diff --git a/app/controllers/pools_controller.rb b/app/controllers/pools_controller.rb index 57aef5347..082789548 100644 --- a/app/controllers/pools_controller.rb +++ b/app/controllers/pools_controller.rb @@ -2,6 +2,7 @@ class PoolsController < ApplicationController respond_to :html, :xml, :json, :js before_filter :member_only, :except => [:index, :show] before_filter :moderator_only, :only => [:destroy] + rescue_from User::PrivilegeError, :with => "static/access_denied" def new @pool = Pool.new @@ -45,6 +46,9 @@ class PoolsController < ApplicationController def destroy @pool = Pool.find(params[:id]) + if !@pool.deletable_by?(CurrentUser.user) + raise User::PrivilegeError + end @pool.destroy respond_with(@pool, :notice => "Pool deleted") end diff --git a/app/models/pool.rb b/app/models/pool.rb index 6b7e85714..13adcae8b 100644 --- a/app/models/pool.rb +++ b/app/models/pool.rb @@ -10,6 +10,7 @@ class Pool < ActiveRecord::Base before_validation :normalize_post_ids before_validation :initialize_creator, :on => :create after_save :create_version + before_destroy :create_mod_action_for_destroy attr_accessible :name, :description, :post_ids, :post_id_array, :is_active, :post_count def self.name_to_id(name) @@ -66,6 +67,14 @@ class Pool < ActiveRecord::Base post_ids =~ /(?:\A| )#{post_id}(?:\Z| )/ end + def deletable_by?(user) + user.is_janitor? + end + + def create_mod_action_for_destroy + ModAction.create(:description => "deleted pool ##{id} name=#{name} post_ids=#{post_ids}") + end + def add!(post) return if contains?(post.id) diff --git a/app/views/pools/_secondary_links.html.erb b/app/views/pools/_secondary_links.html.erb index fd1957600..7f1946f1a 100644 --- a/app/views/pools/_secondary_links.html.erb +++ b/app/views/pools/_secondary_links.html.erb @@ -8,6 +8,9 @@