From 9d0c9b5b2505d1de1048b35d12f9f94fe4efb7eb Mon Sep 17 00:00:00 2001 From: Stella Rouzi Date: Tue, 22 Jul 2014 17:00:41 +0300 Subject: [PATCH] do not allow access to admin area if user does not have a relevant role --- app/controllers/application_controller.rb | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 1517dc73..2962676d 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -35,8 +35,12 @@ class ApplicationController < ActionController::Base end def verify_user_admin - if self.class.to_s.split('::').first == 'Admin' - verify_user + if self.class.to_s.split('::').first == 'Admin' && verify_user + unless (current_user.has_role? :organizer, :any) || (current_user.has_role? :cfp, :any) || + (current_user.has_role? :info_desk, :any) || + (current_user.has_role? :volunteers_coordinator, :any) + raise CanCan::AccessDenied.new('You are not authorized to access this area!') + end end end