the real first version of the site

steveklabnik · steveklabnik · commit d4f4fad3bf5f · 2009-12-24T01:05:52.000-05:00
diff --git a/app/controllers/messages_controller.rb b/app/controllers/messages_controller.rb
@@ -15,6 +15,10 @@ def index
 
   def show
     @message = Message.find(params[:id])
+    if @message.sender != current_user && @message.recipient != current_user
+      redirect_to root_url
+      return
+    end
     respond_to do |format|
       format.html
       format.yaml {require 'yaml'; render :text => (Hash.from_xml(@message.to_xml)).to_yaml}
@@ -27,6 +31,7 @@ def new
 
   def edit
     @message = Message.find(params[:id])
+    redirect_to root_url if @message.sender != current_user
   end
 
   def create
@@ -57,6 +62,10 @@ def create
 
   def update
     @message = Message.find(params[:id])
+    if @message.sender != current_user
+      redirect_to root_url
+      return
+    end
 
 		if @message.update_attributes(params[:message])
 			flash[:notice] = 'Message was successfully updated.'
@@ -68,6 +77,10 @@ def update
 
   def destroy
     @message = Message.find(params[:id])
+    if @message.sender != current_user
+      redirect_to root_url
+      return
+    end
     @message.destroy
 
     redirect_to(messages_url)
diff --git a/app/controllers/posts_controller.rb b/app/controllers/posts_controller.rb
@@ -24,6 +24,10 @@ def show
   # GET /posts/new
   # GET /posts/new.xml
   def new
+    if current_user != User.first
+      redirect_to posts_path
+      return
+    end
     @post = Post.new
 
     respond_to do |format|
@@ -34,12 +38,20 @@ def new
 
   # GET /posts/1/edit
   def edit
+    if current_user != User.first
+      redirect_to posts_path
+      return
+    end
     @post = Post.find(params[:id])
   end
 
   # POST /posts
   # POST /posts.xml
   def create
+    if current_user != User.first
+      redirect_to posts_path
+      return
+    end
     @post = Post.new(params[:post])
 
     respond_to do |format|
@@ -57,6 +69,10 @@ def create
   # PUT /posts/1
   # PUT /posts/1.xml
   def update
+    if current_user != User.first
+      redirect_to posts_path
+      return
+    end
     @post = Post.find(params[:id])
 
     respond_to do |format|
@@ -74,6 +90,10 @@ def update
   # DELETE /posts/1
   # DELETE /posts/1.xml
   def destroy
+    if current_user != User.first
+      redirect_to posts_path
+      return
+    end
     @post = Post.find(params[:id])
     @post.destroy
 
diff --git a/app/controllers/programs_controller.rb b/app/controllers/programs_controller.rb
@@ -22,6 +22,10 @@ def new
 
   def edit
     @program = Program.find(params[:id])
+    if current_user != @program.user
+      redirect_to root_url
+      return
+    end
   end
 
   def create
@@ -38,6 +42,10 @@ def create
 
   def update
     @program = Program.find(params[:id])
+    if current_user != @program.user
+      redirect_to root_url
+      return
+    end
 
 		if @program.update_attributes(params[:program])
 			flash[:notice] = 'Program was successfully updated.'
@@ -49,6 +57,10 @@ def update
 
   def destroy
     @program = Program.find(params[:id])
+    if current_user != @program.user
+      redirect_to root_url
+      return
+    end
     @program.destroy
 		redirect_to user_path(current_user.username)
   end
diff --git a/app/views/programs/show.html.erb b/app/views/programs/show.html.erb
@@ -23,10 +23,12 @@
 <% end %>
 <% end %>
 <br style="clear:both"/>
+<% unless current_user.nil? %>
 <h2>Make a comment</h2>
 <% form_for Comment.new do |f| %>
   <%= f.text_area :text, :rows => 10, :cols => 65 %><br />
   <%= f.hidden_field :program_id, :value => @program.id %>
   <%= f.submit %>
 <% end %>
+<% end %>
 
