work on authorization in controllers and refine ability.rb

app/controllers/admin/events_controller.rb

@@ -1,9 +1,8 @@
 module Admin
   class EventsController < ApplicationController
-    load_and_authorize_resource :conference, find_by: :short_title
+    load_resource :conference, find_by: :short_title
     load_and_authorize_resource :event, through: :conference
-
-    before_action :get_event, except: [:index, :create]
+    before_filter :authorize_conference
 
     # FIXME: The timezome should only be applied on output, otherwise
     # you get lost in timezone conversions...
@@ -14,7 +13,6 @@ module Admin
     end
 
     def index
-      @conference = Conference.find_by(short_title: params[:conference_id])
       @events = @conference.events
       @tracks = @conference.tracks
       @machine_states = @events.state_machine.states.map
@@ -170,15 +168,6 @@ module Admin
 
     private
 
-    def get_event
-      @event = @conference.events.find_by_id(params[:id])
-      if !@event
-        redirect_to(admin_conference_events_path(conference_id: @conference.short_title),
-                    alert: 'Error! Could not find event!') && return
-      end
-      @event
-    end
-
     def update_state(transition, notice, mail = false, subject = false, send_mail = false)
       alert = @event.update_state(transition, mail, subject, send_mail, params[:send_mail].blank?)
 

app/controllers/admin/speakers_controller.rb

@@ -1,17 +1,15 @@
 module Admin
   class SpeakersController < ApplicationController
     load_and_authorize_resource :conference, find_by: :short_title
-    load_and_authorize_resource :speaker, through: :conference
+    load_resource :event, through: :conference
 
     respond_to :js, :html
 
     def edit
-      @event = @conference.events.find(params[:event_id])
       @speaker = @event.event_users.where(event_role: 'speaker').first
     end
 
     def update
-      @event = @conference.events.find(params[:event_id])
       @speaker = @event.event_users.where(event_role: 'speaker').first
       @speaker.user_id = params[:speaker][:user_id]
       @speaker.save