From 360a764cb4e04619d6615aa952747ed141f43517 Mon Sep 17 00:00:00 2001 From: Shlok Srivastava Date: Sat, 29 Apr 2017 19:35:30 +0000 Subject: [PATCH] fix hakiri issue and added authorization --- app/controllers/rater_controller.rb | 9 ++++++++- app/models/ability.rb | 2 ++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/app/controllers/rater_controller.rb b/app/controllers/rater_controller.rb index 0a2c150d..a4e8348a 100644 --- a/app/controllers/rater_controller.rb +++ b/app/controllers/rater_controller.rb @@ -1,7 +1,14 @@ class RaterController < ApplicationController + load_and_authorize_resource :rate + def create if user_signed_in? - obj = params[:klass].classify.constantize.find(params[:id]) + votable_type = '' + VotableField::VALID_VOTABLE_TYPES.each do |valid_votable_type| + votable_type = valid_votable_type + break if params[:klass] == votable_type + end + obj = votable_type.classify.constantize.find(params[:id]) obj.rate params[:score].to_f, current_user, params[:dimension] render json: true diff --git a/app/models/ability.rb b/app/models/ability.rb index 74f0d56c..05d64e06 100644 --- a/app/models/ability.rb +++ b/app/models/ability.rb @@ -138,6 +138,7 @@ class Ability # ids of all the conferences for which the user has the 'organizer' role conf_ids_for_organizer = Conference.with_role(:organizer, user).pluck(:id) + can :manage, Rate, conference_id: conf_ids_for_organizer can :manage, VotableField, conference_id: conf_ids_for_organizer can :manage, Resource, conference_id: conf_ids_for_organizer can [:new, :create], Conference if user.has_role?(:organizer, :any) @@ -193,6 +194,7 @@ class Ability # ids of all the conferences for which the user has the 'cfp' role conf_ids_for_cfp = Conference.with_role(:cfp, user).pluck(:id) + can :manage, Rate, conference_id: conf_ids_for_cfp can :manage, VotableField, conference_id: conf_ids_for_cfp can [:index, :show, :update], Resource, conference_id: conf_ids_for_cfp can :manage, Event, program: { conference_id: conf_ids_for_cfp }