gunghogeoduck/osem-fcy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix hakiri issue and added authorization

Browse source
This commit is contained in:
Shlok Srivastava 2017-04-29 19:35:30 +00:00
parent c07fd304c0
commit 360a764cb4
2 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
app/controllers/rater_controller.rb
View file

@ -1,7 +1,14 @@
class RaterController < ApplicationController class RaterController < ApplicationController
load_and_authorize_resource :rate
def create def create
if user_signed_in? if user_signed_in?
obj = params[:klass].classify.constantize.find(params[:id]) votable_type = ''
VotableField::VALID_VOTABLE_TYPES.each do |valid_votable_type|
votable_type = valid_votable_type
break if params[:klass] == votable_type
end
obj = votable_type.classify.constantize.find(params[:id])
obj.rate params[:score].to_f, current_user, params[:dimension] obj.rate params[:score].to_f, current_user, params[:dimension]
render json: true render json: true

2
app/models/ability.rb
View file

@ -138,6 +138,7 @@ class Ability
# ids of all the conferences for which the user has the 'organizer' role # ids of all the conferences for which the user has the 'organizer' role
conf_ids_for_organizer = Conference.with_role(:organizer, user).pluck(:id) conf_ids_for_organizer = Conference.with_role(:organizer, user).pluck(:id)
can :manage, Rate, conference_id: conf_ids_for_organizer
can :manage, VotableField, conference_id: conf_ids_for_organizer can :manage, VotableField, conference_id: conf_ids_for_organizer
can :manage, Resource, conference_id: conf_ids_for_organizer can :manage, Resource, conference_id: conf_ids_for_organizer
can [:new, :create], Conference if user.has_role?(:organizer, :any) can [:new, :create], Conference if user.has_role?(:organizer, :any)
@ -193,6 +194,7 @@ class Ability
# ids of all the conferences for which the user has the 'cfp' role # ids of all the conferences for which the user has the 'cfp' role
conf_ids_for_cfp = Conference.with_role(:cfp, user).pluck(:id) conf_ids_for_cfp = Conference.with_role(:cfp, user).pluck(:id)
can :manage, Rate, conference_id: conf_ids_for_cfp
can :manage, VotableField, conference_id: conf_ids_for_cfp can :manage, VotableField, conference_id: conf_ids_for_cfp
can [:index, :show, :update], Resource, conference_id: conf_ids_for_cfp can [:index, :show, :update], Resource, conference_id: conf_ids_for_cfp
can :manage, Event, program: { conference_id: conf_ids_for_cfp } can :manage, Event, program: { conference_id: conf_ids_for_cfp }