work on authorization in controllers and refine ability.rb

app/controllers/admin/events_controller.rb

@@ -1,9 +1,8 @@
 module Admin
   class EventsController < ApplicationController
-    load_and_authorize_resource :conference, find_by: :short_title
+    load_resource :conference, find_by: :short_title
     load_and_authorize_resource :event, through: :conference
-
-    before_action :get_event, except: [:index, :create]
+    before_filter :authorize_conference
 
     # FIXME: The timezome should only be applied on output, otherwise
     # you get lost in timezone conversions...
@@ -14,7 +13,6 @@ module Admin
     end
 
     def index
-      @conference = Conference.find_by(short_title: params[:conference_id])
       @events = @conference.events
       @tracks = @conference.tracks
       @machine_states = @events.state_machine.states.map
@@ -170,15 +168,6 @@ module Admin
 
     private
 
-    def get_event
-      @event = @conference.events.find_by_id(params[:id])
-      if !@event
-        redirect_to(admin_conference_events_path(conference_id: @conference.short_title),
-                    alert: 'Error! Could not find event!') && return
-      end
-      @event
-    end
-
     def update_state(transition, notice, mail = false, subject = false, send_mail = false)
       alert = @event.update_state(transition, mail, subject, send_mail, params[:send_mail].blank?)
 

app/controllers/admin/speakers_controller.rb

@@ -1,17 +1,15 @@
 module Admin
   class SpeakersController < ApplicationController
     load_and_authorize_resource :conference, find_by: :short_title
-    load_and_authorize_resource :speaker, through: :conference
+    load_resource :event, through: :conference
 
     respond_to :js, :html
 
     def edit
-      @event = @conference.events.find(params[:event_id])
       @speaker = @event.event_users.where(event_role: 'speaker').first
     end
 
     def update
-      @event = @conference.events.find(params[:event_id])
       @speaker = @event.event_users.where(event_role: 'speaker').first
       @speaker.user_id = params[:speaker][:user_id]
       @speaker.save

app/controllers/application_controller.rb

@@ -34,11 +34,15 @@ class ApplicationController < ActionController::Base
     @conferences =Conference.all
   end
 
+  def authorize_conference
+    authorize! :update, @conference
+  end
+
   def verify_user_admin
     if self.class.to_s.split('::').first == 'Admin' && verify_user
       unless (current_user.has_role? :organizer, :any) || (current_user.has_role? :cfp, :any) ||
           (current_user.has_role? :info_desk, :any) ||
-          (current_user.has_role? :volunteers_coordinator, :any)
+          (current_user.has_role? :volunteers_coordinator, :any) || (current_user.is_admin)
         raise CanCan::AccessDenied.new('You are not authorized to access this area!')
       end
     end

app/controllers/conference_registration_controller.rb

@@ -1,7 +1,7 @@
 class ConferenceRegistrationController < ApplicationController
   before_filter :verify_user
-  load_and_authorize_resource :conference, find_by: :short_title
-  authorize_resource :conference_registration, class: Registration
+  load_resource :conference, find_by: :short_title
+  load_and_authorize_resource :conference_registration, class: Registration
 
   def register
     @workshops = @conference.events.where('require_registration = ? AND state LIKE ?',