prevent update of any object without providing the correct/current

[rails.git] / app / controllers / message_controller.rb

diff --git a/app/controllers/message_controller.rb b/app/controllers/message_controller.rb
index 52f38e9f6a1d3d4e166423b432b57ea9b6b4a7d7..8aecef98e56a87059595550c72064170fca66501 100644 (file)
--- a/app/controllers/message_controller.rb
+++ b/app/controllers/message_controller.rb
@@ -20,10 +20,32 @@ class MessageController < ApplicationController
     end
   end
 
+  def destroy
+    @message = Message.find(params[:message_id], :conditions => ["to_user_id = ? or from_user_id = ?", @user.id, @user.id ])
+    if !@message.message_read
+      flash[:notice] = 'Message not read and so not deleted'
+      redirect_to :controller => 'message', :action => 'inbox', :display_name => @user.display_name
+    else
+      flash[:notice] = "Message '#{@message.title}' deleted"
+      @message.destroy
+      redirect_to :controller => 'message', :action => 'inbox', :display_name => @user.display_name
+    end
+  end
+
+  def reply
+    message = Message.find(params[:message_id], :conditions => ["to_user_id = ? or from_user_id = ?", @user.id, @user.id ])
+    @body = "\n\nOn #{message.sent_on} #{message.sender.display_name} wrote:\n #{message.body}" 
+    @title = "Re: #{message.title}"
+    @user_id = message.from_user_id
+    render :action => 'new'
+  rescue ActiveRecord::RecordNotFound
+    render :nothing => true, :status => :not_found
+  end
+
   def read
     @title = 'read message'
-    @message = Message.find(params[:message_id], :conditions => ["to_user_id = ?", @user.id])
-    @message.message_read = 1
+    @message = Message.find(params[:message_id], :conditions => ["to_user_id = ? or from_user_id = ?", @user.id, @user.id ])
+    @message.message_read = 1 if @message.to_user_id == @user.id
     @message.save
   rescue ActiveRecord::RecordNotFound
     render :nothing => true, :status => :not_found
@@ -37,6 +59,14 @@ class MessageController < ApplicationController
     end
   end
 
+  def outbox
+    @title = 'outbox'
+    if @user and params[:display_name] == @user.display_name
+    else
+      redirect_to :controller => 'message', :action => 'outbox', :display_name => @user.display_name
+    end
+  end
+
   def mark
     if params[:message_id]
       id = params[:message_id]