From 263f6cd33f03c6d34fb4b44f555a255df1b7c8ae Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Thu, 7 Apr 2016 17:00:21 +0200 Subject: [PATCH] Allow users to delete their screenshots --- app/controllers/packages_controller.rb | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/app/controllers/packages_controller.rb b/app/controllers/packages_controller.rb index 73910c5..f91ccf0 100644 --- a/app/controllers/packages_controller.rb +++ b/app/controllers/packages_controller.rb @@ -57,9 +57,16 @@ class PackagesController < ApplicationController end def delete_screenshot + # Is the user allowed to delete the screenshot? @screenshot = Screenshot.find(params[:id]) - @screenshot.destroy - redirect_to package_path + + if user_can_alter_screenshot? + @screenshot.destroy + redirect_to package_path + flash['notice'] = "Screenshot deleted." + else + head :forbidden + end end # Returns a 160x120 thumbnail image if posssible. @@ -115,4 +122,11 @@ class PackagesController < ApplicationController return packages end + + # Check if the user is allowed to do changed to a screenshot + def user_can_alter_screenshot? + # - Is this the user's own screenshot? + # - Is the user an admin (=logged in)? + @screenshot.uploaderhash == session[:token] or user_signed_in? + end end