gunghogeoduck/osem-fcy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Fix authorization of adding/removing users from roles

Browse source 
Only organizers should be able to add/remove users from all roles.
Only organizers should be able to edit/update the description of roles of their conference.
Cfp/info_desk/voluters coordinators should be to able to add/remove users only to their own teams.
This commit is contained in:
Nishanth Vijayan 2016-04-03 20:26:00 +05:30
parent ab339fadb0
commit 03fcdecdf2
3 changed files with 25 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

10
app/views/admin/roles/_users.html.haml
View file

@ -3,16 +3,18 @@
- if users.present?
%table.table.table-striped.table-bordered.table-hover.datatable#users
%thead
%th.col-md-1
- if ( can? :toggle_user, @role )
%th.col-md-1
%th ID
%th Name
%th Email
%tbody
- users.each do |user|
%tr
%td.text-right
= hidden_field_tag "role[user_ids][]", nil
= check_box_tag @conference.short_title, @role.id, (@role.user_ids.include? user.id), method: :post, url: "/admin/conference/#{@conference.short_title}/roles/#{@role.name}/toggle_user?user[email]=#{user.email}&user[state]=", class: 'switch-checkbox', data: { size: 'small', off_color: 'warning', on_text: 'Yes', off_text: 'No' }
- if ( can? :toggle_user, @role )
%td.text-right
= hidden_field_tag "role[user_ids][]", nil
= check_box_tag @conference.short_title, @role.id, (@role.user_ids.include? user.id), method: :post, url: "/admin/conference/#{@conference.short_title}/roles/#{@role.name}/toggle_user?user[email]=#{user.email}&user[state]=", class: 'switch-checkbox', data: { size: 'small', off_color: 'warning', on_text: 'Yes', off_text: 'No' }
%td= user.id
%td= user.name
%td= user.email