gunghogeoduck/osem-fcy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Refactor authorization for schedule action of Conferences Controller

Browse source 
Remove can ability for schedule and events action in ability.rb as both the actions are no longer present in conferences_controller. Replace load_and_authorize_resource with load_resource for program in the schedules_controller.

Closes #1457
This commit is contained in:
Chaitanya 2017-04-19 21:17:58 +05:30
parent 1c38b091cc
commit 41ae0279b8
2 changed files with 1 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
app/controllers/admin/schedules_controller.rb
View file

@ -3,7 +3,7 @@ module Admin
# By authorizing 'conference' resource, we can ensure there will be no unauthorized access to
# the schedule of a conference, which should not be accessed in the first place
load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource :program, through: :conference, singleton: true
load_resource :program, through: :conference, singleton: true
load_and_authorize_resource :schedule, through: :program
load_resource :event_schedules, through: :schedule
load_resource :selected_schedule, through: :program, singleton: true

4
app/models/ability.rb
View file

@ -33,10 +33,6 @@ class Ability
can [:show], Conference do |conference|
conference.splashpage && conference.splashpage.public == true
end
# Can view the schedule
can [:schedule, :events], Conference do |conference|
conference.program.cfp && conference.program.schedule_public
end
can :show, Event do |event|
event.state == 'confirmed'