Merge remote-tracking branch 'upstream/pull/2226'

diff --cc app/abilities/ability.rb
index 28380392df1aaaba9500b1724e047e8c71f70826,897c3410c2e01858d763eb7b3e593f5e40d6229b..c34f357a97a41b2febfbdb7fa1b0a505ded8e3aa
--- 1/app/abilities/ability.rb
--- 2/app/abilities/ability.rb
+++ b/app/abilities/ability.rb
@@@ -51,7 -52,7 +52,7 @@@ class Abilit
          end
  
          if user.administrator?
-           can [:hide, :unhide, :hidecomment, :unhidecomment], [DiaryEntry, DiaryComment]
 -          can [:hide, :hidecomment], DiaryEntry
++          can [:hide, :unhide, :hidecomment, :unhidecomment], DiaryEntry
            can [:index, :show, :resolve, :ignore, :reopen], Issue
            can :create, IssueComment
            can [:set_status, :delete, :index], User

diff --cc app/views/diary_entries/_diary_comment.html.erb
index 301739eef9cf3ffe19d4b5fd0d0868198772c840,8679f5a08c44fe60fa21bb8e5911241c59ac76b0..639ac9a191f170e055db979142739c8f179dbb07
--- 1/app/views/diary_entries/_diary_comment.html.erb
--- 2/app/views/diary_entries/_diary_comment.html.erb
+++ b/app/views/diary_entries/_diary_comment.html.erb
@@@ -7,13 -7,9 +7,13 @@@
    </p>
  
    <div class="richtext"><%= diary_comment.body.to_html %></div>
-   <% if current_user && current_user.administrator? %>
+   <% if can? :hidecomment, DiaryEntry %>
      <span>
 -      <%= link_to t(".hide_link"), hide_diary_comment_path(:display_name => diary_comment.diary_entry.user.display_name, :id => diary_comment.diary_entry.id, :comment => diary_comment.id), :method => :post, :data => { :confirm => t(".confirm") } %>
 +      <% if diary_comment.visible? %>
 +        <%= link_to t(".hide_link"), hide_diary_comment_path(:display_name => diary_comment.diary_entry.user.display_name, :id => diary_comment.diary_entry.id, :comment => diary_comment.id), :method => :post, :data => { :confirm => t(".confirm") } %>
 +      <% else %>
 +        <%= link_to t(".unhide_link"), unhide_diary_comment_path(:display_name => diary_comment.diary_entry.user.display_name, :id => diary_comment.diary_entry.id, :comment => diary_comment.id), :method => :post, :data => { :confirm => t(".confirm") } %>
 +      <% end %>
      </span>
    <% end %>
  </div>

diff --cc app/views/diary_entries/_diary_entry.html.erb
index 5674a37b7c4d70f9b0041de822baf5b6ea92fce9,0aff1b113ef3c8c2c4b959eae74d00ff2d953356..c7dbec38616f8a623382905127af877b0cb67250
--- 1/app/views/diary_entries/_diary_entry.html.erb
--- 2/app/views/diary_entries/_diary_entry.html.erb
+++ b/app/views/diary_entries/_diary_entry.html.erb
@@@ -37,13 -37,9 +37,13 @@@
        </li>
      <% end %>
  
-     <% if current_user && current_user.administrator? %>
+     <% if can? :hide, DiaryEntry %>
        <li>
 -        <%= link_to t(".hide_link"), hide_diary_entry_path(:display_name => diary_entry.user.display_name, :id => diary_entry.id), :method => :post, :data => { :confirm => t(".confirm") } %>
 +        <% if diary_entry.visible %>
 +          <%= link_to t(".hide_link"), hide_diary_entry_path(:display_name => diary_entry.user.display_name, :id => diary_entry.id), :method => :post, :data => { :confirm => t(".confirm") } %>
 +        <% else %>
 +          <%= link_to t(".unhide_link"), unhide_diary_entry_path(:display_name => diary_entry.user.display_name, :id => diary_entry.id), :method => :post, :data => { :confirm => t(".confirm") } %>
 +        <% end %>
        </li>
      <% end %>
    </ul>

diff --cc test/controllers/diary_entries_controller_test.rb
index 2b4230db7a41cfbfdf92cb4a6bcd73fcc611900c,b17d974d1f65deb85c9056304c2e672d43115c3f..fd03758233c5699421b8025f8812fb493583a1f0
--- 1/test/controllers/diary_entries_controller_test.rb
--- 2/test/controllers/diary_entries_controller_test.rb
+++ b/test/controllers/diary_entries_controller_test.rb
@@@ -758,38 -749,11 +769,38 @@@ class DiaryEntriesControllerTest < Acti
      assert_equal false, DiaryEntry.find(diary_entry.id).visible
    end
  
 +  def test_unhide
 +    user = create(:user)
 +
 +    # Try without logging in
 +    diary_entry = create(:diary_entry, :user => user, :visible => false)
 +    post :unhide,
 +         :params => { :display_name => user.display_name, :id => diary_entry.id }
 +    assert_response :forbidden
 +    assert_equal false, DiaryEntry.find(diary_entry.id).visible
 +
 +    # Now try as a normal user
 +    post :unhide,
 +         :params => { :display_name => user.display_name, :id => diary_entry.id },
 +         :session => { :user => user }
 +    assert_response :redirect
 +    assert_redirected_to :controller => :errors, :action => :forbidden
 +    assert_equal false, DiaryEntry.find(diary_entry.id).visible
 +
 +    # Finally try as an administrator
 +    post :unhide,
 +         :params => { :display_name => user.display_name, :id => diary_entry.id },
 +         :session => { :user => create(:administrator_user) }
 +    assert_response :redirect
 +    assert_redirected_to :action => :index, :display_name => user.display_name
 +    assert_equal true, DiaryEntry.find(diary_entry.id).visible
 +  end
 +
    def test_hidecomment
      user = create(:user)
-     administrator_user = create(:administrator_user)
      diary_entry = create(:diary_entry, :user => user)
      diary_comment = create(:diary_comment, :diary_entry => diary_entry)
+ 
      # Try without logging in
      post :hidecomment,
           :params => { :display_name => user.display_name, :id => diary_entry.id, :comment => diary_comment.id }