gunghogeoduck/osem-fcy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

verify user if accessing admin area. Testing: setup organizer_conference_1_role

Browse source
This commit is contained in:
Stella Rouzi 2014-07-18 20:49:50 +03:00
parent ab17e6db11
commit 940f76bf13
22 changed files with 91 additions and 62 deletions
Download patch file Download diff file Expand all files Collapse all files

7
app/controllers/application_controller.rb
View file

@ -3,6 +3,7 @@ class ApplicationController < ActionController::Base
protect_from_forgery
before_filter :get_conferences
before_filter :store_location
before_filter :verify_user_admin
helper_method :date_string
# Ensure every controller authorizes resource or skips authorization (skip_authorization_check)
check_authorization unless: :devise_controller?
@ -33,6 +34,12 @@ class ApplicationController < ActionController::Base
@conferences =Conference.all
end
def verify_user_admin
if self.class.to_s.split('::').first == 'Admin'
verify_user
end
end
def verify_user
:authenticate_user!

5
app/models/ability.rb
View file

@ -71,6 +71,9 @@ class Ability
# Ids of all the conferences for which the user has an 'organizer' role
conf_ids_for_organizer =
Conference.with_role(:organizer, user).pluck(:id) unless user.new_record?
# Ids of the venues of the conference for which (conferences) the user has an 'organizer' role
conf_ids_for_organizer_venue =
Conference.with_role(:organizer, user).pluck(:venue_id) unless user.new_record?
# Ids of all the conferences for which the user has a 'cfp' role
conf_ids_for_cfp =
Conference.with_role(:cfp, user).pluck(:id) unless user.new_record?
@ -105,7 +108,7 @@ class Ability
# Authorize Conference by its 'id' attribute
can :manage, Conference, id: conf_ids_for_organizer
# Authorize venues of conferences, which user can manage
can :manage, Venue, conference: { id: conf_ids_for_organizer }
can :manage, Venue, id: conf_ids_for_organizer_venue
# id: Conference.where(id: conf_ids_for_organizer).map(&:venue_id)
# User can view the admin 'users' page if he is an organizer for any conference
can :manage, User if user.has_role?('organizer', :any)