From c5e410843c3686b2bb4a871dac43f21e356ff395 Mon Sep 17 00:00:00 2001 From: Ana Date: Fri, 29 Jul 2016 18:29:57 +0200 Subject: [PATCH] Load and authorize schedule in ScheduleController --- app/controllers/admin/schedule_controller.rb | 6 +----- app/models/ability.rb | 1 + spec/models/ability_spec.rb | 10 ++++++++++ 3 files changed, 12 insertions(+), 5 deletions(-) diff --git a/app/controllers/admin/schedule_controller.rb b/app/controllers/admin/schedule_controller.rb index c28240a6..22699f24 100644 --- a/app/controllers/admin/schedule_controller.rb +++ b/app/controllers/admin/schedule_controller.rb @@ -2,6 +2,7 @@ module Admin class ScheduleController < Admin::BaseController # By authorizing 'conference' resource, we can ensure there will be no unauthorized access to # the schedule of a conference, which should not be accessed in the first place + load_and_authorize_resource :schedule load_and_authorize_resource :conference, find_by: :short_title load_and_authorize_resource :program, through: :conference, singleton: true load_resource :venue, through: :conference, singleton: true @@ -19,7 +20,6 @@ module Admin end def show - authorize! :update, @program.events.new @schedule_id = params[:id].to_i schedule = Schedule.find(@schedule_id) @event_schedules = schedule.event_schedules @@ -30,10 +30,6 @@ module Admin end def update - event = @program.events.new - authorize! :update, event - event.destroy - if params[:selected_schedule].present? if params[:selected_schedule] == 'true' @program.selected_schedule_id = params[:id].to_i diff --git a/app/models/ability.rb b/app/models/ability.rb index 76e1fc4c..02096392 100644 --- a/app/models/ability.rb +++ b/app/models/ability.rb @@ -143,6 +143,7 @@ class Ability can :manage, Vposition, conference_id: conf_ids_for_organizer can :manage, Vday, conference_id: conf_ids_for_organizer can :manage, Program, conference_id: conf_ids_for_organizer + can :manage, Schedule, program: { conference_id: conf_ids_for_organizer } can :manage, Cfp, program: { conference_id: conf_ids_for_organizer} can :manage, Event, program: { conference_id: conf_ids_for_organizer} can :manage, EventType, program: { conference_id: conf_ids_for_organizer} diff --git a/spec/models/ability_spec.rb b/spec/models/ability_spec.rb index affbf53d..c34991a6 100644 --- a/spec/models/ability_spec.rb +++ b/spec/models/ability_spec.rb @@ -39,6 +39,8 @@ describe 'User' do let(:conference_with_closed_registration) { create(:conference) } let!(:closed_registration_period) { create(:registration_period, conference: conference_with_closed_registration, start_date: Date.current - 6.days, end_date: Date.current - 6.days) } + let!(:my_schedule) { create(:schedule, program: my_conference.program) } + let!(:other_schedule) { create(:schedule, program: conference_public.program) } # Test abilities for not signed in users context 'when user is not signed in' do it{ should be_able_to(:index, Conference)} @@ -197,6 +199,8 @@ describe 'User' do it{ should_not be_able_to(:manage, conference_public.questions.first) } it{ should be_able_to(:manage, my_conference.program.cfp) } it{ should_not be_able_to(:manage, conference_public.program.cfp) } + it{ should be_able_to(:manage, my_schedule) } + it{ should_not be_able_to(:manage, other_schedule) } it{ should be_able_to(:manage, my_conference.venue) } it{ should_not be_able_to(:manage, conference_public.venue) } it{ should be_able_to(:manage, my_conference.lodgings.first) } @@ -262,6 +266,8 @@ describe 'User' do it{ should_not be_able_to(:manage, conference_public.questions.first) } it{ should be_able_to(:manage, my_conference.program.cfp) } it{ should_not be_able_to(:manage, conference_public.program.cfp) } + it{ should_not be_able_to(:manage, my_schedule) } + it{ should_not be_able_to(:manage, other_schedule) } it{ should_not be_able_to(:manage, my_conference.venue) } it{ should be_able_to(:show, my_conference.venue) } it{ should_not be_able_to(:manage, conference_public.venue) } @@ -321,6 +327,8 @@ describe 'User' do it{ should_not be_able_to(:manage, conference_public.questions.first) } it{ should_not be_able_to(:manage, my_conference.program.cfp) } it{ should_not be_able_to(:manage, conference_public.program.cfp) } + it{ should_not be_able_to(:manage, my_schedule) } + it{ should_not be_able_to(:manage, other_schedule) } it{ should_not be_able_to(:manage, my_conference.venue) } it{ should_not be_able_to(:show, my_conference.venue) } it{ should_not be_able_to(:manage, conference_public.venue) } @@ -380,6 +388,8 @@ describe 'User' do it{ should_not be_able_to(:manage, conference_public.questions.first) } it{ should_not be_able_to(:manage, my_conference.program.cfp) } it{ should_not be_able_to(:manage, conference_public.program.cfp) } + it{ should_not be_able_to(:manage, my_schedule) } + it{ should_not be_able_to(:manage, other_schedule) } it{ should_not be_able_to(:manage, my_conference.venue) } it{ should_not be_able_to(:show, my_conference.venue) } it{ should_not be_able_to(:manage, conference_public.venue) }