From 58a3913735e3db7932662f4ac6cfcf83b66d60fb Mon Sep 17 00:00:00 2001 From: Nishanth Vijayan Date: Mon, 15 Aug 2016 14:21:33 +0530 Subject: [PATCH] Use load_and_authorize_resource in versions controlller --- app/controllers/admin/versions_controller.rb | 20 +++++++------------- app/models/ability.rb | 5 ++--- 2 files changed, 9 insertions(+), 16 deletions(-) diff --git a/app/controllers/admin/versions_controller.rb b/app/controllers/admin/versions_controller.rb index 16f38c15..7b02461a 100644 --- a/app/controllers/admin/versions_controller.rb +++ b/app/controllers/admin/versions_controller.rb @@ -1,26 +1,23 @@ module Admin class VersionsController < Admin::BaseController - skip_authorization_check + load_and_authorize_resource class: PaperTrail::Version def index authorize! :index, PaperTrail::Version.new(item_type: 'User') @conf_ids_for_organizer = current_user.is_admin? ? Conference.pluck(:id) : Conference.with_role(:organizer, current_user).pluck(:id) @conference_id = params[:conference_id].to_i unless params[:conference_id].nil? - if @conference_id.nil? - @versions = PaperTrail::Version.where(["conference_id IN (?) OR item_type = 'User'", @conf_ids_for_organizer]) - elsif !Conference.exists?(id: @conference_id) + + unless @conference_id.nil? || Conference.exists?(id: @conference_id) redirect_to admin_revision_history_path, error: "Conference with ID #{@conference_id} does not exist!" return - else - authorize! :index, PaperTrail::Version.new(conference_id: @conference_id) - @versions = PaperTrail::Version.where(conference_id: @conference_id) end + + return unless @conference_id.present? + authorize! :index, PaperTrail::Version.new(conference_id: @conference_id) + @versions = @versions.where(conference_id: @conference_id) end def revert_attribute - @version = PaperTrail::Version.find(params[:id]) - authorize! :revert_attribute, @version - if params[:attribute] && @version.changeset.reject{ |_, values| values[0].blank? && values[1].blank? }.keys.include?(params[:attribute]) if @version.item[params[:attribute]] == @version.changeset[params[:attribute]][0] flash[:error] = 'The item is already in the state that you are trying to revert it back to' @@ -42,9 +39,6 @@ module Admin end def revert_object - @version = PaperTrail::Version.find(params[:id]) - authorize! :revert_object, @version - if @version.event != 'create' if @version.reify.save flash[:notice] = 'The selected change was successfully reverted' diff --git a/app/models/ability.rb b/app/models/ability.rb index 760f43fe..699e4f54 100644 --- a/app/models/ability.rb +++ b/app/models/ability.rb @@ -178,9 +178,8 @@ class Ability role.resource_type == 'Conference' && (conf_ids_for_organizer.include? role.resource_id) end - can [:index, :revert_object, :revert_attribute], PaperTrail::Version do |version| - version.item_type == 'User' || (conf_ids_for_organizer.include? version.conference_id) - end + can [:index, :revert_object, :revert_attribute], PaperTrail::Version, item_type: 'User' + can [:index, :revert_object, :revert_attribute], PaperTrail::Version, conference_id: conf_ids_for_organizer end def signed_in_with_cfp_role(user)