diff --git a/app/controllers/timelines_controller.rb b/app/controllers/timelines_controller.rb index 3e8b396b..4deb5f63 100644 --- a/app/controllers/timelines_controller.rb +++ b/app/controllers/timelines_controller.rb @@ -14,6 +14,12 @@ class TimelinesController < ApplicationController end end + def show + unless @timeline.privacy == 'public' || (user_signed_in? && current_user == @timeline.user) + return redirect_back(fallback_location: root_path, notice: "You don't have permission to view that timeline!") + end + end + # GET /timelines/new def new timeline = current_user.timelines.create.reload diff --git a/app/views/timelines/show.html.erb b/app/views/timelines/show.html.erb index 290d3824..ed993067 100644 --- a/app/views/timelines/show.html.erb +++ b/app/views/timelines/show.html.erb @@ -1,4 +1,126 @@ -
<%= notice %>
+<%= form_for @timeline, html: { class: 'autosave-form' }, remote: true do |f| %> +