panel_button(_('Edit Header and Footer'), 'header-and-footer', :controller => 'profile_editor', :action => 'header_footer') if user.is_admin?(environment) || (!profile.enterprise? && !environment.enabled?('disable_header_and_footer')) %> diff --git a/test/functional/profile_themes_controller_test.rb b/test/functional/profile_themes_controller_test.rb index ee53a6e..fa743d6 100644 --- a/test/functional/profile_themes_controller_test.rb +++ b/test/functional/profile_themes_controller_test.rb @@ -116,7 +116,7 @@ class ProfileThemesControllerTest < ActionController::TestCase should 'create a new theme' do post :new, :profile => 'testinguser', :name => 'My theme' - + ok('theme should be created') do profile.themes.first.id == 'my-theme' end @@ -197,7 +197,7 @@ class ProfileThemesControllerTest < ActionController::TestCase should 'display "add image" button' do theme = Theme.create('mytheme', :owner => profile) get :edit, :profile => 'testinguser', :id => 'mytheme' - + assert_tag :tag => 'a', :attributes => { :href => '/myprofile/testinguser/profile_themes/add_image/mytheme' } end @@ -329,4 +329,29 @@ class ProfileThemesControllerTest < ActionController::TestCase assert_equal [t2, t1], assigns(:themes) end + should 'user cant edit appearance if environment dont permit' do + environment = Environment.default + environment.settings[:disable_appearance_enabled] = true + environment.save! + + user = create_user('user').person + login_as('user') + + post :index, :profile => user.identifier + assert_response :redirect + end + + should 'admin can edit appearance if environment dont permit' do + user = create_user('user').person + + environment = Environment.default + environment.add_admin(user) + environment.settings[:disable_appearance_enabled] = true + environment.save! + + login_as('user') + + post :index, :profile => user.identifier + assert_response :success + end end -- libgit2 0.21.2