AutoCommit Son Aug 2 10:03:02 CEST 2015

app/controllers/comments_controller.rb

@@ -1,11 +1,11 @@
 class CommentsController < ApplicationController
+  load_and_authorize_resource
   before_filter :decode_commentable_type
   def index
     @commentable=params[:commentable_type].constantize.find(params[:commentable_id]) unless params[:commentable_type].nil? or params[:commentable_id].nil?
+   @comments=@commentable.comments.order(:created_at).roots.accessible_by(current_ability, :show).page(params[:page]).per(Comment::NUM[params[:commentable_type]]).reverse_order
 
-   @comments=@commentable.comments.order(:created_at).roots.page(params[:page]).per(Comment::NUM[params[:commentable_type]]).reverse_order
     respond_to do |format|
-      format.html # new.html.erb
       format.js
     end
 
@@ -20,6 +20,7 @@ before_filter :decode_commentable_type
     @comment = Comment.find(params[:id])
     respond_to do |format|
       format.js 
+      format.html {redirect_to @comment.commentable}
     end
   end
   def new

app/controllers/survey/answers_controller.rb

@@ -1,6 +1,8 @@
 class Survey::AnswersController < ApplicationController
   # GET /survey/answers
   # GET /survey/answers.json
+  load_and_authorize_resource
+
   def index
     @survey_answers = Survey::Answer.all
 

app/controllers/survey/choices_controller.rb

@@ -1,6 +1,8 @@
 class Survey::ChoicesController < ApplicationController
   # GET /survey/choices
   # GET /survey/choices.json
+  load_and_authorize_resource
+
   def index
     @survey_choices = Survey::Choice.all
 

app/controllers/survey/questions_controller.rb

@@ -1,6 +1,8 @@
 class Survey::QuestionsController < ApplicationController
   # GET /survey/questions
   # GET /survey/questions.json
+  load_and_authorize_resource
+
   def index
     @survey_questions = Survey::Question.all
     respond_to do |format|

app/models/ability.rb

@@ -10,8 +10,24 @@ class Ability
       end
     end
     user ||=  User.new # guest user (not logged in)
+
     can :manage, Survey::Question 
-    can :manage, Comment
+    can :manage, Survey::Choice
+    can :manage, Survey::Answer
+
+    #---------------------------------------------------
+    
+    can :index, Comment
+    can :show, Comment
+    if loggedin
+      can [:create,:new], Comment
+    end
+
+  #  can :manage, Comment
+    unless user.has_role?("fetadmin")
+      cannot :delete, Comment
+cannot :destroy, Comment
+    end
     #-----------------------------------------------------
     # Rechteverwaltung fuer Studien Modul
     can [:show, :index], Studium, :visible=>true

app/models/comment.rb

@@ -1,5 +1,5 @@
 class Comment < ActiveRecord::Base
-  attr_accessible :text,:anonym, :intern, :hidden
+  attr_accessible :text,:anonym, :intern, :hidden, :commentable_id, :commentable_type
   # commentable depth, official, intern, anonym
   acts_as_votable
   acts_as_nested_set  :scope => [:commentable_id, :commentable_type]

app/views/beispiele/_beispiel.html.erb

@@ -39,3 +39,4 @@
   </div>
   <% end %>
 
+</div>

app/views/comments/index.html.erb

@@ -1,22 +0,0 @@
-<h1>Listing comments</h1>
-<%= render partial:"comments/comments", object: @comments %>
-
-<table>
-  <tr>
-    <th></th>
-    <th></th>
-    <th></th>
-  </tr>
-
-<% @comments.each do |comment| %>
-  <tr>
-    <td><%= link_to 'Show', comment %></td>
-    <td><%= link_to 'Edit', edit_comment_path(comment) %></td>
-    <td><%= link_to 'Destroy', comment, method: :delete, data: { confirm: 'Are you sure?' } %></td>
-  </tr>
-<% end %>
-</table>
-
-<br />
-
-<%= link_to 'New Comment', new_comment_path %>