Don't show unredacted element versions to non-moderators

[rails.git] / app / controllers / diary_entries_controller.rb

diff --git a/app/controllers/diary_entries_controller.rb b/app/controllers/diary_entries_controller.rb
index 0b2fcb73e1a5f85a34aacd6173d9dc3a74024390..1a3d648f460a4f089ca362ac00c9ac88efc7915e 100644 (file)
--- a/app/controllers/diary_entries_controller.rb
+++ b/app/controllers/diary_entries_controller.rb
@@ -47,6 +47,8 @@ class DiaryEntriesController < ApplicationController
         @title = t ".in_language_title", :language => Language.find(params[:language]).english_name
         entries = entries.where(:language_code => params[:language])
       else
+        candidate_codes = preferred_languages.flat_map(&:candidates).uniq.map(&:to_s)
+        @languages = Language.where(:code => candidate_codes).in_order_of(:code, candidate_codes)
         @title = t ".title"
       end
     end
@@ -155,21 +157,25 @@ class DiaryEntriesController < ApplicationController
   end
 
   def subscribe
-    diary_entry = DiaryEntry.find(params[:id])
+    @diary_entry = DiaryEntry.find(params[:id])
 
-    diary_entry.subscriptions.create(:user => current_user) unless diary_entry.subscribers.exists?(current_user.id)
+    if request.post?
+      @diary_entry.subscriptions.create(:user => current_user) unless @diary_entry.subscribers.exists?(current_user.id)
 
-    redirect_to diary_entry_path(diary_entry.user, diary_entry)
+      redirect_to diary_entry_path(@diary_entry.user, @diary_entry)
+    end
   rescue ActiveRecord::RecordNotFound
     render :action => "no_such_entry", :status => :not_found
   end
 
   def unsubscribe
-    diary_entry = DiaryEntry.find(params[:id])
+    @diary_entry = DiaryEntry.find(params[:id])
 
-    diary_entry.subscriptions.where(:user => current_user).delete_all if diary_entry.subscribers.exists?(current_user.id)
+    if request.post?
+      @diary_entry.subscriptions.where(:user => current_user).delete_all if @diary_entry.subscribers.exists?(current_user.id)
 
-    redirect_to diary_entry_path(diary_entry.user, diary_entry)
+      redirect_to diary_entry_path(@diary_entry.user, @diary_entry)
+    end
   rescue ActiveRecord::RecordNotFound
     render :action => "no_such_entry", :status => :not_found
   end
@@ -235,7 +241,7 @@ class DiaryEntriesController < ApplicationController
   def comments
     @title = t ".title", :user => @user.display_name
 
-    comments = DiaryComment.where(:users => @user)
+    comments = DiaryComment.where(:user => @user)
     comments = comments.visible unless can? :unhidecomment, DiaryEntry
 
     @params = params.permit(:display_name, :before, :after)