Allow admins and moderators to delete traces

Fixes #1625

diff --git a/app/controllers/trace_controller.rb b/app/controllers/trace_controller.rb
index a720c5fff438dc1ed4e8d9152e85dacf44ed4cc1..81c7864738cf3d5208a1566f23c7a2a86becd9fd 100644 (file)
--- a/app/controllers/trace_controller.rb
+++ b/app/controllers/trace_controller.rb
@@ -186,7 +186,7 @@ class TraceController < ApplicationController
 
     if !trace.visible?
       head :not_found
-    elsif current_user.nil? || trace.user != current_user
+    elsif current_user.nil? || (trace.user != current_user && !current_user.administrator? && !current_user.moderator?)
       head :forbidden
     else
       trace.visible = false

diff --git a/app/views/trace/view.html.erb b/app/views/trace/view.html.erb
index 57cc39a089bac7751374b28106a41d94cc4e144f..351c69227921a2c038768b5fd3085d55d376ab3b 100644 (file)
--- a/app/views/trace/view.html.erb
+++ b/app/views/trace/view.html.erb
@@ -54,9 +54,11 @@
 
 <br /><br />
 
-<%= if_user(@trace.user) do %>
+<% if current_user && (current_user==@trace.user || current_user.administrator? || current_user.moderator?)%>
   <div class="buttons">
-    <%= button_to t('trace.view.edit_track'), :controller => 'trace', :action => 'edit', :id => @trace.id %>
+    <%= if_user(@trace.user) do %>
+      <%= button_to t('trace.view.edit_track'), :controller => 'trace', :action => 'edit', :id => @trace.id %>
+    <% end %>
     <%= button_to t('trace.view.delete_track'), :controller => 'trace', :action => 'delete', :id => @trace.id %>
   </div>
 <% end %>

diff --git a/test/controllers/trace_controller_test.rb b/test/controllers/trace_controller_test.rb
index 2dafa5394f0b20d59b651e082532f2aa62ca8ab3..a9008bc972886fefc3474ee5ab73225879654414 100644 (file)
--- a/test/controllers/trace_controller_test.rb
+++ b/test/controllers/trace_controller_test.rb
@@ -679,12 +679,22 @@ class TraceControllerTest < ActionController::TestCase
     post :delete, :params => { :display_name => deleted_trace_file.user.display_name, :id => deleted_trace_file.id }, :session => { :user => deleted_trace_file.user }
     assert_response :not_found
 
-    # Finally with a trace that we are allowed to delete
+    # Now with a trace that we are allowed to delete
     post :delete, :params => { :display_name => public_trace_file.user.display_name, :id => public_trace_file.id }, :session => { :user => public_trace_file.user }
     assert_response :redirect
     assert_redirected_to :action => :list, :display_name => public_trace_file.user.display_name
     trace = Trace.find(public_trace_file.id)
     assert_equal false, trace.visible
+
+    # Finally with a trace that is deleted by an admin
+    public_trace_file = create(:trace, :visibility => "public")
+    admin = create(:administrator_user)
+
+    post :delete, :params => { :display_name => admin.display_name, :id => public_trace_file.id }, :session => { :user => admin }
+    assert_response :redirect
+    assert_redirected_to :action => :list, :display_name => admin.display_name
+    trace = Trace.find(public_trace_file.id)
+    assert_equal false, trace.visible
   end
 
   # Check getting a specific trace through the api