Ensure views only link to those actions allowed for current user

2018-11-30 13:29:04 +01:00
parent d3f67ab4c7
commit 2125fb1c1d
56 changed files with 128 additions and 264 deletions
--- a/app/controllers/comments_controller.rb
+++ b/app/controllers/comments_controller.rb
@ -9,7 +9,6 @@ class CommentsController < ApplicationController
  end
  private :authorize!

-  # GET /comments
  # GET /comments.json
  def index
    file = CodeOcean::File.find(params[:file_id])
@ -29,24 +28,11 @@ class CommentsController < ApplicationController
    authorize!
  end

-  # GET /comments/1
  # GET /comments/1.json
  def show
    authorize!
  end

-  # GET /comments/new
-  def new
-    @comment = Comment.new
-    authorize!
-  end
-
-  # GET /comments/1/edit
-  def edit
-    authorize!
-  end
-
-  # POST /comments
  # POST /comments.json
  def create
    @comment = Comment.new(comment_params_without_request_id)
@ -59,40 +45,31 @@ class CommentsController < ApplicationController
          send_mail_to_subscribers @comment, request_for_comment
        end

-        format.html { redirect_to @comment, notice: 'Comment was successfully created.' }
-        format.json { render :show, status: :created, location: @comment }
+        render :show, status: :created, location: @comment
      else
-        format.html { render :new }
-        format.json { render json: @comment.errors, status: :unprocessable_entity }
+        render json: @comment.errors, status: :unprocessable_entity
      end
    end
    authorize!
  end

-  # PATCH/PUT /comments/1
  # PATCH/PUT /comments/1.json
  def update
    respond_to do |format|
      if @comment.update(comment_params_without_request_id)
-        format.html { head :no_content, notice: 'Comment was successfully updated.' }
-        format.json { render :show, status: :ok, location: @comment }
+        render :show, status: :ok, location: @comment
      else
-        format.html { render :edit }
-        format.json { render json: @comment.errors, status: :unprocessable_entity }
+        render json: @comment.errors, status: :unprocessable_entity
      end
    end
    authorize!
  end

-  # DELETE /comments/1
  # DELETE /comments/1.json
  def destroy
    authorize!
    @comment.destroy
-    respond_to do |format|
-      format.html { head :no_content, notice: 'Comment was successfully destroyed.' }
-      format.json { head :no_content }
-    end
+    head :no_content
  end

  private
--- a/app/mailers/user_mailer.rb
+++ b/app/mailers/user_mailer.rb
@ -39,6 +39,7 @@ class UserMailer < ActionMailer::Base
  end
  
  def exercise_anomaly_detected(exercise_collection, anomalies)
+    @user = exercise_collection.user
    @receiver_displayname = exercise_collection.user.displayname
    @collection = exercise_collection
    @anomalies = anomalies
--- a/app/policies/exercise_policy.rb
+++ b/app/policies/exercise_policy.rb
@ -8,7 +8,7 @@ class ExercisePolicy < AdminOrAuthorPolicy
  end

  [:clone?, :destroy?, :edit?, :statistics?, :update?, :feedback?].each do |action|
-    define_method(action) { admin? || author?}
+    define_method(action) { admin? || author? }
  end

  [:implement?, :working_times?, :intervention?, :search?, :submit?, :reload?].each do |action|
--- a/app/views/admin/dashboard/show.html.slim
+++ b/app/views/admin/dashboard/show.html.slim
@ -30,7 +30,7 @@ h2 Docker
      tbody
        - ExecutionEnvironment.order(:name).each do |execution_environment|
          tr data-id=execution_environment.id
-            td.name = link_to(execution_environment, execution_environment)
+            td.name = link_to_if(policy(execution_environment).show?, execution_environment, execution_environment)
            td.pool-size
            td.quantity = progress_bar(0)
  h3 = t('.history')
--- a/app/views/application/_breadcrumbs.html.slim
+++ b/app/views/application/_breadcrumbs.html.slim
@ -7,9 +7,9 @@
        - if object
          li.breadcrumb-item = object
      - else
-        li.breadcrumb-item = link_to(model.model_name.human(count: 2), send(:"#{model.model_name.collection}_path"))
+        li.breadcrumb-item = link_to_if(policy(model).show?, model.model_name.human(count: 2), send(:"#{model.model_name.collection}_path"))
        - if object
-          li.breadcrumb-item = link_to(object, send(:"#{model.model_name.singular}_path", object))
+          li.breadcrumb-item = link_to_if(policy(object).show?, object, send(:"#{model.model_name.singular}_path", object))
      li.breadcrumb-item.active
        - if I18n.translation_present?("shared.#{params[:action]}")
          = t("shared.#{params[:action]}")
--- a/app/views/application/_navigation.html.slim
+++ b/app/views/application/_navigation.html.slim
@ -6,8 +6,8 @@
        span.caret
      ul.dropdown-menu.p-0.mt-1 role='menu'
        - if current_user.admin?
-          li = link_to(t('breadcrumbs.dashboard.show'), admin_dashboard_path, class: 'dropdown-item', 'data-turbolinks' => "false")
-          li = link_to(t('breadcrumbs.statistics.show'), statistics_path, class: 'dropdown-item')
+          li = link_to(t('breadcrumbs.dashboard.show'), admin_dashboard_path, class: 'dropdown-item', 'data-turbolinks' => "false") if policy([:admin, :dashboard]).show?
+          li = link_to(t('breadcrumbs.statistics.show'), statistics_path, class: 'dropdown-item') if policy(:statistics).show?
          li.dropdown-divider role='separator'
        = render('navigation_submenu', title: t('activerecord.models.exercise.other'),
                models: [Exercise, ExerciseCollection, ProxyExercise, Tag, Submission], link: exercises_path, cached: true)
--- a/app/views/application/_session.html.slim
+++ b/app/views/application/_session.html.slim
@ -8,7 +8,7 @@
      - if current_user.try(:admin?) or current_user.try(:teacher?)
        li = link_to(t('consumers.show.link'), current_user.consumer, class: 'dropdown-item') if current_user.consumer and policy(current_user.consumer).show?
        li = link_to(t('internal_users.show.link'), current_user, class: 'dropdown-item') if policy(current_user).show?
-        li = link_to(t('request_for_comments.index.all'), request_for_comments_path, class: 'dropdown-item') if policy(RequestForComment).index?
+        li = link_to(t('request_for_comments.index.all'), request_for_comments_path, class: 'dropdown-item') if policy(:request_for_comment).index?
        li = link_to(t('request_for_comments.index.get_my_rfc_activity'), my_rfc_activity_path, class: 'dropdown-item')
      li = link_to(t('request_for_comments.index.get_my_comment_requests'), my_request_for_comments_path, class: 'dropdown-item')
      - if current_user.internal_user?
--- a/app/views/code_harbor_links/index.html.slim
+++ b/app/views/code_harbor_links/index.html.slim
@ -9,10 +9,10 @@ h1 = CodeHarborLink.model_name.human(count: 2)
    tbody
      - @code_harbor_links.each do |code_harbor_link|
        tr
-          td = link_to(code_harbor_link.oauth2token, code_harbor_link)
-          td = link_to(t('shared.show'), code_harbor_link)
-          td = link_to(t('shared.edit'), edit_code_harbor_link_path(code_harbor_link))
-          td = link_to(t('shared.destroy'), code_harbor_link, data: {confirm: t('shared.confirm_destroy')}, method: :delete)
+          td = link_to_if(policy(code_harbor_link).show?, code_harbor_link.oauth2token, code_harbor_link)
+          td = link_to(t('shared.show'), code_harbor_link) if policy(code_harbor_link).show?
+          td = link_to(t('shared.edit'), edit_code_harbor_link_path(code_harbor_link)) if policy(code_harbor_link).edit?
+          td = link_to(t('shared.destroy'), code_harbor_link, data: {confirm: t('shared.confirm_destroy')}, method: :delete) if policy(code_harbor_link).destroy?

 = render('shared/pagination', collection: @code_harbor_links)
 p = render('shared/new_button', model: CodeHarborLink)
--- a/app/views/code_harbor_links/show.html.slim
+++ b/app/views/code_harbor_links/show.html.slim
@ -1,6 +1,6 @@
 h1
  = @code_harbor_link
-  = render('shared/edit_button', object: @code_harbor_link) if policy(@code_harbor_link).edit?
+  = render('shared/edit_button', object: @code_harbor_link)

 - %w[oauth2token].each do |attribute|
  = row(label: "code_harbor_link.#{attribute}") do
--- a/app/views/comments/_form.html.slim
+++ b/app/views/comments/_form.html.slim
@ -1,33 +0,0 @@
-= form_for(@comment) do |f|
-  - if @comment.errors.any?
-    #error_explanation
-      h2
-        = pluralize(@comment.errors.count, "error")
-        | prohibited this comment from being saved:
-
-      ul
-        - @comment.errors.full_messages.each do |message|
-          li= message
-
-  .field
-    = f.label :user_id
-    br/
-    = f.text_field :user_id
-  .field
-    = f.label :file_id
-    br/
-    = f.text_field :file_id
-  .field
-    = f.label :row
-    br/
-    = f.number_field :row
-  .field
-    = f.label :column
-    br/
-    = f.number_field :column
-  .field
-    = f.label :text
-    br/
-    = f.text_field :text
-  .actions
-    = f.submit
--- a/app/views/comments/edit.html.slim
+++ b/app/views/comments/edit.html.slim
@ -1,7 +0,0 @@
-h1 Editing comment
-
-= render 'form'
-
-= link_to 'Show', @comment
-| |
-= link_to 'Back', comments_path
--- a/app/views/comments/index.html.slim
+++ b/app/views/comments/index.html.slim
@ -1,24 +0,0 @@
-h1 Listing comments
-
-table
-  thead
-    tr
-      th User
-      th File
-      th Row
-      th Column
-      th Text
-      th colspan="3" 
-  tbody
-    - @comments.each do |comment|
-      tr
-        td= comment.user
-        td= comment.file
-        td= comment.row
-        td= comment.column
-        td= comment.text
-        td= link_to 'Show', comment
-        td= link_to 'Edit', edit_comment_path(comment)
-        td= link_to 'Destroy', comment, method: :delete, data: confirm: 'Are you sure?'
-br/
-= link_to 'New Comment', new_comment_path
--- a/app/views/comments/new.html.slim
+++ b/app/views/comments/new.html.slim
@ -1,5 +0,0 @@
-h1 New comment
-
-= render 'form'
-
-= link_to 'Back', comments_path
--- a/app/views/comments/show.html.slim
+++ b/app/views/comments/show.html.slim
@ -1,25 +0,0 @@
-p#notice= notice
-
-p
-  strong User:
-  = @comment.user
-
-p
-  strong File:
-  = @comment.file
-
-p
-  strong Row:
-  = @comment.row
-
-p
-  strong Column:
-  = @comment.column
-
-p
-  strong Text:
-  = @comment.text
-
-= link_to 'Edit', edit_comment_path(@comment)
-| |
-= link_to 'Back', comments_path
--- a/app/views/consumers/index.html.slim
+++ b/app/views/consumers/index.html.slim
@ -9,10 +9,10 @@ h1 = Consumer.model_name.human(count: 2)
    tbody
      - @consumers.each do |consumer|
        tr
-          td = link_to(consumer.name, consumer)
-          td = link_to(t('shared.show'), consumer)
-          td = link_to(t('shared.edit'), edit_consumer_path(consumer))
-          td = link_to(t('shared.destroy'), consumer, data: {confirm: t('shared.confirm_destroy')}, method: :delete)
+          td = link_to_if(policy(consumer).show?, consumer.name, consumer)
+          td = link_to(t('shared.show'), consumer) if policy(consumer).show?
+          td = link_to(t('shared.edit'), edit_consumer_path(consumer)) if policy(consumer).edit?
+          td = link_to(t('shared.destroy'), consumer, data: {confirm: t('shared.confirm_destroy')}, method: :delete) if policy(consumer).destroy?

 = render('shared/pagination', collection: @consumers)
 p = render('shared/new_button', model: Consumer)
--- a/app/views/consumers/show.html.slim
+++ b/app/views/consumers/show.html.slim
@ -1,6 +1,6 @@
 h1
  = @consumer
-  = render('shared/edit_button', object: @consumer) if policy(@consumer).edit?
+  = render('shared/edit_button', object: @consumer)

 = row(label: 'consumer.name', value: @consumer.name)
 - %w[oauth_key oauth_secret].each do |attribute|
--- a/app/views/error_template_attributes/index.html.slim
+++ b/app/views/error_template_attributes/index.html.slim
@ -8,7 +8,7 @@ h1 = ErrorTemplateAttribute.model_name.human(count: 2)
        th = t('activerecord.attributes.error_template_attribute.key')
        th = t('activerecord.attributes.error_template_attribute.description')
        th = t('activerecord.attributes.error_template_attribute.regex')
-        th colspan=5 = t('shared.actions')
+        th colspan=3 = t('shared.actions')
    tbody
      - @error_template_attributes.each do |error_template_attribute|
        tr
@ -17,13 +17,13 @@ h1 = ErrorTemplateAttribute.model_name.human(count: 2)
              span class="fa fa-star" aria-hidden="true"
            - else
              span class="fa fa-star-o" aria-hidden="true"
-          td = link_to(error_template_attribute.key, error_template_attribute)
+          td = link_to_if(policy(error_template_attribute).show?, error_template_attribute.key, error_template_attribute)
          td = error_template_attribute.description
          td
            code = error_template_attribute.regex
-          td = link_to(t('shared.show'), error_template_attribute)
-          td = link_to(t('shared.edit'), edit_error_template_attribute_path(error_template_attribute))
-          td = link_to(t('shared.destroy'), error_template_attribute, data: {confirm: t('shared.confirm_destroy')}, method: :delete)
+          td = link_to(t('shared.show'), error_template_attribute) if policy(error_template_attribute).show?
+          td = link_to(t('shared.edit'), edit_error_template_attribute_path(error_template_attribute)) if policy(error_template_attribute).edit?
+          td = link_to(t('shared.destroy'), error_template_attribute, data: {confirm: t('shared.confirm_destroy')}, method: :delete) if policy(error_template_attribute).destroy?

 = render('shared/pagination', collection: @error_template_attributes)
 p = render('shared/new_button', model: ErrorTemplateAttribute)
--- a/app/views/error_templates/index.html.slim
+++ b/app/views/error_templates/index.html.slim
@ -11,12 +11,12 @@ h1 = ErrorTemplate.model_name.human(count: 2)
    tbody
      - @error_templates.each do |error_template|
        tr
-          td = link_to(error_template.name, error_template)
+          td = link_to_if(policy(error_template).show?, error_template.name, error_template)
          td = error_template.description
          td = link_to(error_template.execution_environment)
-          td = link_to(t('shared.show'), error_template)
-          td = link_to(t('shared.edit'), edit_error_template_path(error_template))
-          td = link_to(t('shared.destroy'), error_template, data: {confirm: t('shared.confirm_destroy')}, method: :delete)
+          td = link_to(t('shared.show'), error_template) if policy(error_template).show?
+          td = link_to(t('shared.edit'), edit_error_template_path(error_template)) if policy(error_template).edit?
+          td = link_to(t('shared.destroy'), error_template, data: {confirm: t('shared.confirm_destroy')}, method: :delete) if policy(error_template).destroy?

 = render('shared/pagination', collection: @error_templates)
 p = render('shared/new_button', model: ErrorTemplate)
--- a/app/views/error_templates/show.html.slim
+++ b/app/views/error_templates/show.html.slim
@ -3,7 +3,7 @@ h1
  = render('shared/edit_button', object: @error_template)

 = row(label: 'error_template.name', value: @error_template.name)
-= row(label: 'exercise.execution_environment', value: link_to(@error_template.execution_environment))
+= row(label: 'exercise.execution_environment', value: link_to_if(policy(@error_template.execution_environment).show?, @error_template.execution_environment))
 = row(label: "error_template.signature") do
  code = @error_template.signature
 - [:description, :hint].each do |attribute|
@ -29,12 +29,13 @@ h2.mt-4
              span class="fa fa-star" aria-hidden="true"
            - else
              span class="fa fa-star-o" aria-hidden="true"
-          td = link_to(attribute.key, attribute)
+          td = link_to_if(policy(attribute).show?, attribute.key, attribute)
          td = attribute.description
          td
            code = attribute.regex
-          td = link_to(t('shared.show'), attribute)
-          td = link_to(t('shared.destroy'), attribute_error_template_url(:error_template_attribute_id => attribute.id), :method => :delete)
+          td = link_to(t('shared.show'), attribute) if policy(attribute).show?
+          td = link_to(t('shared.edit'), edit_error_template_attribute_path(attribute)) if policy(attribute).edit?
+          td = link_to(t('shared.destroy'), attribute_error_template_url(:error_template_attribute_id => attribute.id), :method => :delete) if policy(attribute).destroy?

 #add-attribute
  = collection_select({}, :error_template_attribute_id,
--- a/app/views/execution_environments/show.html.slim
+++ b/app/views/execution_environments/show.html.slim
@ -3,7 +3,7 @@ h1
  = render('shared/edit_button', object: @execution_environment)

 = row(label: 'execution_environment.name', value: @execution_environment.name)
-= row(label: 'execution_environment.user', value: link_to(@execution_environment.author, @execution_environment.author))
+= row(label: 'execution_environment.user', value: link_to_if(policy(@execution_environment.author).show?, @execution_environment.author, @execution_environment.author))
 = row(label: 'execution_environment.file_type', value: @execution_environment.file_type.present? ? link_to(@execution_environment.file_type, @execution_environment.file_type) : nil)
 - [:docker_image, :exposed_ports, :memory_limit, :network_enabled, :permitted_execution_time, :pool_size].each do |attribute|
  = row(label: "execution_environment.#{attribute}", value: @execution_environment.send(attribute))
--- a/app/views/execution_environments/statistics.html.slim
+++ b/app/views/execution_environments/statistics.html.slim
@ -14,7 +14,7 @@ h1 = @execution_environment
        - if wts then average_time = wts["average_time"] else 0
        - if wts then stddev_time = wts["stddev_time"] else 0
        tr
-          td = link_to exercise.title, controller: "exercises", action: "statistics", id: exercise.id, 'data-turbolinks' => "false"
+          td = link_to_if policy(exercise).show?, exercise.title, controller: "exercises", action: "statistics", id: exercise.id, 'data-turbolinks' => "false"
          td = us["users"]
          td = us["average_score"].to_f.round(4)
          td = us["maximum_score"].to_f.round(2)
--- a/app/views/exercise_collections/index.html.slim
+++ b/app/views/exercise_collections/index.html.slim
@ -13,13 +13,13 @@ h1 = ExerciseCollection.model_name.human(count: 2)
      - @exercise_collections.each do |collection|
        tr
          td = collection.id
-          td = link_to(collection.name, collection)
+          td = link_to_if(policy(collection).show?, collection.name, collection)
          td = collection.updated_at
          td = collection.exercises.size
-          td = link_to(t('shared.show'), collection)
-          td = link_to(t('shared.edit'), edit_exercise_collection_path(collection))
-          td = link_to(t('shared.statistics'), statistics_exercise_collection_path(collection))
-          td = link_to(t('shared.destroy'), collection, data: {confirm: t('shared.confirm_destroy')}, method: :delete)
+          td = link_to(t('shared.show'), collection) if policy(collection).show?
+          td = link_to(t('shared.edit'), edit_exercise_collection_path(collection)) if policy(collection).edit?
+          td = link_to(t('shared.statistics'), statistics_exercise_collection_path(collection)) if policy(collection).statistics?
+          td = link_to(t('shared.destroy'), collection, data: {confirm: t('shared.confirm_destroy')}, method: :delete) if policy(collection).destroy?

 = render('shared/pagination', collection: @exercise_collections)
 p = render('shared/new_button', model: ExerciseCollection)
--- a/app/views/exercise_collections/show.html.slim
+++ b/app/views/exercise_collections/show.html.slim
@ -3,7 +3,7 @@ h1
  = render('shared/edit_button', object: @exercise_collection)

 = row(label: 'exercise_collections.name', value: @exercise_collection.name)
-= row(label: 'exercise_collections.user', value: link_to(@exercise_collection.user.name, @exercise_collection.user)) unless @exercise_collection.user.nil?
+= row(label: 'exercise_collections.user', value: link_to_if(policy(@exercise_collection.user).show?, @exercise_collection.user.name, @exercise_collection.user)) unless @exercise_collection.user.nil?
 = row(label: 'exercise_collections.use_anomaly_detection', value: @exercise_collection.use_anomaly_detection)
 = row(label: 'exercise_collections.updated_at', value: @exercise_collection.updated_at)

@ -22,7 +22,7 @@ h4.mt-4 = t('activerecord.attributes.exercise_collections.exercises')
        - exercise = exercise_collection_item.exercise
        tr
          td = exercise_collection_item.position
-          td = link_to(exercise.title, exercise)
+          td = link_to_if(policy(exercise).show?, exercise.title, exercise)
          td = link_to_if(exercise.execution_environment && policy(exercise.execution_environment).show?, exercise.execution_environment, exercise.execution_environment)
          td = link_to_if(exercise.user && policy(exercise.user).show?, exercise.user.name, exercise.user)
-          td = link_to(t('shared.statistics'), statistics_exercise_path(exercise), 'data-turbolinks' => "false")
+          td = link_to(t('shared.statistics'), statistics_exercise_path(exercise), 'data-turbolinks' => "false") if policy(exercise).statistics?
--- a/app/views/exercises/feedback.html.slim
+++ b/app/views/exercises/feedback.html.slim
@ -1,4 +1,4 @@
-h1 = link_to(@exercise, exercise_path(@exercise))
+h1 = link_to_if(policy(@exercise).show?, @exercise, exercise_path(@exercise))

 .feedback-page
  .header = t('activerecord.attributes.exercise.description')
--- a/app/views/exercises/index.html.slim
+++ b/app/views/exercises/index.html.slim
@ -27,7 +27,7 @@ h1 = Exercise.model_name.human(count: 2)
    tbody
      - @exercises.each do |exercise|
        tr data-id=exercise.id
-          td.p-1.pt-2 = link_to(exercise.title, exercise, 'data-turbolinks' => "false") if policy(exercise).show?
+          td.p-1.pt-2 = link_to_if(policy(exercise).show?, exercise.title, exercise, 'data-turbolinks' => "false")
          td.p-1.pt-2 = link_to_if(exercise.execution_environment && policy(exercise.execution_environment).show?, exercise.execution_environment, exercise.execution_environment)
          td.p-1.pt-2 = exercise.files.teacher_defined_tests.count
          td.p-1.pt-2 = exercise.maximum_score
--- a/app/views/exercises/show.html.slim
+++ b/app/views/exercises/show.html.slim
@ -7,7 +7,6 @@

 h1
  = @exercise
-  - if policy(@exercise).edit?
  = render('shared/edit_button', object: @exercise)

 = row(label: 'exercise.title', value: @exercise.title)
--- a/app/views/exercises/statistics.html.slim
+++ b/app/views/exercises/statistics.html.slim
@ -49,7 +49,7 @@ h1 = @exercise
          - if user_statistics[user.id] then us = user_statistics[user.id] else us = {"maximum_score" => nil, "runs" => nil}
          - label = "#{user.displayname}"
          tr
-            td = link_to_if symbol==:external_users, label, {controller: "exercises", action: "statistics", external_user_id: user.id, id: @exercise.id}
+            td = link_to_if symbol==:external_users && policy(user).statistics?, label, {controller: "exercises", action: "statistics", external_user_id: user.id, id: @exercise.id}
            td = us['maximum_score'] or 0
            td = us['runs']
            td = @exercise.average_working_time_for(user.id) or 0
--- a/app/views/external_users/index.html.slim
+++ b/app/views/external_users/index.html.slim
@ -10,8 +10,8 @@ h1 = ExternalUser.model_name.human(count: 2)
    tbody
      - @users.each do |user|
        tr
-          td = user.name
-          td = link_to(user.consumer, user.consumer)
-          td = link_to(t('shared.show'), user)
+          td = link_to_if(policy(user).show?, user.name)
+          td = link_to_if(policy(user.consumer).show?, user.consumer, user.consumer)
+          td = link_to(t('shared.show'), user) if policy(user).show?

 = render('shared/pagination', collection: @users)
--- a/app/views/external_users/show.html.slim
+++ b/app/views/external_users/show.html.slim
@ -5,7 +5,7 @@ h1 = @user.name
 = row(label: 'external_user.consumer', value: link_to(@user.consumer, @user.consumer))
 = row(label: 'external_user.role', value: t("users.roles.#{@user.role}"))

-h4.mt-4 = link_to(t('.exercise_statistics'), statistics_external_user_path(@user))
+h4.mt-4 = link_to(t('.exercise_statistics'), statistics_external_user_path(@user)) if policy(@user).statistics?

 h4.mt-4 = t('.tag_statistics')
 #loading
--- a/app/views/external_users/statistics.html.slim
+++ b/app/views/external_users/statistics.html.slim
@ -13,7 +13,7 @@ h1 = t('.title')
        - if statistics[exercise.id]
          - stats = statistics[exercise.id]
          tr
-            td = link_to exercise, controller: "exercises", action: "statistics", external_user_id: @user.id, id: exercise.id
+            td = link_to_if policy(exercise).show?, exercise, controller: "exercises", action: "statistics", external_user_id: @user.id, id: exercise.id
            td = stats["maximum_score"] or 0
            td = stats["runs"] or 0
            td = stats["working_time"] or 0
--- a/app/views/file_templates/index.html.slim
+++ b/app/views/file_templates/index.html.slim
@ -10,11 +10,11 @@ h1 = FileTemplate.model_name.human(count: 2)
    tbody
      - @file_templates.each do |file_template|
        tr
-          td = link_to(file_template.name, file_template)
-          td = link_to(file_template.file_type, file_type_path(file_template.file_type))
-          td = link_to(t('shared.show'), file_template)
-          td = link_to(t('shared.edit'), edit_file_template_path(file_template))
-          td = link_to(t('shared.destroy'), file_template, data: {confirm: t('shared.confirm_destroy')}, method: :delete)
+          td = link_to_if(policy(file_template).show?, file_template.name, file_template)
+          td = link_to_if(policy(file_template.file_type).show?, file_template.file_type, file_type_path(file_template.file_type))
+          td = link_to(t('shared.show'), file_template) if policy(file_template).show?
+          td = link_to(t('shared.edit'), edit_file_template_path(file_template)) if policy(file_template).edit?
+          td = link_to(t('shared.destroy'), file_template, data: {confirm: t('shared.confirm_destroy')}, method: :delete) if policy(file_template).destroy?

 = render('shared/pagination', collection: @file_templates)
 p = render('shared/new_button', model: FileTemplate)
--- a/app/views/file_templates/show.html.slim
+++ b/app/views/file_templates/show.html.slim
@ -3,5 +3,5 @@ h1
  = render('shared/edit_button', object: @file_template)

 = row(label: 'file_template.name', value: @file_template.name)
-= row(label: 'file_template.file_type', value: link_to(@file_template.file_type, file_type_path(@file_template.file_type)))
+= row(label: 'file_template.file_type', value: link_to_if(policy(@file_template.file_type).show?, @file_template.file_type, file_type_path(@file_template.file_type)))
 = row(label: 'file_template.content', value: @file_template.content)
--- a/app/views/file_types/show.html.slim
+++ b/app/views/file_types/show.html.slim
@ -3,6 +3,6 @@ h1
  = render('shared/edit_button', object: @file_type)

 = row(label: 'file_type.name', value: @file_type.name)
-= row(label: 'file_type.user', value: link_to(@file_type.author, @file_type.author))
+= row(label: 'file_type.user', value: link_to_if(policy(@file_type.author).show?, @file_type.author, @file_type.author))
 - [:editor_mode, :file_extension, :indent_size, :binary, :executable, :renderable].each do |attribute|
  = row(label: "file_type.#{attribute}", value: @file_type.send(attribute))
--- a/app/views/internal_users/index.html.slim
+++ b/app/views/internal_users/index.html.slim
@ -22,14 +22,12 @@ h1 = InternalUser.model_name.human(count: 2)
    tbody
      - @users.each do |user|
        tr
-          td = user.name
-          td = user.consumer ? link_to(user.consumer, user.consumer) : empty
+          td = link_to_if(policy(user).show?, user.name)
+          td = user.consumer ? link_to_if(policy(user.consumer).show?, user.consumer, user.consumer) : empty
          td = t("users.roles.#{user.role}")
-          td = link_to(t('shared.show'), user)
-          td = link_to(t('shared.edit'), edit_internal_user_path(user))
-          td
-            - if policy(user).destroy?
-              = link_to(t('shared.destroy'), user, data: {confirm: t('shared.confirm_destroy')}, method: :delete)
+          td = link_to(t('shared.show'), user) if policy(user).show?
+          td = link_to(t('shared.edit'), edit_internal_user_path(user)) if policy(user).edit?
+          td = link_to(t('shared.destroy'), user, data: {confirm: t('shared.confirm_destroy')}, method: :delete) if policy(user).destroy?

 = render('shared/pagination', collection: @users)
 p = render('shared/new_button', model: InternalUser)
--- a/app/views/internal_users/show.html.slim
+++ b/app/views/internal_users/show.html.slim
@ -1,10 +1,9 @@
 h1
  = @user
-  - if policy(@user).edit?
  = render('shared/edit_button', object: @user)

 = row(label: 'internal_user.email', value: @user.email)
 = row(label: 'internal_user.name', value: @user.name)
-= row(label: 'internal_user.consumer', value: @user.consumer ? link_to(@user.consumer, @user.consumer) : nil)
+= row(label: 'internal_user.consumer', value: @user.consumer ? link_to_if(policy(@user.consumer).show?, @user.consumer, @user.consumer) : nil)
 = row(label: 'internal_user.role', value: t("users.roles.#{@user.role}"))
 = row(label: 'internal_user.activated', value: @user.activated?)
--- a/app/views/interventions/index.html.slim
+++ b/app/views/interventions/index.html.slim
@ -5,10 +5,11 @@ h1 = Intervention.model_name.human(count: 2)
    thead
      tr
        th = t('activerecord.attributes.intervention.name')
+        th = t('shared.actions')
    tbody
      - @interventions.each do |intervention|
        tr
-          td = intervention.name
-          td = link_to(t('shared.show'), intervention)
+          td = link_to_if policy(intervention).show?, intervention.name
+          td = link_to(t('shared.show'), intervention) if policy(intervention).show?

 = render('shared/pagination', collection: @interventions)
--- a/app/views/proxy_exercises/_form.html.slim
+++ b/app/views/proxy_exercises/_form.html.slim
@ -18,7 +18,7 @@
      = collection_check_boxes :proxy_exercise, :exercise_ids, @exercises, :id, :title do |b|
        tr
          td = b.check_box
-          td = link_to(b.object, b.object)
+          td = link_to_if(policy(b.object).show?, b.object, b.object)
          td = l(b.object.created_at, format: :short)

  .actions = render('shared/submit_button', f: f, object: @proxy_exercise)
--- a/app/views/proxy_exercises/index.html.slim
+++ b/app/views/proxy_exercises/index.html.slim
@ -12,11 +12,11 @@ h1 = ProxyExercise.model_name.human(count: 2)
        th.p-1 = sort_link(@search, :title, t('activerecord.attributes.proxy_exercise.title'))
        th.p-1 = t('activerecord.attributes.exercise.token')
        th.p-1 = t('activerecord.attributes.proxy_exercise.files_count')
-        th.p-1 colspan=6 = t('shared.actions')
+        th.p-1 colspan=2 = t('shared.actions')
    tbody
      - @proxy_exercises.each do |proxy_exercise|
        tr data-id=proxy_exercise.id
-          td.p-1.pt-2 = link_to(proxy_exercise.title,proxy_exercise)
+          td.p-1.pt-2 = link_to_if(policy(proxy_exercise).show?, proxy_exercise.title, proxy_exercise)
          td.p-1.pt-2 = proxy_exercise.token
          td.p-1.pt-2 = proxy_exercise.count_files
          td.p-1.pt-2 = link_to(t('shared.edit'), edit_proxy_exercise_path(proxy_exercise)) if policy(proxy_exercise).edit?
--- a/app/views/proxy_exercises/show.html.slim
+++ b/app/views/proxy_exercises/show.html.slim
@ -7,7 +7,6 @@

 h1
  = @proxy_exercise.title
-  - if policy(@proxy_exercise).edit?
  = render('shared/edit_button', object: @proxy_exercise)

 = row(label: 'exercise.title', value: @proxy_exercise.title)
@ -24,5 +23,5 @@ h2.mt-4 Exercises
        th = sort_link(@search, :created_at, t('shared.created_at'))
    - @proxy_exercise.exercises.each do |exercise|
      tr
-        td = link_to(exercise.title, exercise)
+        td = link_to_if(policy(exercise).show?, exercise.title, exercise)
        td = l(exercise.created_at, format: :short)
--- a/app/views/request_for_comments/_admin_menu.html.slim
+++ b/app/views/request_for_comments/_admin_menu.html.slim
@ -1,8 +1,8 @@
 hr
 h5.mt-4 Admin Menu
 ul.text
-  li = link_to "User's current status of this exercise", statistics_external_user_exercise_path(id: @request_for_comment.exercise_id, external_user_id: @request_for_comment.user_id)
-  li = link_to "All exercises of this user", statistics_external_user_path(id: @request_for_comment.user_id)
+  li = link_to "User's current status of this exercise", statistics_external_user_exercise_path(id: @request_for_comment.exercise_id, external_user_id: @request_for_comment.user_id) if policy(@request_for_comment.exercise).statistics?
+  li = link_to "All exercises of this user", statistics_external_user_path(id: @request_for_comment.user_id) if policy(@request_for_comment.user).statistics?
 ul.text
-  li = link_to "Implement the exercise yourself", implement_exercise_path(id: @request_for_comment.exercise_id)
-  li = link_to "Show the exercise", exercise_path(id: @request_for_comment.exercise_id)
+  li = link_to "Implement the exercise yourself", implement_exercise_path(id: @request_for_comment.exercise_id) if policy(@request_for_comment.exercise).implement?
+  li = link_to "Show the exercise", exercise_path(id: @request_for_comment.exercise_id) if policy(@request_for_comment.exercise).show?
--- a/app/views/request_for_comments/_form.html.slim
+++ b/app/views/request_for_comments/_form.html.slim
@ -1,28 +0,0 @@
-= form_for(@request_for_comment) do |f|
-  - if @request_for_comment.errors.any?
-    #error_explanation
-      h2
-        = pluralize(@request_for_comment.errors.count, "error")
-        | prohibited this request_for_comment from being saved:
-      ul
-        - @request_for_comment.errors.full_messages.each do |message|
-          li= message
-
-  .field
-    = f.label :user_id
-    br/
-    = f.number_field :user_id
-  .field
-    = f.label :exercise_id
-    br/
-    = f.number_field :exercise_id
-  .field
-    = f.label :file_id
-    br/
-    = f.number_field :file_id
-  .field
-    = f.label :user_type
-    br/
-    = f.text_field :user_type
-  .actions
-    = f.submit
--- a/app/views/request_for_comments/index.html.slim
+++ b/app/views/request_for_comments/index.html.slim
@ -32,8 +32,8 @@ h1 = RequestForComment.model_name.human(count: 2)
              span class="fa fa-check" style="color:darkgrey" aria-hidden="true"
          - else
            td = ''
-          td = link_to(request_for_comment.exercise.title, request_for_comment)
-          - if request_for_comment.has_attribute?(:question) && request_for_comment.question
+          td = link_to_if(policy(request_for_comment.exercise).show?, request_for_comment.exercise.title, request_for_comment)
+          - if request_for_comment.has_attribute?(:question) && request_for_comment.question.present?
            td = truncate(request_for_comment.question, length: 200)
          - else
            td = '-'
--- a/app/views/request_for_comments/show.html.slim
+++ b/app/views/request_for_comments/show.html.slim
@ -2,12 +2,12 @@
  h4#exercise_caption.list-group-item-heading data-comment-exercise-url=create_comment_exercise_request_for_comment_path data-exercise-id="#{@request_for_comment.exercise.id}" data-rfc-id="#{@request_for_comment.id}"
    - if @request_for_comment.solved?
      span.fa.fa-check aria-hidden="true"
-    = link_to(@request_for_comment.exercise.title, [:implement, @request_for_comment.exercise])
+    = link_to_if(policy(@request_for_comment.exercise).show?, @request_for_comment.exercise.title, [:implement, @request_for_comment.exercise])
  p.list-group-item-text
    - user = @request_for_comment.user
    - submission =  @request_for_comment.submission
    - testruns = Testrun.where(:submission_id => @request_for_comment.submission)
-    = user.displayname
+    = link_to_if(policy(user).show?, user.displayname, user)
    | | #{@request_for_comment.created_at.localtime}
  .rfc
    .description
@ -22,7 +22,7 @@
        = t('activerecord.attributes.request_for_comments.question')
      .text
        - question = @request_for_comment.question
-        = question.nil? or question.empty? ? t('request_for_comments.no_question') : question
+        = question.blank? ? t('request_for_comments.no_question') : question

    - if policy(@request_for_comment).mark_as_solved? and not @request_for_comment.solved?
      = render('mark_as_solved')
--- a/app/views/shared/_edit_button.html.slim
+++ b/app/views/shared/_edit_button.html.slim
@ -1,3 +1,4 @@
-// default value for fetch will always be evaluated even if it is not returned
- link_target = local_assigns.fetch(:path, false) || send(:"edit_#{object.class.name.underscore}_path", object)
-= link_to(t('shared.edit'), link_target, class: 'btn btn-secondary float-right')
+- if policy(object).edit?
+  // default value for fetch will always be evaluated even if it is not returned
+  - link_target = local_assigns.fetch(:path, false) || send(:"edit_#{object.class.name.underscore}_path", object)
+  = link_to(t('shared.edit'), link_target, class: 'btn btn-secondary float-right')
--- a/app/views/shared/_file.html.slim
+++ b/app/views/shared/_file.html.slim
@ -7,4 +7,4 @@
 - if file.teacher_defined_test?
  = row(label: 'file.feedback_message', value: render_markdown(file.feedback_message), class: 'm-0')
  = row(label: 'file.weight', value: file.weight)
-= row(label: 'file.content', value: file.native_file? ? link_to(file.native_file.file.filename, file.native_file.url) : code_tag(file.content))
+= row(label: 'file.content', value: file.native_file? ? link_to_if(policy(file.native_file.file.filename).show?, file.native_file.file.filename, file.native_file.url) : code_tag(file.content))
--- a/app/views/submissions/index.html.slim
+++ b/app/views/submissions/index.html.slim
@ -21,12 +21,12 @@ h1 = Submission.model_name.human(count: 2)
    tbody
      - @submissions.each do |submission|
        tr
-          td = link_to(submission.exercise, submission.exercise)
-          td = link_to(submission.user, submission.user)
+          td = link_to_if(policy(submission.exercise).show?, submission.exercise, submission.exercise)
+          td = link_to_if(policy(submission.user).show?, submission.user, submission.user)
          td = t("submissions.causes.#{submission.cause}")
          td = submission.score
          td = l(submission.created_at, format: :short)
-          td = link_to(t('shared.show'), submission)
-          td = link_to(t('shared.statistics'), statistics_submission_path(submission))
+          td = link_to(t('shared.show'), submission) if policy(submission).show?
+          td = link_to(t('shared.statistics'), statistics_submission_path(submission)) if policy(submission).statistics?

 = render('shared/pagination', collection: @submissions)
--- a/app/views/submissions/show.html.slim
+++ b/app/views/submissions/show.html.slim
@ -7,8 +7,8 @@

 h1 = @submission

-= row(label: 'submission.exercise', value: link_to(@submission.exercise, @submission.exercise))
-= row(label: 'submission.user', value: link_to(@submission.user, @submission.user))
+= row(label: 'submission.exercise', value: link_to_if(policy(@submission.exercise).show?, @submission.exercise, @submission.exercise))
+= row(label: 'submission.user', value: link_to_if(policy(@submission.user).show?, @submission.user, @submission.user))
 = row(label: 'submission.cause', value: t("submissions.causes.#{@submission.cause}"))
 = row(label: 'submission.score', value: @submission.score)

--- a/app/views/submissions/statistics.html.slim
+++ b/app/views/submissions/statistics.html.slim
@ -23,4 +23,4 @@ h2.mt-4 = t('.history')
            td = l(submission.created_at, format: :short)
            td = submission.score
            td = progress_bar(submission.percentage)
-            td = link_to(t('shared.show'), submission)
+            td = link_to(t('shared.show'), submission) if policy(submission).show?
--- a/app/views/tags/index.html.slim
+++ b/app/views/tags/index.html.slim
@ -9,10 +9,10 @@ h1 = Tag.model_name.human(count: 2)
    tbody
      - @tags.each do |tag|
        tr
-          td = tag.name
-          td = link_to(t('shared.show'), tag)
-          td = link_to(t('shared.edit'), edit_tag_path(tag))
-          td = link_to(t('shared.destroy'), tag, data: {confirm: t('shared.confirm_destroy')}, method: :delete) if tag.can_be_destroyed?
+          td = link_to_if(policy(tag).show?, tag.name, tag)
+          td = link_to(t('shared.show'), tag) if policy(tag).show?
+          td = link_to(t('shared.edit'), edit_tag_path(tag)) if policy(tag).edit?
+          td = link_to(t('shared.destroy'), tag, data: {confirm: t('shared.confirm_destroy')}, method: :delete) if tag.can_be_destroyed? &&  policy(tag).destroy?

 = render('shared/pagination', collection: @tags)
 p = render('shared/new_button', model: Tag, path: new_tag_path)
--- a/app/views/user_exercise_feedbacks/index.html.slim
+++ b/app/views/user_exercise_feedbacks/index.html.slim
@ -12,16 +12,15 @@ h1 = UserExerciseFeedback.model_name.human(count: 2)
  table.table
    thead
      tr
-        th colspan=2 = t('activerecord.attributes.user_exercise_feedback.user')
+        th = t('activerecord.attributes.user_exercise_feedback.user')
        th = t('activerecord.attributes.user_exercise_feedback.exercise')
        th colspan=2 = t('shared.actions')
    tbody
      - @uefs.each do |uef|
        tr
-          td = uef.user.id
-          td = uef.user.name
-          td = link_to(uef.exercise.title, uef.exercise)
-          td = link_to(t('shared.show'), uef)
-          td = link_to(t('shared.destroy'), uef, data: {confirm: t('shared.confirm_destroy')}, method: :delete)
+          td = link_to_if(policy(uef.user).show?, uef.user.name)
+          td = link_to_if(policy(uef.exercise).show?, uef.exercise.title, uef.exercise)
+          td = link_to(t('shared.show'), uef) if policy(uef).show?
+          td = link_to(t('shared.destroy'), uef, data: {confirm: t('shared.confirm_destroy')}, method: :delete) if policy(uef).destroy?

 = render('shared/pagination', collection: @uefs)
--- a/app/views/user_exercise_feedbacks/show.html.slim
+++ b/app/views/user_exercise_feedbacks/show.html.slim
@ -1,7 +1,7 @@
 h2 = @uef

-= row(label: 'activerecord.attributes.user_exercise_feedback.exercise', value: link_to(@uef.exercise.title, @uef.exercise))
-= row(label: 'user_exercise_feedback.user', value: @uef.user)
+= row(label: 'activerecord.attributes.user_exercise_feedback.exercise', value: link_to_if(policy(@uef.exercise).show?, @uef.exercise.title, @uef.exercise))
+= row(label: 'user_exercise_feedback.user', value: link_to_if(policy(@uef.user).show?, @uef.user))
 = row(label: 'activerecord.attributes.user_exercise_feedback.feedback_text', value: @uef.feedback_text)
 = row(label: 'user_exercise_feedback.difficulty', value: @uef.difficulty)
 = row(label: 'user_exercise_feedback.working_time', value: @uef.user_estimated_worktime)
--- a/app/views/user_mailer/exercise_anomaly_detected.html.slim
+++ b/app/views/user_mailer/exercise_anomaly_detected.html.slim
@ -12,9 +12,9 @@ table(border=1)
    - @anomalies.keys.each do | id |
      - exercise = Exercise.find(id)
      tr
-        td = link_to(exercise.title, exercise_path(exercise))
+        td = link_to_if(policy(@user, exercise).show?, exercise.title, exercise_path(exercise))
        td = @anomalies[id]
-        td = link_to(t('shared.statistics', locale: :de), statistics_exercise_path(exercise))
+        td = link_to_if(policy(@user, exercise).statistics?, t('shared.statistics', locale: :de), statistics_exercise_path(exercise))


 == t('mailers.user_mailer.exercise_anomaly_detected.body2',
@ -31,8 +31,8 @@ table(border=1)
    - @anomalies.keys.each do | id |
      - exercise = Exercise.find(id)
      tr
-        td = link_to(exercise.title, exercise_path(exercise))
+        td = link_to_if(policy(@user, exercise).show?, exercise.title, exercise_path(exercise))
        td = @anomalies[id]
-        td = link_to(t('shared.statistics', locale: :en), statistics_exercise_path(exercise))
+        td = link_to_if(policy(@user, exercise).statistics?, t('shared.statistics', locale: :en), statistics_exercise_path(exercise))

 == t('mailers.user_mailer.exercise_anomaly_detected.body3')
--- a/app/views/user_mailer/got_new_comment.slim
+++ b/app/views/user_mailer/got_new_comment.slim
@ -1 +1,7 @@
-== t('mailers.user_mailer.got_new_comment.body', receiver_displayname: @receiver_displayname, link_to_comment: link_to(@rfc_link, @rfc_link), commenting_user_displayname: @commenting_user_displayname, comment_text: @comment_text, link_my_comments: link_to(t('request_for_comments.index.get_my_comment_requests'), my_request_for_comments_url), link_all_comments: link_to(t('request_for_comments.index.all'), request_for_comments_url) )
+== t('mailers.user_mailer.got_new_comment.body',
+        receiver_displayname: @receiver_displayname,
+        link_to_comment: link_to(@rfc_link, @rfc_link),
+        commenting_user_displayname: @commenting_user_displayname,
+        comment_text: @comment_text,
+        link_my_comments: link_to(t('request_for_comments.index.get_my_comment_requests'), my_request_for_comments_url),
+        link_all_comments: link_to(t('request_for_comments.index.all'), request_for_comments_url) )
--- a/app/views/user_mailer/send_thank_you_note.slim
+++ b/app/views/user_mailer/send_thank_you_note.slim
@ -1 +1,5 @@
-== t('mailers.user_mailer.send_thank_you_note.body', receiver_displayname: @receiver_displayname, link_to_comment: link_to(@rfc_link, @rfc_link), author: @author, thank_you_note: @thank_you_note )
+== t('mailers.user_mailer.send_thank_you_note.body',
+        receiver_displayname: @receiver_displayname,
+        link_to_comment: link_to(@rfc_link, @rfc_link),
+        author: @author,
+        thank_you_note: @thank_you_note )
--- a/config/routes.rb
+++ b/config/routes.rb
@ -21,7 +21,7 @@ Rails.application.routes.draw do
      post :set_thank_you_note
    end
  end
-  resources :comments
+  resources :comments, defaults: { format: :json }
  get '/my_request_for_comments', as: 'my_request_for_comments', to: 'request_for_comments#get_my_comment_requests'
  get '/my_rfc_activity', as: 'my_rfc_activity', to: 'request_for_comments#get_rfcs_with_my_comments'

--- a/db/schema.rb
+++ b/db/schema.rb
@ -169,6 +169,7 @@ ActiveRecord::Schema.define(version: 2018_11_29_093207) do
    t.string "name", limit: 255
    t.datetime "created_at"
    t.datetime "updated_at"
+    t.string "role", default: "learner", null: false
  end

  create_table "file_templates", force: :cascade do |t|