diff --git a/app/controllers/admin/events_controller.rb b/app/controllers/admin/events_controller.rb index a5085883..c38b8b54 100644 --- a/app/controllers/admin/events_controller.rb +++ b/app/controllers/admin/events_controller.rb @@ -1,9 +1,8 @@ module Admin class EventsController < ApplicationController - load_and_authorize_resource :conference, find_by: :short_title + load_resource :conference, find_by: :short_title load_and_authorize_resource :event, through: :conference - - before_action :get_event, except: [:index, :create] + before_filter :authorize_conference # FIXME: The timezome should only be applied on output, otherwise # you get lost in timezone conversions... @@ -14,7 +13,6 @@ module Admin end def index - @conference = Conference.find_by(short_title: params[:conference_id]) @events = @conference.events @tracks = @conference.tracks @machine_states = @events.state_machine.states.map @@ -170,15 +168,6 @@ module Admin private - def get_event - @event = @conference.events.find_by_id(params[:id]) - if !@event - redirect_to(admin_conference_events_path(conference_id: @conference.short_title), - alert: 'Error! Could not find event!') && return - end - @event - end - def update_state(transition, notice, mail = false, subject = false, send_mail = false) alert = @event.update_state(transition, mail, subject, send_mail, params[:send_mail].blank?) diff --git a/app/controllers/admin/speakers_controller.rb b/app/controllers/admin/speakers_controller.rb index 0b204037..cddb0bd0 100644 --- a/app/controllers/admin/speakers_controller.rb +++ b/app/controllers/admin/speakers_controller.rb @@ -1,17 +1,15 @@ module Admin class SpeakersController < ApplicationController load_and_authorize_resource :conference, find_by: :short_title - load_and_authorize_resource :speaker, through: :conference + load_resource :event, through: :conference respond_to :js, :html def edit - @event = @conference.events.find(params[:event_id]) @speaker = @event.event_users.where(event_role: 'speaker').first end def update - @event = @conference.events.find(params[:event_id]) @speaker = @event.event_users.where(event_role: 'speaker').first @speaker.user_id = params[:speaker][:user_id] @speaker.save diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 2962676d..85564e87 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -34,11 +34,15 @@ class ApplicationController < ActionController::Base @conferences =Conference.all end + def authorize_conference + authorize! :update, @conference + end + def verify_user_admin if self.class.to_s.split('::').first == 'Admin' && verify_user unless (current_user.has_role? :organizer, :any) || (current_user.has_role? :cfp, :any) || (current_user.has_role? :info_desk, :any) || - (current_user.has_role? :volunteers_coordinator, :any) + (current_user.has_role? :volunteers_coordinator, :any) || (current_user.is_admin) raise CanCan::AccessDenied.new('You are not authorized to access this area!') end end diff --git a/app/controllers/conference_registration_controller.rb b/app/controllers/conference_registration_controller.rb index 27179c4e..540e3284 100644 --- a/app/controllers/conference_registration_controller.rb +++ b/app/controllers/conference_registration_controller.rb @@ -1,7 +1,7 @@ class ConferenceRegistrationController < ApplicationController before_filter :verify_user - load_and_authorize_resource :conference, find_by: :short_title - authorize_resource :conference_registration, class: Registration + load_resource :conference, find_by: :short_title + load_and_authorize_resource :conference_registration, class: Registration def register @workshops = @conference.events.where('require_registration = ? AND state LIKE ?', diff --git a/app/models/ability.rb b/app/models/ability.rb index 23a28c8a..f76eaf1e 100644 --- a/app/models/ability.rb +++ b/app/models/ability.rb @@ -23,12 +23,13 @@ class Ability # Check roles of user, using rolify. Role name is *case sensitive* # user.is_organizer? or user.has_role? :organizer - # user.is_cfp_of? Conference or user.has_role? :cfp, Conference - # user.is_info_desk_of? Conference - # user.is_volunteer_coordinator_of? Conference - # user.is_attendee_of? Conference + # We only assign roles per conference, so: + # user.is_cfp_of? Conference.find(1) or user.has_role? :cfp, @conference + # user.is_info_desk_of? @conference + # user.is_volunteer_coordinator_of? @conference + # user.is_attendee_of? @conference # The following is wrong because a user will only have 'cfp' role for a specific conference - # user.is_cfp? # This is always false + # user.is_cfp? # Always FALSE # Ids of all the conferences for which the user has an 'organizer' role conf_ids_for_organizer = @@ -48,31 +49,23 @@ class Ability event_ids_for_user = EventUser.where(user_id: user.id).pluck(:event_id) - ## Abilities for everyone, even guests (not logged in users) - can :show, Conference do |conference| - conference.make_conference_public - end + ## Abilities for everyone (incl. GUESTS - not logged in users) + can :show, Conference, make_conference_public: true - can :show, Event do |event| - event.state == 'confirmed' - end + can :show, Event, state: 'confirmed' - can :index, :schedule # show? + can :index, :schedule ## Abilities for signed in users unless user.new_record? - can :show, Conference do |conference| - conference.make_conference_public - end - # Conference Registration - can :manage, Registration + can [:register, :update, :unregister], Registration, user_id: user.id # Proposals # Users can edit their own proposals # Organizer and CfP team can edit any proposal they want # Can manage an event if the user is a speaker or a submitter of that event -# can [:index, :create], Event + can :create, Event can :manage, Event do |event| event.event_users.where(:user_id => user.id).present? @@ -88,7 +81,7 @@ class Ability if user.is_admin # is_admin is an attribute of User can :create, Conference can :index, Conference # this will allow the Conference to appear in the menu - can :view, Conference # for /admin/conference overview + can :show, Conference # for /admin/conference overview can :manage, User # to make other users admins end