Allow users to delete their screenshots

app/controllers/packages_controller.rb

@@ -57,9 +57,16 @@ class PackagesController < ApplicationController
   end
 
   def delete_screenshot
+    # Is the user allowed to delete the screenshot?
     @screenshot = Screenshot.find(params[:id])
-    @screenshot.destroy
+
-    redirect_to package_path
+    if user_can_alter_screenshot?
+      @screenshot.destroy
+      redirect_to package_path
+      flash['notice'] = "Screenshot deleted."
+    else
+      head :forbidden
+    end
   end
 
   # Returns a 160x120 thumbnail image if posssible.
@@ -115,4 +122,11 @@ class PackagesController < ApplicationController
 
     return packages
   end
+
+  # Check if the user is allowed to do changed to a screenshot
+  def user_can_alter_screenshot?
+    # - Is this the user's own screenshot?
+    # - Is the user an admin (=logged in)?
+    @screenshot.uploaderhash == session[:token] or user_signed_in?
+  end
 end