From e61fee82582933342c90d2b32c3e8008e8a134e7 Mon Sep 17 00:00:00 2001
From: Raoul Snyman <raoul.snyman@saturnlaboratories.co.za>
Date: Tue, 19 Jan 2010 21:51:45 +0200
Subject: [PATCH 1/2] Added some authentication methods.

---
 scribeengine/controllers/blog.py | 1 +
 scribeengine/controllers/post.py | 1 +
 2 files changed, 2 insertions(+)

diff --git a/scribeengine/controllers/blog.py b/scribeengine/controllers/blog.py
index 12b34e8..85d7046 100644
--- a/scribeengine/controllers/blog.py
+++ b/scribeengine/controllers/blog.py
@@ -71,6 +71,7 @@ class BlogController(BaseController):
         c.page_title = c.post.title
         return render(u'/blog/view.mako')
 
+    @authenticate()
     def comment_POST(self, id):
         if not id:
             h.flash.set_message(u'There was a problem submitting your comment.', u'error')
diff --git a/scribeengine/controllers/post.py b/scribeengine/controllers/post.py
index cba2b1f..7cd45c1 100644
--- a/scribeengine/controllers/post.py
+++ b/scribeengine/controllers/post.py
@@ -48,6 +48,7 @@ class PostController(BaseController):
         c.page_title = 'Edit Post: %s' % c.post.title
         return render(u'/post/edit.mako')
 
+    @authenticate()
     def edit_POST(self, id=None):
         url = utils.generate_url(c.form_values[u'title'])
         if id is None:

From 3ad5f581d49196087d624d3ba384211fde35f6af Mon Sep 17 00:00:00 2001
From: Raoul Snyman <raoul.snyman@saturnlaboratories.co.za>
Date: Tue, 19 Jan 2010 22:44:25 +0200
Subject: [PATCH 2/2] Conditionally show the "new post" link for users with the
 permission to add posts.

---
 scribeengine/templates/base.mako | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/scribeengine/templates/base.mako b/scribeengine/templates/base.mako
index 4f127d2..514cbe5 100644
--- a/scribeengine/templates/base.mako
+++ b/scribeengine/templates/base.mako
@@ -20,10 +20,12 @@
             <li><a href="${page.url}">${page.name}</a></li>
 % endfor
 % if c.current_user:
-            <li><a href="${h.url_for(controller='post',action='new')}">New Post</a></li>
-            <li><a href="${h.url_for(controller='admin',action='logout')}">Logout</a></li>
+% if c.current_user.has_permission('Add Posts'):
+            <li><a href="${h.url_for(controller='post', action='new')}">New Post</a></li>
+% endif
+            <li><a href="${h.url_for(controller='admin', action='logout')}">Logout</a></li>
 % else:
-            <li><a href="${h.url_for(controller='admin',action='login')}">Login</a></li>
+            <li><a href="${h.url_for(controller='admin', action='login')}">Login</a></li>
 % endif
         </ul>
     </div>