课程教师列表增加权限控制

app/controllers/courses_controller.rb

@@ -198,6 +198,7 @@ class CoursesController < ApplicationController
 
   def member
     ## 有角色参数的才是课程，没有的就是项目
+    if User.current.member_of_course?(@course) || User.current.admin?
       @render_file = 'member_list'
       @teachers= searchTeacherAndAssistant(@course)
       @canShowCode = isCourseTeacher(User.current.id,@course) && params[:role] != '1'
@@ -214,6 +215,9 @@ class CoursesController < ApplicationController
       end
       @members = paginateHelper @members
       render :layout => 'base_courses'
+    else
+       render_403
+    end
   end
 
   #判断指定用户是否为课程教师