gunghogeoduck/osem-fcy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

authorization with cancancan

Browse source
This commit is contained in:
Stella Rouzi 2014-07-11 18:54:51 +03:00
parent 4af0e59ca6
commit c3ed57e3e9
34 changed files with 538 additions and 500 deletions
Download patch file Download diff file Expand all files Collapse all files

87
app/controllers/admin/callforpapers_controller.rb
View file

@ -1,52 +1,55 @@
class Admin::CallforpapersController < ApplicationController module Admin
before_filter :verify_organizer class CallforpapersController < ApplicationController
load_and_authorize_resource :conference, find_by: :short_title
# load_and_authorize_resource :call_for_paper, class: 'CallForPapers', through: :conference
def show def show
@cfp = @conference.call_for_papers @cfp = @conference.call_for_papers
if @cfp.nil? if @cfp.nil?
@cfp = CallForPapers.new @cfp = CallForPapers.new
end
end end
end
def update def update
@cfp = @conference.call_for_papers @cfp = @conference.call_for_papers
@cfp.assign_attributes(params[:call_for_papers]) @cfp.assign_attributes(params[:call_for_papers])
notify_on_schedule_public = @cfp.schedule_public_changed? && @cfp.schedule_public\ notify_on_schedule_public = @cfp.schedule_public_changed? && @cfp.schedule_public\
&& @conference.email_settings.send_on_call_for_papers_schedule_public\ && @conference.email_settings.send_on_call_for_papers_schedule_public\
&& !@conference.email_settings.call_for_papers_schedule_public_subject.blank?\ && !@conference.email_settings.call_for_papers_schedule_public_subject.blank?\
&& !@conference.email_settings.call_for_papers_schedule_public_template.blank? && !@conference.email_settings.call_for_papers_schedule_public_template.blank?
notify_on_cfp_date_update = !@cfp.end_date.blank? && !@cfp.start_date.blank?\ notify_on_cfp_date_update = !@cfp.end_date.blank? && !@cfp.start_date.blank?\
&& (@cfp.start_date_changed? || @cfp.end_date_changed?)\ && (@cfp.start_date_changed? || @cfp.end_date_changed?)\
&& @conference.email_settings.send_on_call_for_papers_dates_updates\ && @conference.email_settings.send_on_call_for_papers_dates_updates\
&& !@conference.email_settings.call_for_papers_dates_updates_subject.blank?\ && !@conference.email_settings.call_for_papers_dates_updates_subject.blank?\
&& !@conference.email_settings.call_for_papers_dates_updates_template.blank? && !@conference.email_settings.call_for_papers_dates_updates_template.blank?
if @cfp.update_attributes(params[:call_for_papers]) if @cfp.update_attributes(params[:call_for_papers])
Mailbot.delay.send_on_call_for_papers_dates_updates(@conference) if notify_on_cfp_date_update Mailbot.delay.send_on_call_for_papers_dates_updates(@conference) if notify_on_cfp_date_update
Mailbot.delay.send_on_schedule_public(@conference) if notify_on_schedule_public Mailbot.delay.send_on_schedule_public(@conference) if notify_on_schedule_public
redirect_to(admin_conference_callforpapers_path( redirect_to(admin_conference_callforpapers_path(
id: @conference.short_title), id: @conference.short_title),
notice: 'Call for Papers was successfully updated.') notice: 'Call for Papers was successfully updated.')
else else
redirect_to(admin_conference_callforpapers_path( redirect_to(admin_conference_callforpapers_path(
id: @conference.short_title), id: @conference.short_title),
alert: "Updating call for papers failed. #{@cfp.errors.to_a.join(". ")}.") alert: "Updating call for papers failed. #{@cfp.errors.to_a.join(". ")}.")
end
end end
end
def create def create
@cfp = CallForPapers.new(params[:call_for_papers]) @cfp = CallForPapers.new(params[:call_for_papers])
if @cfp.valid? if @cfp.valid?
@cfp.save @cfp.save
@conference.call_for_papers = @cfp @conference.call_for_papers = @cfp
redirect_to(admin_conference_callforpapers_path( redirect_to(admin_conference_callforpapers_path(
id: @conference.short_title), id: @conference.short_title),
notice: 'Call for Papers was successfully created.') notice: 'Call for Papers was successfully created.')
else else
redirect_to(admin_conference_callforpapers_path( redirect_to(admin_conference_callforpapers_path(
id: @conference.short_title), id: @conference.short_title),
alert: "Creating the call for papers failed. #{@cfp.errors.to_a.join(". ")}.") alert: "Creating the call for papers failed. #{@cfp.errors.to_a.join(". ")}.")
end
end end
end end
end end

3
app/controllers/admin/campaigns_controller.rb
View file

@ -1,6 +1,7 @@
module Admin module Admin
class CampaignsController < ApplicationController class CampaignsController < ApplicationController
before_filter :verify_organizer load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource :campaign, through: :conference
def index def index
@conference = Conference.find_by(short_title: params[:conference_id]) @conference = Conference.find_by(short_title: params[:conference_id])

282
app/controllers/admin/conference_controller.rb
View file

@ -1,133 +1,136 @@
class Admin::ConferenceController < ApplicationController module Admin
before_filter :verify_organizer class ConferenceController < ApplicationController
load_and_authorize_resource :conference, find_by: :short_title
def index def index
# Redirect to new form if there is no conference # Redirect to new form if there is no conference
if Conference.count == 0 if Conference.count == 0
redirect_to new_admin_conference_path redirect_to new_admin_conference_path
return return
end
@total_user = User.count
@new_user = User.where('created_at > ?', current_user.last_sign_in_at).count
@total_reg = Registration.count
@new_reg = Registration.where('created_at > ?', current_user.last_sign_in_at).count
@total_submissions = Event.count
@new_submissions = Event.where('created_at > ?', current_user.last_sign_in_at).count
@active_conferences = Conference.get_active_conferences_for_dashboard # pending or the last two
@deactive_conferences = Conference.
get_conferences_without_active_for_dashboard(@active_conferences) # conferences without active
@conferences = @active_conferences + @deactive_conferences
@recent_users = User.limit(5).order(created_at: :desc)
@recent_events = Event.limit(5).order(created_at: :desc)
@recent_registrations = Registration.limit(5).order(created_at: :desc)
@top_submitter = Conference.get_top_submitter
@submissions = {}
@cfp_weeks = [0]
@registrations = {}
@registration_weeks = [0]
@conferences.each do |c|
# Event submissions over time chart
@submissions[c.short_title] = c.get_submissions_per_week
@cfp_weeks.push(@submissions[c.short_title].length)
# Conference registrations over time chart
@registrations[c.short_title] = c.get_registrations_per_week
@registration_weeks.push(@registrations[c.short_title].length)
end
@cfp_weeks = @cfp_weeks.max
@submissions = normalize_array_length(@submissions, @cfp_weeks)
@cfp_weeks = @cfp_weeks > 0 ? (1..@cfp_weeks).to_a : 1
@registration_weeks = @registration_weeks.max
@registrations = normalize_array_length(@registrations, @registration_weeks)
@registration_weeks = @registration_weeks > 0 ? (1..@registration_weeks).to_a : 1
@event_distribution = Conference.event_distribution
@user_distribution = Conference.user_distribution
end end
@total_user = User.count def new
@new_user = User.where('created_at > ?', current_user.last_sign_in_at).count @conference = Conference.new
@total_reg = Registration.count
@new_reg = Registration.where('created_at > ?', current_user.last_sign_in_at).count
@total_submissions = Event.count
@new_submissions = Event.where('created_at > ?', current_user.last_sign_in_at).count
@active_conferences = Conference.get_active_conferences_for_dashboard # pending or the last two
@deactive_conferences = Conference.
get_conferences_without_active_for_dashboard(@active_conferences) # conferences without active
@conferences = @active_conferences + @deactive_conferences
@recent_users = User.limit(5).order(created_at: :desc)
@recent_events = Event.limit(5).order(created_at: :desc)
@recent_registrations = Registration.limit(5).order(created_at: :desc)
@top_submitter = Conference.get_top_submitter
@submissions = {}
@cfp_weeks = [0]
@registrations = {}
@registration_weeks = [0]
@conferences.each do |c|
# Event submissions over time chart
@submissions[c.short_title] = c.get_submissions_per_week
@cfp_weeks.push(@submissions[c.short_title].length)
# Conference registrations over time chart
@registrations[c.short_title] = c.get_registrations_per_week
@registration_weeks.push(@registrations[c.short_title].length)
end end
@cfp_weeks = @cfp_weeks.max def create
@submissions = normalize_array_length(@submissions, @cfp_weeks) @conference = Conference.new(params[:conference])
@cfp_weeks = @cfp_weeks > 0 ? (1..@cfp_weeks).to_a : 1
@registration_weeks = @registration_weeks.max if @conference.valid?
@registrations = normalize_array_length(@registrations, @registration_weeks) @conference.save
@registration_weeks = @registration_weeks > 0 ? (1..@registration_weeks).to_a : 1 # user that creates the conference becomes organizer of that conference
current_user.add_role :organizer, @conference
@event_distribution = Conference.event_distribution redirect_to(admin_conference_path(id: @conference.short_title),
@user_distribution = Conference.user_distribution notice: 'Conference was successfully created.')
end else
render action: 'new'
def new
@conference = Conference.new
end
def create
@conference = Conference.new(params[:conference])
if @conference.valid?
@conference.save
redirect_to(admin_conference_path(id: @conference.short_title),
notice: 'Conference was successfully created.')
else
render action: 'new'
end
end
def update
@conference = Conference.find_by(short_title: params[:id])
short_title = @conference.short_title
@conference.assign_attributes(params[:conference])
if @conference.start_date_changed? || @conference.end_date_changed?
if @conference.email_settings.send_on_updated_conference_dates &&
!@conference.email_settings.updated_conference_dates_subject.blank? &&
@conference.email_settings.updated_conference_dates_template
Mailbot.conference_date_update_mail(@conference).deliver
end end
end end
if @conference.registration_start_date_changed? || @conference.registration_end_date_changed? def update
if @conference.email_settings.send_on_updated_conference_registration_dates && short_title = @conference.short_title
!@conference.email_settings.updated_conference_registration_dates_subject.blank? && @conference.assign_attributes(params[:conference])
@conference.email_settings.updated_conference_registration_dates_template if @conference.start_date_changed? || @conference.end_date_changed?
Mailbot.conference_registration_date_update_mail(@conference).deliver if @conference.email_settings.send_on_updated_conference_dates &&
!@conference.email_settings.updated_conference_dates_subject.blank? &&
@conference.email_settings.updated_conference_dates_template
Mailbot.conference_date_update_mail(@conference).deliver
end
end
if @conference.registration_start_date_changed? || @conference.registration_end_date_changed?
if @conference.email_settings.send_on_updated_conference_registration_dates &&
!@conference.email_settings.updated_conference_registration_dates_subject.blank? &&
@conference.email_settings.updated_conference_registration_dates_template
Mailbot.conference_registration_date_update_mail(@conference).deliver
end
if @conference.update_attributes(params[:conference])
redirect_to(edit_admin_conference_path(id: @conference.short_title),
notice: 'Conference was successfully updated.')
else
redirect_to(edit_admin_conference_path(id: short_title),
alert: 'Updating conference failed. ' \
"#{@conference.errors.full_messages.join('. ')}.")
end
end end
end end
if @conference.update_attributes(params[:conference]) def show
redirect_to(edit_admin_conference_path(id: @conference.short_title), @conference = Conference.find_by(short_title: params[:id])
notice: 'Conference was successfully updated.')
else
redirect_to(edit_admin_conference_path(id: short_title),
alert: 'Updating conference failed. ' \
"#{@conference.errors.full_messages.join('. ')}.")
end
end
def show # Overview and since last login information
@conference = Conference.find_by(short_title: params[:id]) @total_reg = @conference.registrations.count
@new_reg = @conference.registrations.where('created_at > ?', current_user.last_sign_in_at).count
# Overview and since last login information @total_submissions = @conference.events.count
@total_reg = @conference.registrations.count @new_submissions = @conference.events.
@new_reg = @conference.registrations.where('created_at > ?', current_user.last_sign_in_at).count where('created_at > ?', current_user.last_sign_in_at).count
@total_submissions = @conference.events.count @program_length = @conference.current_program_hours
@new_submissions = @conference.events. @new_program_length = @conference.new_program_hours(current_user.last_sign_in_at)
where('created_at > ?', current_user.last_sign_in_at).count
@program_length = @conference.current_program_hours # Step by step list
@new_program_length = @conference.new_program_hours(current_user.last_sign_in_at) @conference_progress = @conference.get_status
# Step by step list # Line charts
@conference_progress = @conference.get_status @registrations = { @conference.short_title => @conference.get_registrations_per_week }
@registration_weeks = [0]
@registration_weeks.push(@registrations[@conference.short_title].length)
# Line charts @registration_weeks = @registration_weeks.max
@registrations = { @conference.short_title => @conference.get_registrations_per_week } @registrations = normalize_array_length(@registrations, @registration_weeks)
@registration_weeks = [0] @registration_weeks = @registration_weeks > 0 ? (1..@registration_weeks).to_a : 1
@registration_weeks.push(@registrations[@conference.short_title].length)
@registration_weeks = @registration_weeks.max @submissions = Conference.get_event_state_line_colors
@registrations = normalize_array_length(@registrations, @registration_weeks)
@registration_weeks = @registration_weeks > 0 ? (1..@registration_weeks).to_a : 1
@submissions = Conference.get_event_state_line_colors
@submissions_data = {} @submissions_data = {}
@submissions_data = @conference.get_submissions_data @submissions_data = @conference.get_submissions_data
@ -137,43 +140,44 @@ class Admin::ConferenceController < ApplicationController
@submissions_data = @submissions_data.except('Weeks') @submissions_data = @submissions_data.except('Weeks')
end end
# Doughnut charts # Doughnut charts
@event_type_distribution = @conference.event_type_distribution @event_type_distribution = @conference.event_type_distribution
@event_type_distribution_confirmed = @conference.event_type_distribution(:confirmed) @event_type_distribution_confirmed = @conference.event_type_distribution(:confirmed)
@difficulty_levels_distribution = @conference.difficulty_levels_distribution @difficulty_levels_distribution = @conference.difficulty_levels_distribution
@difficulty_levels_distribution_confirmed = @conference. @difficulty_levels_distribution_confirmed = @conference.
difficulty_levels_distribution(:confirmed) difficulty_levels_distribution(:confirmed)
@tracks_distribution = @conference.tracks_distribution @tracks_distribution = @conference.tracks_distribution
@tracks_distribution_confirmed = @conference.tracks_distribution(:confirmed) @tracks_distribution_confirmed = @conference.tracks_distribution(:confirmed)
# Recent actions information # Recent actions information
@recent_events = @conference.events.limit(5).order(created_at: :desc) @recent_events = @conference.events.limit(5).order(created_at: :desc)
@recent_registrations = @conference.registrations.limit(5).order(created_at: :desc) @recent_registrations = @conference.registrations.limit(5).order(created_at: :desc)
@top_submitter = @conference.get_top_submitter @top_submitter = @conference.get_top_submitter
# get targets # get targets
@registration_targets = @conference.get_targets(Target.units[:registrations]) @registration_targets = @conference.get_targets(Target.units[:registrations])
@submission_targets = @conference.get_targets(Target.units[:submissions]) @submission_targets = @conference.get_targets(Target.units[:submissions])
@program_minutes_targets = @conference.get_targets(Target.units[:program_minutes]) @program_minutes_targets = @conference.get_targets(Target.units[:program_minutes])
# get campaigns # get campaigns
@campaigns = @conference.get_campaigns @campaigns = @conference.get_campaigns
respond_to do |format| respond_to do |format|
format.html format.html
format.json { render json: @conference.to_json } format.json { render json: @conference.to_json }
end
end end
end
def edit def edit
@conferences = Conference.all @conferences = Conference.all
@conference = Conference.find_by(short_title: params[:id]) @conference = Conference.find_by(short_title: params[:id])
respond_to do |format| respond_to do |format|
format.html format.html
format.json { render json: @conference.to_json } format.json { render json: @conference.to_json }
end
end end
end end
end end

25
app/controllers/admin/dietchoices_controller.rb
View file

@ -1,16 +1,19 @@
class Admin::DietchoicesController < ApplicationController module Admin
before_filter :verify_organizer class DietchoicesController < ApplicationController
load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource :dietary_choice, through: :conference
def show def show
render :diets_list render :diets_list
end end
def update def update
begin begin
@conference.update_attributes!(params[:conference]) @conference.update_attributes!(params[:conference])
redirect_to(admin_conference_dietary_list_path(conference_id: @conference.short_title), notice: 'Dietary choices were successfully updated.') redirect_to(admin_conference_dietary_list_path(conference_id: @conference.short_title), notice: 'Dietary choices were successfully updated.')
rescue => e rescue => e
redirect_to(admin_conference_dietary_list_path(conference_id: @conference.short_title), alert: "Dietary choices update failed: #{e.message}") redirect_to(admin_conference_dietary_list_path(conference_id: @conference.short_title), alert: "Dietary choices update failed: #{e.message}")
end
end end
end end
end end

43
app/controllers/admin/difficulty_levels_controller.rb
View file

@ -1,29 +1,32 @@
class Admin::DifficultyLevelsController < ApplicationController module Admin
before_filter :verify_organizer class DifficultyLevelsController < ApplicationController
load_and_authorize_resource :conference, find_by: :short_title
def index authorize_resource :difficulty_level, through: :conference
@conference = Conference.find_by(short_title: params[:conference_id])
end
def update def index
if @conference.update_attributes(params[:conference]) @conference = Conference.find_by(short_title: params[:conference_id])
if !(@conference.difficulty_levels.count > 0) && @conference.use_difficulty_levels == true end
begin
@conference.use_difficulty_levels = false def update
@conference.save! if @conference.update_attributes(params[:conference])
flash[:error] = "You cannot enable the usage of difficulty levels without having set any levels." if !(@conference.difficulty_levels.count > 0) && @conference.use_difficulty_levels == true
begin
@conference.use_difficulty_levels = false
@conference.save!
flash[:error] = "You cannot enable the usage of difficulty levels without having set any levels."
redirect_to(admin_conference_difficulty_levels_path(conference_id: @conference.short_title))
rescue ActiveRecord::RecordInvalid
flash[:error] = "Something went wrong. Difficulty Levels update failed."
redirect_to(admin_conference_difficulty_levels_path(conference_id: @conference.short_title))
end
else
flash[:notice] = "Difficulty Levels were successfully updated."
redirect_to(admin_conference_difficulty_levels_path(conference_id: @conference.short_title)) redirect_to(admin_conference_difficulty_levels_path(conference_id: @conference.short_title))
rescue ActiveRecord::RecordInvalid
flash[:error] = "Something went wrong. Difficulty Levels update failed."
redirect_to(admin_conference_difficulty_levels_path(conference_id: @conference.short_title))
end end
else else
flash[:notice] = "Difficulty Levels were successfully updated." flash[:error] = "Difficulty Levels update failed."
redirect_to(admin_conference_difficulty_levels_path(conference_id: @conference.short_title)) redirect_to(admin_conference_difficulty_levels_path(conference_id: @conference.short_title))
end end
else
flash[:error] = "Difficulty Levels update failed."
redirect_to(admin_conference_difficulty_levels_path(conference_id: @conference.short_title))
end end
end end
end end

23
app/controllers/admin/emails_controller.rb
View file

@ -1,14 +1,17 @@
class Admin::EmailsController < ApplicationController module Admin
before_filter :verify_organizer class EmailsController < ApplicationController
load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource :emails, class: EmailSettings
def update def update
@conference.email_settings.update_attributes(params[:email_settings]) @conference.email_settings.update_attributes(params[:email_settings])
redirect_to(admin_conference_emails_path( redirect_to(admin_conference_emails_path(
@conference.short_title), @conference.short_title),
notice: 'Settings have been successfully updated.') notice: 'Settings have been successfully updated.')
end end
def index def index
@settings = @conference.email_settings @settings = @conference.email_settings
end
end end
end end

4
app/controllers/admin/event_types_controller.rb
View file

@ -1,7 +1,7 @@
module Admin module Admin
class EventTypesController < Admin::BaseController class EventTypesController < ApplicationController
authorize_resource
load_and_authorize_resource :conference, find_by: :short_title load_and_authorize_resource :conference, find_by: :short_title
authorize_resource :event_type, through: :conference
def show def show
render :eventtypes render :eventtypes

4
app/controllers/admin/events_controller.rb
View file

@ -1,6 +1,7 @@
module Admin module Admin
class EventsController < ApplicationController class EventsController < ApplicationController
before_filter :verify_organizer load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource :event, through: :conference
before_action :get_event, except: [:index, :create] before_action :get_event, except: [:index, :create]
@ -13,6 +14,7 @@ module Admin
end end
def index def index
@conference = Conference.find_by(short_title: params[:conference_id])
@events = @conference.events @events = @conference.events
@tracks = @conference.tracks @tracks = @conference.tracks
@machine_states = @events.state_machine.states.map @machine_states = @events.state_machine.states.map

3
app/controllers/admin/lodgings_controller.rb
View file

@ -1,6 +1,7 @@
module Admin module Admin
class LodgingsController < ApplicationController class LodgingsController < ApplicationController
before_filter :verify_organizer load_and_authorize_resource :conference, find_by: :short_title
authorize_resource :lodging, through: :conference
def index def index
@venue = @conference.venue @venue = @conference.venue

144
app/controllers/admin/questions_controller.rb
View file

@ -1,94 +1,88 @@
class Admin::QuestionsController < ApplicationController module Admin
before_filter :verify_organizer class QuestionsController < ApplicationController
load_and_authorize_resource :conference, find_by: :short_title
authorize_resource :question, through: :conference
def index def index
@conference = Conference.find_by(short_title: params[:conference_id]) @questions = Question.where(global: true).all | Question.where(conference_id: @conference.id)
@questions = Question.where(global: true).all | Question.where(conference_id: @conference.id) @questions_conference = @conference.questions
@questions_conference = @conference.questions @new_question = @conference.questions.new
@new_question = @conference.questions.new end
end
def new def new
@conference = Conference.find_by(short_title: params[:conference_id]) @new_question = @conference.questions.new
@new_question = @conference.questions.new end
end
def create def create
@conference = Conference.find_by(short_title: params[:conference_id]) @question = @conference.questions.new(params[:question])
@question = @conference.questions.new(params[:question]) @question.conference_id = @conference.id
@question.conference_id = @conference.id
respond_to do |format| respond_to do |format|
if @conference.save if @conference.save
format.html { redirect_to admin_conference_questions_path, notice: 'Question was successfully created.' } format.html { redirect_to admin_conference_questions_path, notice: 'Question was successfully created.' }
else else
flash[:error] = "Oops, couldn't save. Question and answer(s) have titles?" flash[:error] = "Oops, couldn't save. Question and answer(s) have titles?"
format.html { redirect_to admin_conference_questions_path } format.html { redirect_to admin_conference_questions_path }
end
end end
end
end
# GET questions/1/edit
def edit
@conference = Conference.find_by(short_title: params[:conference_id])
@question = Question.find(params[:id])
if @question.global == true && !has_role?(current_user, "Admin")
redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), alert: "Sorry, you cannot edit global questions. Create a new one.")
end end
end
# PUT questions/1 # GET questions/1/edit
def update def edit
@conference = Conference.find_by(short_title: params[:conference_id])
@question = Question.find(params[:id])
if @question.update_attributes(params[:question])
redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Question '#{@question.title}' for #{@conference.short_title} successfully updated.")
else
redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Update of questions for #{@conference.short_title} failed.")
end
end
# Update questions used for the conference
def update_conference
@conference = Conference.find_by(short_title: params[:conference_id])
if @conference.update_attributes(params[:conference])
redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Questions for #{@conference.short_title} successfully updated.")
else
redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Update of questions for #{@conference.short_title} failed.")
end
end
# DELETE questions/1
def destroy
if has_role?(current_user, "Admin")
@question = Question.find(params[:id]) @question = Question.find(params[:id])
# Do not delete global questions if @question.global == true && !(current_user.has_role? :organizer, @conference)
if @question.global == false redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), alert: "Sorry, you cannot edit global questions. Create a new one.")
end
end
# Delete question and its answers # PUT questions/1
begin def update
Question.transaction do @question = Question.find(params[:id])
@question.delete if @conference.update_attributes(params[:conference])
@question.answers.each do |a| redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Questions for #{@conference.short_title} successfully updated.")
a.delete else
end redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Update of questions for #{@conference.short_title} failed.")
flash[:notice] = "Deleted question: #{@question.title} and its answers: #{@question.answers.map {|a| a.title}.join ','}" end
end
# Update questions used for the conference
def update_conference
if @conference.update_attributes(params[:conference])
redirect_to(admin_conference_questions_path(:conference_id => @conference.short_title), :notice => "Questions for #{@conference.short_title} successfully updated.")
else
redirect_to(admin_conference_questions_path(:conference_id => @conference.short_title), :notice => "Update of questions for #{@conference.short_title} failed.")
end
end
# DELETE questions/1
def destroy
if can? :destroy, @question
# Do not delete global questions
if @question.global == false
# Delete question and its answers
begin
Question.transaction do
@question.delete
@question.answers.each do |a|
a.delete
end
flash[:notice] = "Deleted question: #{@question.title} and its answers: #{@question.answers.map {|a| a.title}.join ','}"
end end
rescue ActiveRecord::RecordInvalid rescue ActiveRecord::RecordInvalid
flash[:error] = "Could not delete question." flash[:error] = "Could not delete question."
end
else
flash[:error] = "You cannot delete global questions."
end end
else else
flash[:error] = "You cannot delete global questions." flash[:error] = "You must be an admin to delete a question."
end end
else
flash[:error] = "You must be an admin to delete a question."
end
@questions = Question.where(global: true).all | Question.where(conference_id: @conference.id) @questions = Question.where(global: true).all | Question.where(conference_id: @conference.id)
@questions_conference = @conference.questions @questions_conference = @conference.questions

9
app/controllers/admin/registrations_controller.rb
View file

@ -1,6 +1,7 @@
module Admin module Admin
class RegistrationsController < ApplicationController class RegistrationsController < ApplicationController
before_filter :verify_organizer load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource through: :conference
def index def index
session[:return_to] ||= request.referer session[:return_to] ||= request.referer
@ -12,7 +13,6 @@ module Admin
end end
def change_field def change_field
@registration = Registration.find(params[:id])
field = params[:view_field] field = params[:view_field]
if @registration.send(field.to_sym) if @registration.send(field.to_sym)
@registration.update_attribute(:"#{field}", 0) @registration.update_attribute(:"#{field}", 0)
@ -26,12 +26,10 @@ module Admin
end end
def edit def edit
@registration = @conference.registrations.where('id = ?', params[:id]).first
@user = User.where('id = ?', @registration.user_id).first @user = User.where('id = ?', @registration.user_id).first
end end
def update def update
@registration = @conference.registrations.where('id = ?', params[:id]).first
@user = User.where('id = ?', @registration.user_id).first @user = User.where('id = ?', @registration.user_id).first
begin begin
@user.update_attributes!(params[:registration][:user_attributes]) @user.update_attributes!(params[:registration][:user_attributes])
@ -55,6 +53,7 @@ module Admin
def new def new
@user = User.new @user = User.new
@registration = @user.registrations.new @registration = @user.registrations.new
@registration.conference_id = @conference.id
@supporter_registration = @conference.supporter_registrations.new @supporter_registration = @conference.supporter_registrations.new
end end
@ -97,7 +96,7 @@ module Admin
end end
def destroy def destroy
if has_role?(current_user, 'Admin') if can? :destroy, @registration
registration = @conference.registrations.where(id: params[:id]).first registration = @conference.registrations.where(id: params[:id]).first
user = User.where('id = ?', registration.user_id).first user = User.where('id = ?', registration.user_id).first

31
app/controllers/admin/rooms_controller.rb
View file

@ -1,19 +1,22 @@
class Admin::RoomsController < ApplicationController module Admin
before_filter :verify_organizer class RoomsController < ApplicationController
load_and_authorize_resource :conference, find_by: :short_title
authorize_resource :room, through: :conference
def show def show
render :rooms_list render :rooms_list
end end
def update def update
if @conference.update_attributes(params[:conference]) if @conference.update_attributes(params[:conference])
redirect_to(admin_conference_rooms_path( redirect_to(admin_conference_rooms_path(
conference_id: @conference.short_title), conference_id: @conference.short_title),
notice: 'Rooms were successfully updated.') notice: 'Rooms were successfully updated.')
else else
redirect_to(admin_conference_rooms_path( redirect_to(admin_conference_rooms_path(
conference_id: @conference.short_title), conference_id: @conference.short_title),
notice: 'Room update failed.') notice: 'Room update failed.')
end
end end
end end
end end

6
app/controllers/admin/schedules_controller.rb
View file

@ -1,6 +1,10 @@
module Admin module Admin
class SchedulesController < ApplicationController class SchedulesController < ApplicationController
before_filter :verify_organizer # By authorizing 'conference' resource, we can ensure there will be no unauthorized access to
# the schedule of a conference, which should not be accessed in the first place
load_and_authorize_resource :conference, find_by: :short_title
authorize_resource class: false
skip_before_filter :verify_authenticity_token, only: [:update] skip_before_filter :verify_authenticity_token, only: [:update]
layout 'schedule' layout 'schedule'

23
app/controllers/admin/social_events_controller.rb
View file

@ -1,15 +1,18 @@
class Admin::SocialEventsController < ApplicationController module Admin
before_filter :verify_organizer class SocialEventsController < ApplicationController
load_and_authorize_resource :conference, find_by: :short_title
authorize_resource :social_event, through: :conference
def show def show
render :social_events_list render :social_events_list
end end
def update def update
if @conference.update_attributes(params[:conference]) if @conference.update_attributes(params[:conference])
redirect_to(admin_conference_social_events_path(conference_id: @conference.short_title), notice: 'Social events were successfully updated.') redirect_to(admin_conference_social_events_path(conference_id: @conference.short_title), notice: 'Social events were successfully updated.')
else else
redirect_to(admin_conference_social_events_path(conference_id: @conference.short_title), notice: 'Social events update failed.') redirect_to(admin_conference_social_events_path(conference_id: @conference.short_title), notice: 'Social events update failed.')
end
end end
end end
end end

4
app/controllers/admin/speakers_controller.rb
View file

@ -1,6 +1,8 @@
module Admin module Admin
class SpeakersController < ApplicationController class SpeakersController < ApplicationController
before_filter :verify_organizer load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource :speaker, through: :conference
respond_to :js, :html respond_to :js, :html
def edit def edit

3
app/controllers/admin/sponsors_controller.rb
View file

@ -1,6 +1,7 @@
module Admin module Admin
class SponsorsController < ApplicationController class SponsorsController < ApplicationController
before_filter :verify_organizer load_and_authorize_resource :conference, find_by: :short_title
authorize_resource :sponsor, through: :conference
def update def update
if @conference.update_attributes(params[:conference]) if @conference.update_attributes(params[:conference])

3
app/controllers/admin/sponsorship_levels_controller.rb
View file

@ -1,6 +1,7 @@
module Admin module Admin
class SponsorshipLevelsController < ApplicationController class SponsorshipLevelsController < ApplicationController
before_filter :verify_organizer load_and_authorize_resource :conference, find_by: :short_title
authorize_resource :sponsorship_level, through: :conference
def update def update
if @conference.update_attributes(params[:conference]) if @conference.update_attributes(params[:conference])

3
app/controllers/admin/stats_controller.rb
View file

@ -1,6 +1,7 @@
module Admin module Admin
class StatsController < ApplicationController class StatsController < ApplicationController
before_filter :verify_organizer load_and_authorize_resource
load_and_authorize_resource :conference, find_by: :short_title
def index def index
@registrations = @conference.registrations.includes(:user) @registrations = @conference.registrations.includes(:user)

15
app/controllers/admin/supporter_levels_controller.rb
View file

@ -1,12 +1,13 @@
class Admin::SupporterLevelsController < ApplicationController module Admin
before_filter :verify_organizer class Admin::SupporterLevelsController < ApplicationController
load_and_authorize_resource :conference, find_by: :short_title
authorize_resource :supporter_level, through: :conference
def show def show
render :supporter_levels render :supporter_levels
end end
def update def update
begin
@conference.update_attributes!(params[:conference]) @conference.update_attributes!(params[:conference])
redirect_to(admin_conference_supporter_levels_path(conference_id: @conference.short_title), notice: 'Supporter levels were successfully updated.') redirect_to(admin_conference_supporter_levels_path(conference_id: @conference.short_title), notice: 'Supporter levels were successfully updated.')
rescue => e rescue => e

29
app/controllers/admin/supporters_controller.rb
View file

@ -1,16 +1,21 @@
class Admin::SupportersController < ApplicationController module Admin
before_filter :verify_organizer class Admin::SupportersController < ApplicationController
load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource :supporter, through: :conference
def index def index
respond_to do |format| respond_to do |format|
format.html format.html
format.json { render json: DatatableSupporters.new(@conference.supporter_registrations, view_context) } format.json { render json: DatatableSupporters.
new(@conference.supporter_registrations, view_context) }
end
end
def create
params[:supporter_registration][:conference_id] = @conference.id
supporter = SupporterRegistration.create!(params[:supporter_registration])
redirect_to(admin_conference_supporters_path(conference_id: @conference.short_title),
notice: 'Supporter added')
end end
end end
def create
params[:supporter_registration][:conference_id] = @conference.id
SupporterRegistration.create!(params[:supporter_registration])
redirect_to(admin_conference_supporters_path(conference_id: @conference.short_title), notice: "Supporter added")
end
end end

3
app/controllers/admin/targets_controller.rb
View file

@ -1,6 +1,7 @@
module Admin module Admin
class TargetsController < ApplicationController class TargetsController < ApplicationController
before_filter :verify_organizer load_and_authorize_resource :conference, find_by: :short_title
authorize_resource :target, through: :conference
def index def index
end end

35
app/controllers/admin/tracks_controller.rb
View file

@ -1,22 +1,25 @@
class Admin::TracksController < ApplicationController module Admin
before_filter :verify_organizer class TracksController < ApplicationController
load_and_authorize_resource :conference, find_by: :short_title
authorize_resource through: :conference
def show def show
respond_to do |format| respond_to do |format|
format.html { render :tracks_list } format.html { render :tracks_list }
format.json { render json: @conference.tracks.to_json } format.json { render json: @conference.tracks.to_json }
end
end end
end
def update def update
if @conference.update_attributes(params[:conference]) if @conference.update_attributes(params[:conference])
redirect_to(admin_conference_tracks_path( redirect_to(admin_conference_tracks_path(
conference_id: @conference.short_title), conference_id: @conference.short_title),
notice: 'Tracks were successfully updated.') notice: 'Tracks were successfully updated.')
else else
redirect_to(admin_conference_tracks_path( redirect_to(admin_conference_tracks_path(
conference_id: @conference.short_title), conference_id: @conference.short_title),
notice: 'Tracks update failed.') notice: 'Tracks update failed.')
end
end end
end end
end end

17
app/controllers/admin/users_controller.rb
View file

@ -1,14 +1,12 @@
module Admin module Admin
class UsersController < ApplicationController class UsersController < ApplicationController
before_filter :verify_admin load_and_authorize_resource :user
def index def index
@users = User.all @users = User.all
end end
def show def show
@user = User.find(params[:id])
# Variable @show_attributes holds the attributes that are visible for the 'show' action # Variable @show_attributes holds the attributes that are visible for the 'show' action
# If you want to change the attributes that are shown in the 'show' action of users # If you want to change the attributes that are shown in the 'show' action of users
# add/remove the attributes in the following string array # add/remove the attributes in the following string array
@ -18,23 +16,16 @@ module Admin
end end
def update def update
user = User.find(params[:id]) @user.update_attributes!(params[:user])
user.update_attributes!(params[:user]) redirect_to admin_users_path, notice: "Updated #{@user.email}"
redirect_to admin_users_path, notice: "Updated #{user.email}"
end end
def edit def edit
@user = User.find(params[:id])
end
def delete
@user = User.find(params[:id])
end end
def destroy def destroy
@user = User.find(params[:id])
@user.destroy @user.destroy
redirect_to admin_users_path, notice: 'User got deleted' redirect_to admin_users_path, notice: "User #{@user.name} (#{@user.email})got deleted"
end end
end end
end end

55
app/controllers/admin/venue_controller.rb
View file

@ -1,34 +1,37 @@
class Admin::VenueController < ApplicationController module Admin
before_filter :verify_organizer class VenueController < ApplicationController
load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource :venue, through: :conference, singleton: true
def index def index
end end
def update def update
@venue = @conference.venue @venue = @conference.venue
@venue.assign_attributes(params[:venue]) @venue.assign_attributes(params[:venue])
unless @venue.name.blank? || @venue.address.blank? || @conference.registrations.blank? unless @venue.name.blank? || @venue.address.blank? || @conference.registrations.blank?
if (@venue.name_changed? || if (@venue.name_changed? ||
@venue.address_changed?) && @venue.address_changed?) &&
(@conference.email_settings.send_on_venue_update && (@conference.email_settings.send_on_venue_update &&
!@conference.email_settings.venue_update_subject.blank? && !@conference.email_settings.venue_update_subject.blank? &&
@conference.email_settings.venue_update_template) @conference.email_settings.venue_update_template)
venue_notify = Mailbot.send_email_on_venue_update(@conference) venue_notify = Mailbot.send_email_on_venue_update(@conference)
end
end
if @venue.update_attributes(params[:venue])
venue_notify.deliver unless venue_notify.blank?
redirect_to(admin_conference_venue_info_path(conference_id: @conference.short_title),
notice: 'Venue was successfully updated.')
else
redirect_to(admin_conference_venue_info_path(conference_id: @conference.short_title),
notice: 'Venue Updation Failed!')
end end
end end
if @venue.update_attributes(params[:venue]) def show
venue_notify.deliver unless venue_notify.blank? @venue = @conference.venue
redirect_to(admin_conference_venue_info_path(conference_id: @conference.short_title), render :venue_info
notice: 'Venue was successfully updated.')
else
redirect_to(admin_conference_venue_info_path(conference_id: @conference.short_title),
notice: 'Venue Updation Failed!')
end end
end end
def show
@venue = @conference.venue
render :venue_info
end
end end

45
app/controllers/admin/volunteers_controller.rb
View file

@ -1,25 +1,28 @@
class Admin::VolunteersController < ApplicationController module Admin
def index class VolunteersController < ApplicationController
@conference = Conference.find_by(short_title: params[:conference_id]) load_and_authorize_resource :conference, find_by: :short_title
render :index authorize_resource class: false, through: :conference
end
def show
@conference = Conference.find_by(short_title: params[:conference_id])
if @conference.use_vpositions
@volunteers = @conference.registrations.joins(:vchoices).uniq
else
@volunteers = @conference.registrations.where(volunteer: true)
end
end
def update def index
@conference = Conference.find_by(short_title: params[:conference_id]) render :index
begin end
@conference.update_attributes!(params[:conference])
redirect_to(admin_conference_volunteers_info_path(conference_id: params[:conference_id]), notice: "Volunteering options were successfully updated.") def show
rescue => e if @conference.use_vpositions
redirect_to(admin_conference_volunteers_info_path(conference_id: params[:conference_id]), alert: "Volunteering options update failed: #{e.message}") @volunteers = @conference.registrations.joins(:vchoices).uniq
else
@volunteers = @conference.registrations.where(volunteer: true)
end
end
def update
@conference = Conference.find_by(short_title: params[:conference_id])
begin
@conference.update_attributes!(params[:conference])
redirect_to(admin_conference_volunteers_info_path(conference_id: params[:conference_id]), notice: "Volunteering options were successfully updated.")
rescue => e
redirect_to(admin_conference_volunteers_info_path(conference_id: params[:conference_id]), alert: "Volunteering options update failed: #{e.message}")
end
end end
end end
end end

29
app/controllers/application_controller.rb
View file

@ -4,13 +4,15 @@ class ApplicationController < ActionController::Base
before_filter :get_conferences before_filter :get_conferences
before_filter :store_location before_filter :store_location
helper_method :date_string helper_method :date_string
# Ensure every controller authorizes resource or skips authorization (skip_authorization_check)
check_authorization unless: :devise_controller?
def store_location def store_location
session[:return_to] = request.fullpath if request.get? and controller_name != "user_sessions" and controller_name != "sessions" session[:return_to] = request.fullpath if request.get? and controller_name != "user_sessions" and controller_name != "sessions"
end end
def after_sign_in_path_for(resource) def after_sign_in_path_for(resource)
if organizer_or_admin? && if can? :view, Conference &&
(!session[:return_to] || (!session[:return_to] ||
session[:return_to] && session[:return_to] &&
session[:return_to] == root_path) session[:return_to] == root_path)
@ -39,36 +41,21 @@ class ApplicationController < ActionController::Base
return false return false
end end
@conference = Conference.find_by(short_title: params[:conference_id])
true true
end end
def organizer_or_admin? def current_ability
has_role?(current_user, 'admin') || has_role?(current_user, 'organizer') if self.class.to_s.split('::').first == 'Admin'
end @current_ability ||= AdminAbility.new(current_user)
else
def verify_organizer @current_ability ||= Ability.new(current_user)
if !verify_user
return
end end
## Todo simplify this
redirect_to root_path unless has_role?(current_user, 'admin') || has_role?(current_user, 'organizer')
end
def verify_admin
if !verify_user
return
end
redirect_to root_path unless has_role?(current_user, 'admin')
end end
rescue_from CanCan::AccessDenied do |exception| rescue_from CanCan::AccessDenied do |exception|
Rails.logger.debug("Access denied!") Rails.logger.debug("Access denied!")
redirect_to root_path, alert: exception.message redirect_to root_path, alert: exception.message
end end
helper_method :organizer_or_admin?
def not_found def not_found
raise ActionController::RoutingError.new('Not Found') raise ActionController::RoutingError.new('Not Found')

5
app/controllers/conference_controller.rb
View file

@ -1,11 +1,12 @@
class ConferenceController < ApplicationController class ConferenceController < ApplicationController
load_and_authorize_resource find_by: :short_title
def show def show
@conference = Conference.find_by_short_title(params[:id])
not_found unless @conference.make_conference_public? not_found unless @conference.make_conference_public?
end end
def gallery_photos def gallery_photos
@photos = Conference.find_by_short_title(params[:id]).photos @photos = @conference.photos
render "photos", formats: [:js] render "photos", formats: [:js]
end end
end end

26
app/controllers/event_attachments_controller.rb
View file

@ -1,9 +1,11 @@
class EventAttachmentsController < ApplicationController class EventAttachmentsController < ApplicationController
load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource :proposal, class: Event
load_and_authorize_resource :upload, class: EventAttachment, through: :proposal
before_filter :verify_user before_filter :verify_user
skip_before_filter :verify_user, only: [:show] skip_before_filter :verify_user, only: [:show]
def index def index
@proposal = Event.find(params[:proposal_id])
@uploads = @proposal.event_attachments @uploads = @proposal.event_attachments
@uploads = @uploads.map{|upload| upload.to_jq_upload } @uploads = @uploads.map{|upload| upload.to_jq_upload }
@ -14,9 +16,9 @@ class EventAttachmentsController < ApplicationController
end end
def show def show
upload = EventAttachment.find(params[:id])
if upload.public? if @upload.public?
send_file upload.attachment.path send_file @upload.attachment.path
return return
end end
@ -26,7 +28,7 @@ class EventAttachmentsController < ApplicationController
end end
if organizer_or_admin? || current_user == upload.event.submitter if organizer_or_admin? || current_user == upload.event.submitter
send_file upload.attachment.path send_file @upload.attachment.path
else else
raise ActionController::RoutingError.new('Not Found') raise ActionController::RoutingError.new('Not Found')
end end
@ -42,7 +44,6 @@ class EventAttachmentsController < ApplicationController
end end
def edit def edit
@upload = EventAttachment.find(params[:id])
end end
def create def create
@ -50,7 +51,7 @@ class EventAttachmentsController < ApplicationController
params[:event_attachment][:public] = false params[:event_attachment][:public] = false
params[:event_attachment][:event_id] = params[:proposal_id] params[:event_attachment][:event_id] = params[:proposal_id]
if !organizer_or_admin? if cannot? :create, EventAttachment
begin begin
current_user.events.find(params[:proposal_id]) current_user.events.find(params[:proposal_id])
rescue rescue
@ -83,8 +84,6 @@ class EventAttachmentsController < ApplicationController
end end
def update def update
@proposal = current_user.events.find(params[:proposal_id])
@upload = @proposal.event_attachments.find(params[:proposal_id])
respond_to do |format| respond_to do |format|
if @upload.update_attributes(params[:upload]) if @upload.update_attributes(params[:upload])
@ -98,14 +97,13 @@ class EventAttachmentsController < ApplicationController
end end
def destroy def destroy
@proposal = Event.find(params[:proposal_id])
if can? :destroy, @proposal
if organizer_or_admin? || current_user == @proposal.submitter
@upload = @proposal.event_attachments.find(params[:id]) @upload = @proposal.event_attachments.find(params[:id])
end end
@upload.destroy if !@upload.nil? @upload.destroy if !@upload.nil?
respond_to do |format| respond_to do |format|
format.html { redirect_back_or_to conference_proposal_index_path(@conference.short_title), notice: "Deleted successfully attachment '#{@upload.title}' for proposal '#{@proposal.title}'" } format.html { redirect_back_or_to conference_proposal_index_path(@conference.short_title), notice: "Deleted successfully attachment '#{@upload.title}' for proposal '#{@proposal.title}'" }

1
app/controllers/home_controller.rb
View file

@ -1,5 +1,6 @@
class HomeController < ApplicationController class HomeController < ApplicationController
before_filter :respond_to_options before_filter :respond_to_options
skip_authorization_check
def index def index
@today = Date.current @today = Date.current

30
app/controllers/proposal_controller.rb
View file

@ -1,32 +1,35 @@
class ProposalController < ApplicationController class ProposalController < ApplicationController
load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource :event, parent: false
before_filter :verify_user, except: [:show] before_filter :verify_user, except: [:show]
before_action :set_conference, only: [:show] before_filter :setup
before_action :set_event, only: [:show, :edit, :update, :destroy, :confirm, :restart]
def setup
@user = current_user if current_user
@url = conference_proposal_index_path(@conference.short_title)
@event_types = @conference.event_types
end
def index def index
@events = current_user.proposals(@conference) @events = current_user.proposals(@conference)
end end
def show def show
authorize! :show, @event
# FIXME: We should show more than the first speaker # FIXME: We should show more than the first speaker
@speaker = @event.speakers.first || @event.submitter @speaker = @event.speakers.first || @event.submitter
end end
def new def new
authorize! :new, Event
@url = conference_proposal_index_path(@conference.short_title) @url = conference_proposal_index_path(@conference.short_title)
@event = Event.new @event = Event.new
end end
def edit def edit
authorize! :edit, @event
@url = conference_proposal_path(@conference.short_title, params[:id]) @url = conference_proposal_path(@conference.short_title, params[:id])
@attachments = @event.event_attachments @attachments = @event.event_attachments
end end
def create def create
authorize! :create, Event
@url = conference_proposal_index_path(@conference.short_title) @url = conference_proposal_index_path(@conference.short_title)
params[:event].delete :user params[:event].delete :user
@ -63,7 +66,6 @@ class ProposalController < ApplicationController
end end
def update def update
authorize! :update, @event
@url = conference_proposal_path(@conference.short_title, params[:id]) @url = conference_proposal_path(@conference.short_title, params[:id])
# First, update the submitter's info, if they've changed anything # First, update the submitter's info, if they've changed anything
@ -129,12 +131,12 @@ class ProposalController < ApplicationController
end end
def restart def restart
authorize! :update, @event
@url = conference_proposal_path(@conference.short_title, params[:id]) @url = conference_proposal_path(@conference.short_title, params[:id])
begin begin
@event.restart @event.restart
rescue Transitions::InvalidTransition rescue Transitions::InvalidTransition
redirect_to(conference_proposal_index_path(conference_id: @conference.short_title), redirect_to(conference_proposal_index_path(conference_id: @conference.short_title),
error: "The proposal can't be re-submitted.") error: "The proposal can't be re-submitted.")
return return
@ -149,14 +151,4 @@ class ProposalController < ApplicationController
redirect_to(conference_proposal_index_path(conference_id: @conference.short_title), redirect_to(conference_proposal_index_path(conference_id: @conference.short_title),
notice: "The proposal was re-submitted. The #{@conference.short_title} organizers will review it again.") notice: "The proposal was re-submitted. The #{@conference.short_title} organizers will review it again.")
end end
private
def set_conference
@conference = Conference.find_by(short_title: params[:conference_id])
end
def set_event
@event = Event.find(params[:id])
end
end end

3
app/controllers/schedule_controller.rb
View file

@ -1,6 +1,7 @@
class ScheduleController < ApplicationController class ScheduleController < ApplicationController
authorize_resource class: false
layout "application" layout "application"
def index def index
@conference = Conference.includes(:rooms, {events: [:speakers, :track, :event_type]}).where("conferences.short_title" => params[:conference_id]).first @conference = Conference.includes(:rooms, {events: [:speakers, :track, :event_type]}).where("conferences.short_title" => params[:conference_id]).first
@rooms = @conference.rooms @rooms = @conference.rooms

1
app/controllers/users/omniauth_callbacks_controller.rb
View file

@ -1,6 +1,7 @@
module Users module Users
class OmniauthCallbacksController < Devise::OmniauthCallbacksController class OmniauthCallbacksController < Devise::OmniauthCallbacksController
skip_before_filter :verify_authenticity_token skip_before_filter :verify_authenticity_token
skip_authorization_check
User.omniauth_providers.each do |provider| User.omniauth_providers.each do |provider|
define_method(provider) { handle(provider) } define_method(provider) { handle(provider) }

33
app/models/ability.rb
View file

@ -2,16 +2,27 @@ class Ability
include CanCan::Ability include CanCan::Ability
def initialize(user) def initialize(user)
# guest user (not logged in) # Define abilities for the passed in user here. For example:
user ||= User.new #
if user.admin? || user.organizer? user ||= User.new # guest user (not logged in)
# An admin can manage everything # if user.admin?
can :manage, :all # can :manage, :all
else # else
can [:update, :destroy], Event do |event| # can :read, :all
event.users.include?(user) # end
end #
can [:create, :read], Event # The first argument to `can` is the action you are giving the user permission to do.
end # If you pass :manage it will apply to every action. Other common actions here are
# :read, :create, :update and :destroy.
#
# The second argument is the resource the user can perform the action on. If you pass
# :all it will apply to every resource. Otherwise pass a Ruby class of the resource.
#
# The third argument is an optional hash of conditions to further filter the objects.
# For example, here the user can only update published articles.
#
# can :update, Article, :published => true
#
# See the wiki for details: https://github.com/ryanb/cancan/wiki/Defining-Abilities
end end
end end

11
app/models/admin_ability.rb Normal file
View file

@ -0,0 +1,11 @@
class AdminAbility
include CanCan::Ability
def initialize(user)
user ||= User.new # for guest
if user.role?('Conference Admin')
can :manage, :all
end
end
end