From 41ae0279b83a80a4bd5ce21315a6ba211b9579ea Mon Sep 17 00:00:00 2001 From: Chaitanya Date: Wed, 19 Apr 2017 21:17:58 +0530 Subject: [PATCH] Refactor authorization for schedule action of Conferences Controller Remove can ability for schedule and events action in ability.rb as both the actions are no longer present in conferences_controller. Replace load_and_authorize_resource with load_resource for program in the schedules_controller. Closes #1457 --- app/controllers/admin/schedules_controller.rb | 2 +- app/models/ability.rb | 4 ---- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/app/controllers/admin/schedules_controller.rb b/app/controllers/admin/schedules_controller.rb index d3c7cea3..4ed535c2 100644 --- a/app/controllers/admin/schedules_controller.rb +++ b/app/controllers/admin/schedules_controller.rb @@ -3,7 +3,7 @@ module Admin # By authorizing 'conference' resource, we can ensure there will be no unauthorized access to # the schedule of a conference, which should not be accessed in the first place load_and_authorize_resource :conference, find_by: :short_title - load_and_authorize_resource :program, through: :conference, singleton: true + load_resource :program, through: :conference, singleton: true load_and_authorize_resource :schedule, through: :program load_resource :event_schedules, through: :schedule load_resource :selected_schedule, through: :program, singleton: true diff --git a/app/models/ability.rb b/app/models/ability.rb index cc23a631..fcd615cc 100644 --- a/app/models/ability.rb +++ b/app/models/ability.rb @@ -33,10 +33,6 @@ class Ability can [:show], Conference do |conference| conference.splashpage && conference.splashpage.public == true end - # Can view the schedule - can [:schedule, :events], Conference do |conference| - conference.program.cfp && conference.program.schedule_public - end can :show, Event do |event| event.state == 'confirmed'