diff --git a/app/controllers/admin/base_controller.rb b/app/controllers/admin/base_controller.rb new file mode 100644 index 00000000..036aec62 --- /dev/null +++ b/app/controllers/admin/base_controller.rb @@ -0,0 +1,17 @@ +module Admin + class BaseController < ApplicationController + before_filter :verify_user_admin + + def verify_user_admin + if (current_user.nil?) + redirect_to new_user_session_path + return false + end + unless (current_user.has_role? :organizer, :any) || (current_user.has_role? :cfp, :any) || + (current_user.has_role? :info_desk, :any) || + (current_user.has_role? :volunteers_coordinator, :any) || current_user.is_admin + raise CanCan::AccessDenied.new('You are not authorized to access this area!') + end + end + end +end diff --git a/app/controllers/admin/callforpapers_controller.rb b/app/controllers/admin/callforpapers_controller.rb index 4e238027..b18d80de 100644 --- a/app/controllers/admin/callforpapers_controller.rb +++ b/app/controllers/admin/callforpapers_controller.rb @@ -1,5 +1,5 @@ module Admin - class CallforpapersController < ApplicationController + class CallforpapersController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title # load_and_authorize_resource :cfp, class: 'CallForPapers', through: :conference diff --git a/app/controllers/admin/campaigns_controller.rb b/app/controllers/admin/campaigns_controller.rb index 0c933f23..8a0e3e23 100644 --- a/app/controllers/admin/campaigns_controller.rb +++ b/app/controllers/admin/campaigns_controller.rb @@ -1,5 +1,5 @@ module Admin - class CampaignsController < ApplicationController + class CampaignsController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title load_and_authorize_resource :campaign, through: :conference diff --git a/app/controllers/admin/commercials_controller.rb b/app/controllers/admin/commercials_controller.rb index 632f396e..2a41b2dc 100644 --- a/app/controllers/admin/commercials_controller.rb +++ b/app/controllers/admin/commercials_controller.rb @@ -1,5 +1,5 @@ module Admin - class CommercialsController < ApplicationController + class CommercialsController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title load_and_authorize_resource through: :conference, except: [:new, :create] @@ -9,7 +9,7 @@ module Admin def new @commercial = @conference.commercials.build - authorize! :create, @commercial + authorize! :create, @conference.commercials.new end def edit; end diff --git a/app/controllers/admin/conference_controller.rb b/app/controllers/admin/conference_controller.rb index ca712700..6b31fd0b 100644 --- a/app/controllers/admin/conference_controller.rb +++ b/app/controllers/admin/conference_controller.rb @@ -1,5 +1,5 @@ module Admin - class ConferenceController < ApplicationController + class ConferenceController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title load_resource :user, only: [:remove_user] diff --git a/app/controllers/admin/contacts_controller.rb b/app/controllers/admin/contacts_controller.rb index 2507f4dc..c441a4c6 100644 --- a/app/controllers/admin/contacts_controller.rb +++ b/app/controllers/admin/contacts_controller.rb @@ -1,5 +1,5 @@ module Admin - class ContactsController < ApplicationController + class ContactsController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title load_and_authorize_resource through: :conference, singleton: true diff --git a/app/controllers/admin/dietchoices_controller.rb b/app/controllers/admin/dietchoices_controller.rb index bf1ffdf5..2720577c 100644 --- a/app/controllers/admin/dietchoices_controller.rb +++ b/app/controllers/admin/dietchoices_controller.rb @@ -1,5 +1,5 @@ module Admin - class DietchoicesController < ApplicationController + class DietchoicesController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title load_and_authorize_resource :dietary_choice, through: :conference diff --git a/app/controllers/admin/difficulty_levels_controller.rb b/app/controllers/admin/difficulty_levels_controller.rb index 1ed54077..cfab7528 100644 --- a/app/controllers/admin/difficulty_levels_controller.rb +++ b/app/controllers/admin/difficulty_levels_controller.rb @@ -1,5 +1,5 @@ module Admin - class DifficultyLevelsController < ApplicationController + class DifficultyLevelsController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title authorize_resource through: :conference diff --git a/app/controllers/admin/emails_controller.rb b/app/controllers/admin/emails_controller.rb index bff82c49..b0f0a26c 100644 --- a/app/controllers/admin/emails_controller.rb +++ b/app/controllers/admin/emails_controller.rb @@ -1,5 +1,5 @@ module Admin - class EmailsController < ApplicationController + class EmailsController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title load_and_authorize_resource class: EmailSettings diff --git a/app/controllers/admin/event_types_controller.rb b/app/controllers/admin/event_types_controller.rb index 34bebbf8..f6cfaab2 100644 --- a/app/controllers/admin/event_types_controller.rb +++ b/app/controllers/admin/event_types_controller.rb @@ -1,5 +1,5 @@ module Admin - class EventTypesController < ApplicationController + class EventTypesController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title authorize_resource :event_type, through: :conference diff --git a/app/controllers/admin/events_controller.rb b/app/controllers/admin/events_controller.rb index 0fbd8f77..1b534f33 100644 --- a/app/controllers/admin/events_controller.rb +++ b/app/controllers/admin/events_controller.rb @@ -1,5 +1,5 @@ module Admin - class EventsController < ApplicationController + class EventsController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title load_and_authorize_resource :event, through: :conference diff --git a/app/controllers/admin/lodgings_controller.rb b/app/controllers/admin/lodgings_controller.rb index 7db38e66..ce299ed7 100644 --- a/app/controllers/admin/lodgings_controller.rb +++ b/app/controllers/admin/lodgings_controller.rb @@ -1,5 +1,5 @@ module Admin - class LodgingsController < ApplicationController + class LodgingsController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title load_and_authorize_resource :venue, through: :conference, singleton: true authorize_resource :lodging, through: :venue diff --git a/app/controllers/admin/photos_controller.rb b/app/controllers/admin/photos_controller.rb index c5f58167..764f4532 100644 --- a/app/controllers/admin/photos_controller.rb +++ b/app/controllers/admin/photos_controller.rb @@ -1,5 +1,5 @@ module Admin - class PhotosController < ApplicationController + class PhotosController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title load_and_authorize_resource through: :conference diff --git a/app/controllers/admin/questions_controller.rb b/app/controllers/admin/questions_controller.rb index f64af6c2..a9da703b 100644 --- a/app/controllers/admin/questions_controller.rb +++ b/app/controllers/admin/questions_controller.rb @@ -1,5 +1,5 @@ module Admin - class QuestionsController < ApplicationController + class QuestionsController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title load_and_authorize_resource through: :conference, except: [:new, :create] diff --git a/app/controllers/admin/registrations_controller.rb b/app/controllers/admin/registrations_controller.rb index 677cb701..bc17b1ff 100644 --- a/app/controllers/admin/registrations_controller.rb +++ b/app/controllers/admin/registrations_controller.rb @@ -1,5 +1,5 @@ module Admin - class RegistrationsController < ApplicationController + class RegistrationsController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title load_and_authorize_resource through: :conference diff --git a/app/controllers/admin/rooms_controller.rb b/app/controllers/admin/rooms_controller.rb index f9ed42e0..0acb9586 100644 --- a/app/controllers/admin/rooms_controller.rb +++ b/app/controllers/admin/rooms_controller.rb @@ -1,5 +1,5 @@ module Admin - class RoomsController < ApplicationController + class RoomsController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title authorize_resource through: :conference diff --git a/app/controllers/admin/schedules_controller.rb b/app/controllers/admin/schedules_controller.rb index bf04d453..0a939db8 100644 --- a/app/controllers/admin/schedules_controller.rb +++ b/app/controllers/admin/schedules_controller.rb @@ -1,5 +1,5 @@ module Admin - class SchedulesController < ApplicationController + class SchedulesController < Admin::BaseController # By authorizing 'conference' resource, we can ensure there will be no unauthorized access to # the schedule of a conference, which should not be accessed in the first place load_and_authorize_resource :conference, find_by: :short_title diff --git a/app/controllers/admin/social_events_controller.rb b/app/controllers/admin/social_events_controller.rb index 47bbeceb..bc8dae88 100644 --- a/app/controllers/admin/social_events_controller.rb +++ b/app/controllers/admin/social_events_controller.rb @@ -1,5 +1,5 @@ module Admin - class SocialEventsController < ApplicationController + class SocialEventsController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title authorize_resource :social_event, through: :conference diff --git a/app/controllers/admin/speakers_controller.rb b/app/controllers/admin/speakers_controller.rb index 019cb24b..d3dfe700 100644 --- a/app/controllers/admin/speakers_controller.rb +++ b/app/controllers/admin/speakers_controller.rb @@ -1,5 +1,5 @@ module Admin - class SpeakersController < ApplicationController + class SpeakersController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title load_and_authorize_resource :event diff --git a/app/controllers/admin/sponsors_controller.rb b/app/controllers/admin/sponsors_controller.rb index 9db33120..26d1df6e 100644 --- a/app/controllers/admin/sponsors_controller.rb +++ b/app/controllers/admin/sponsors_controller.rb @@ -1,5 +1,5 @@ module Admin - class SponsorsController < ApplicationController + class SponsorsController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title authorize_resource :sponsor, through: :conference diff --git a/app/controllers/admin/sponsorship_levels_controller.rb b/app/controllers/admin/sponsorship_levels_controller.rb index bef6af72..134295e3 100644 --- a/app/controllers/admin/sponsorship_levels_controller.rb +++ b/app/controllers/admin/sponsorship_levels_controller.rb @@ -1,5 +1,5 @@ module Admin - class SponsorshipLevelsController < ApplicationController + class SponsorshipLevelsController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title authorize_resource through: :conference diff --git a/app/controllers/admin/stats_controller.rb b/app/controllers/admin/stats_controller.rb index 99bee919..a6ba21b8 100644 --- a/app/controllers/admin/stats_controller.rb +++ b/app/controllers/admin/stats_controller.rb @@ -1,5 +1,5 @@ module Admin - class StatsController < ApplicationController + class StatsController < Admin::BaseController load_and_authorize_resource load_and_authorize_resource :conference, find_by: :short_title diff --git a/app/controllers/admin/supporter_levels_controller.rb b/app/controllers/admin/supporter_levels_controller.rb index 686f16dc..f0721c94 100644 --- a/app/controllers/admin/supporter_levels_controller.rb +++ b/app/controllers/admin/supporter_levels_controller.rb @@ -1,5 +1,5 @@ module Admin - class SupporterLevelsController < ApplicationController + class SupporterLevelsController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title authorize_resource through: :conference diff --git a/app/controllers/admin/supporters_controller.rb b/app/controllers/admin/supporters_controller.rb index 99dcefb3..f1610631 100644 --- a/app/controllers/admin/supporters_controller.rb +++ b/app/controllers/admin/supporters_controller.rb @@ -1,5 +1,5 @@ module Admin - class SupportersController < ApplicationController + class SupportersController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title load_and_authorize_resource through: :conference diff --git a/app/controllers/admin/targets_controller.rb b/app/controllers/admin/targets_controller.rb index 6253459e..21246185 100644 --- a/app/controllers/admin/targets_controller.rb +++ b/app/controllers/admin/targets_controller.rb @@ -1,5 +1,5 @@ module Admin - class TargetsController < ApplicationController + class TargetsController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title authorize_resource through: :conference diff --git a/app/controllers/admin/tracks_controller.rb b/app/controllers/admin/tracks_controller.rb index 14f375f7..089afacc 100644 --- a/app/controllers/admin/tracks_controller.rb +++ b/app/controllers/admin/tracks_controller.rb @@ -1,5 +1,5 @@ module Admin - class TracksController < ApplicationController + class TracksController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title authorize_resource through: :conference diff --git a/app/controllers/admin/users_controller.rb b/app/controllers/admin/users_controller.rb index cf41882e..d5a52787 100644 --- a/app/controllers/admin/users_controller.rb +++ b/app/controllers/admin/users_controller.rb @@ -1,5 +1,5 @@ module Admin - class UsersController < ApplicationController + class UsersController < Admin::BaseController load_and_authorize_resource def new @@ -21,9 +21,9 @@ module Admin def update if @user.update_attributes(params[:user]) - redirect_to admin_users_path, notice: "Updated #{@user.email}" + redirect_to admin_users_path, notice: "Updated #{@user.name} (#{@user.email})!" else - redirect_to admin_users_path, alert: "Could not update #{@user.name}. #{@user.errors.full_messages.join '. '}." + redirect_to admin_users_path, alert: "Could not update #{@user.name} (#{@user.email}). #{@user.errors.full_messages.join('. ')}." end end diff --git a/app/controllers/admin/venue_controller.rb b/app/controllers/admin/venue_controller.rb index 14d08cd1..f2d77495 100644 --- a/app/controllers/admin/venue_controller.rb +++ b/app/controllers/admin/venue_controller.rb @@ -1,5 +1,5 @@ module Admin - class VenueController < ApplicationController + class VenueController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title load_and_authorize_resource :venue, through: :conference, singleton: true diff --git a/app/controllers/admin/volunteers_controller.rb b/app/controllers/admin/volunteers_controller.rb index 00b06c90..e6c53e6e 100644 --- a/app/controllers/admin/volunteers_controller.rb +++ b/app/controllers/admin/volunteers_controller.rb @@ -1,5 +1,5 @@ module Admin - class VolunteersController < ApplicationController + class VolunteersController < Admin::BaseController load_and_authorize_resource :conference, find_by: :short_title def index