authorization with cancancan

app/controllers/event_attachments_controller.rb

@@ -1,9 +1,11 @@
 class EventAttachmentsController < ApplicationController
+  load_and_authorize_resource :conference, find_by: :short_title
+  load_and_authorize_resource :proposal, class: Event
+  load_and_authorize_resource :upload, class: EventAttachment, through: :proposal
   before_filter :verify_user
   skip_before_filter :verify_user, only: [:show]
 
   def index
-    @proposal = Event.find(params[:proposal_id])
     @uploads = @proposal.event_attachments
     @uploads = @uploads.map{|upload| upload.to_jq_upload }
 
@@ -14,9 +16,9 @@ class EventAttachmentsController < ApplicationController
   end
 
   def show
-    upload = EventAttachment.find(params[:id])
-    if upload.public?
-      send_file upload.attachment.path
+
+    if @upload.public?
+      send_file @upload.attachment.path
       return
     end
 
@@ -26,7 +28,7 @@ class EventAttachmentsController < ApplicationController
     end
 
     if organizer_or_admin? || current_user == upload.event.submitter
-      send_file upload.attachment.path
+      send_file @upload.attachment.path
     else
       raise ActionController::RoutingError.new('Not Found')
     end
@@ -42,7 +44,6 @@ class EventAttachmentsController < ApplicationController
   end
 
   def edit
-    @upload = EventAttachment.find(params[:id])
   end
 
   def create
@@ -50,7 +51,7 @@ class EventAttachmentsController < ApplicationController
     params[:event_attachment][:public] = false
     params[:event_attachment][:event_id] = params[:proposal_id]
 
-    if !organizer_or_admin?
+    if cannot? :create, EventAttachment
       begin
         current_user.events.find(params[:proposal_id])
       rescue
@@ -83,8 +84,6 @@ class EventAttachmentsController < ApplicationController
   end
 
   def update
-    @proposal = current_user.events.find(params[:proposal_id])
-    @upload = @proposal.event_attachments.find(params[:proposal_id])
 
     respond_to do |format|
       if @upload.update_attributes(params[:upload])
@@ -98,14 +97,13 @@ class EventAttachmentsController < ApplicationController
   end
 
   def destroy
-    @proposal = Event.find(params[:proposal_id])
-    
-    if organizer_or_admin? || current_user == @proposal.submitter
+
+    if can? :destroy, @proposal
       @upload = @proposal.event_attachments.find(params[:id])
     end
-    
+
     @upload.destroy if !@upload.nil?
-    
+
     respond_to do |format|
 
       format.html { redirect_back_or_to conference_proposal_index_path(@conference.short_title), notice: "Deleted successfully attachment '#{@upload.title}' for proposal '#{@proposal.title}'" }