Foodsoft/foodsoft
1
1
Fork 0
Code Issues 36 Pull requests 5 Projects 1 Releases Wiki Activity

Ensure mail privacy in message reply and show view.

Browse source 
Thanks to @JuliusR for reporting.
This commit is contained in:
Benjamin Meichsner 2013-03-24 01:36:50 +01:00
parent da72d3a61c
commit 18f6cadca2
2 changed files with 16 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

16
app/models/message.rb
View file

@ -2,7 +2,7 @@ class Message < ActiveRecord::Base
belongs_to :sender, :class_name => "User", :foreign_key => "sender_id"
serialize :recipients_ids, Array
attr_accessor :sent_to_all, :group_id, :recipient_tokens
attr_accessor :sent_to_all, :group_id, :recipient_tokens, :reply_to
scope :pending, where(:email_state => 0)
scope :sent, where(:email_state => 1)
@ -46,11 +46,11 @@ class Message < ActiveRecord::Base
end
def reply_to=(message_id)
message = Message.find(message_id)
add_recipients([message.sender])
self.subject = "Re: #{message.subject}"
self.body = "#{message.sender.nick} schrieb am #{I18n.l(message.created_at, :format => :short)}:\n"
message.body.each_line{ |l| self.body += "> #{l}" }
@reply_to = Message.find(message_id)
add_recipients([@reply_to.sender])
self.subject = "Re: #{@reply_to.subject}"
self.body = "#{@reply_to.sender.nick} schrieb am #{I18n.l(@reply_to.created_at, :format => :short)}:\n"
@reply_to.body.each_line{ |l| self.body += "> #{l}" }
end
def mail_to=(user_id)
@ -83,6 +83,10 @@ class Message < ActiveRecord::Base
end
update_attribute(:email_state, 1)
end
def is_readable_for?(user)
!private || sender == user || recipients_ids.include?(user.id)
end
end