diff --git a/app/controllers/projects_controller.rb b/app/controllers/projects_controller.rb index 8753bad..e6041f6 100644 --- a/app/controllers/projects_controller.rb +++ b/app/controllers/projects_controller.rb @@ -22,7 +22,8 @@ class ProjectsController < ApplicationController before_filter :find_project, :except => [ :index, :list, :new, :create, :copy ] before_filter :authorize, :except => [ :index, :list, :new, :create, :copy, :archive, :unarchive, :destroy] before_filter :authorize_global, :only => [:new, :create] - before_filter :require_admin, :only => [ :copy, :archive, :unarchive, :destroy ] + before_filter :require_admin, :only => [:archive, :unarchive, :destroy ] + before_filter :require_edit_permission_to_copy, :only => [:copy] accept_rss_auth :index accept_api_auth :index, :show, :create, :update, :destroy require_sudo_mode :destroy @@ -39,6 +40,22 @@ class ProjectsController < ApplicationController helper :repositories helper :members + def require_edit_permission_to_copy + current_project = Project.find(params[:id]) + allowed = User.current.allowed_to?({:controller => 'projects', :action => 'edit'}, current_project, :global => false) + if allowed + true + else + if @project && @project.archived? + render_403 :message => :notice_not_authorized_archived_project + else + deny_access + end + end + rescue ActiveRecord::RecordNotFound + render_404 + end + # Lists visible projects def index scope = Project.visible.sorted diff --git a/app/views/projects/show.html.erb b/app/views/projects/show.html.erb index b68a5ac..3fbf605 100644 --- a/app/views/projects/show.html.erb +++ b/app/views/projects/show.html.erb @@ -2,6 +2,9 @@ <% if User.current.allowed_to?(:add_subprojects, @project) %> <%= link_to l(:label_subproject_new), new_project_path(:parent_id => @project), :class => 'icon icon-add' %> <% end %> + <% if User.current.allowed_to?({:controller => 'projects', :action => 'edit'}, @project) %> + <%= link_to 'Copy project', copy_project_path(@project), :class => 'icon icon-add' %> + <% end %> <% if User.current.allowed_to?(:close_project, @project) %> <% if @project.active? %> <%= link_to l(:button_close), close_project_path(@project), :data => {:confirm => l(:text_are_you_sure)}, :method => :post, :class => 'icon icon-lock' %>