From b037a5eb7c3ac57c2c2dc6a386b161f43cb6d614 Mon Sep 17 00:00:00 2001 From: Ana Date: Fri, 29 Jul 2016 18:29:57 +0200 Subject: [PATCH] Load and authorize schedule in ScheduleController --- app/controllers/admin/schedule_controller.rb | 6 +----- app/models/ability.rb | 1 + spec/models/ability_spec.rb | 10 ++++++++++ 3 files changed, 12 insertions(+), 5 deletions(-) diff --git a/app/controllers/admin/schedule_controller.rb b/app/controllers/admin/schedule_controller.rb index 9248b244..be3d4b04 100644 --- a/app/controllers/admin/schedule_controller.rb +++ b/app/controllers/admin/schedule_controller.rb @@ -2,6 +2,7 @@ module Admin class ScheduleController < Admin::BaseController # By authorizing 'conference' resource, we can ensure there will be no unauthorized access to # the schedule of a conference, which should not be accessed in the first place + load_and_authorize_resource :schedule load_and_authorize_resource :conference, find_by: :short_title load_and_authorize_resource :program, through: :conference, singleton: true load_resource :venue, through: :conference, singleton: true @@ -19,7 +20,6 @@ module Admin end def show - authorize! :update, @program.events.new @schedule_id = params[:id].to_i @selected_schedule_id = @conference.program.selected_schedule.try(:id) @dates = @conference.start_date..@conference.end_date @@ -27,10 +27,6 @@ module Admin end def update - event = @program.events.new - authorize! :update, event - event.destroy - if params[:selected_schedule].present? if params[:selected_schedule] == 'true' @program.selected_schedule_id = params[:id].to_i diff --git a/app/models/ability.rb b/app/models/ability.rb index 76e1fc4c..02096392 100644 --- a/app/models/ability.rb +++ b/app/models/ability.rb @@ -143,6 +143,7 @@ class Ability can :manage, Vposition, conference_id: conf_ids_for_organizer can :manage, Vday, conference_id: conf_ids_for_organizer can :manage, Program, conference_id: conf_ids_for_organizer + can :manage, Schedule, program: { conference_id: conf_ids_for_organizer } can :manage, Cfp, program: { conference_id: conf_ids_for_organizer} can :manage, Event, program: { conference_id: conf_ids_for_organizer} can :manage, EventType, program: { conference_id: conf_ids_for_organizer} diff --git a/spec/models/ability_spec.rb b/spec/models/ability_spec.rb index 9d77d68a..abb7d95d 100644 --- a/spec/models/ability_spec.rb +++ b/spec/models/ability_spec.rb @@ -39,6 +39,8 @@ describe 'User' do let(:conference_with_closed_registration) { create(:conference) } let!(:closed_registration_period) { create(:registration_period, conference: conference_with_closed_registration, start_date: Date.current - 6.days, end_date: Date.current - 6.days) } + let!(:my_schedule) { create(:schedule, program: my_conference.program) } + let!(:other_schedule) { create(:schedule, program: conference_public.program) } # Test abilities for not signed in users context 'when user is not signed in' do it{ should be_able_to(:index, Conference)} @@ -196,6 +198,8 @@ describe 'User' do it{ should_not be_able_to(:manage, conference_public.questions.first) } it{ should be_able_to(:manage, my_conference.program.cfp) } it{ should_not be_able_to(:manage, conference_public.program.cfp) } + it{ should be_able_to(:manage, my_schedule) } + it{ should_not be_able_to(:manage, other_schedule) } it{ should be_able_to(:manage, my_conference.venue) } it{ should_not be_able_to(:manage, conference_public.venue) } it{ should be_able_to(:manage, my_conference.lodgings.first) } @@ -260,6 +264,8 @@ describe 'User' do it{ should_not be_able_to(:manage, conference_public.questions.first) } it{ should be_able_to(:manage, my_conference.program.cfp) } it{ should_not be_able_to(:manage, conference_public.program.cfp) } + it{ should_not be_able_to(:manage, my_schedule) } + it{ should_not be_able_to(:manage, other_schedule) } it{ should_not be_able_to(:manage, my_conference.venue) } it{ should be_able_to(:show, my_conference.venue) } it{ should_not be_able_to(:manage, conference_public.venue) } @@ -318,6 +324,8 @@ describe 'User' do it{ should_not be_able_to(:manage, conference_public.questions.first) } it{ should_not be_able_to(:manage, my_conference.program.cfp) } it{ should_not be_able_to(:manage, conference_public.program.cfp) } + it{ should_not be_able_to(:manage, my_schedule) } + it{ should_not be_able_to(:manage, other_schedule) } it{ should_not be_able_to(:manage, my_conference.venue) } it{ should_not be_able_to(:show, my_conference.venue) } it{ should_not be_able_to(:manage, conference_public.venue) } @@ -376,6 +384,8 @@ describe 'User' do it{ should_not be_able_to(:manage, conference_public.questions.first) } it{ should_not be_able_to(:manage, my_conference.program.cfp) } it{ should_not be_able_to(:manage, conference_public.program.cfp) } + it{ should_not be_able_to(:manage, my_schedule) } + it{ should_not be_able_to(:manage, other_schedule) } it{ should_not be_able_to(:manage, my_conference.venue) } it{ should_not be_able_to(:show, my_conference.venue) } it{ should_not be_able_to(:manage, conference_public.venue) }