gunghogeoduck/osem-fcy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement role authorization

Browse source
This commit is contained in:
Stella Rouzi 2014-08-12 11:51:59 +03:00
parent 6755328c4c
commit e2fb434dc7
122 changed files with 1386 additions and 751 deletions
Download patch file Download diff file Expand all files Collapse all files

6
app/controllers/admin/callforpapers_controller.rb
View file

@ -1,8 +1,10 @@
module Admin
class CallforpapersController < ApplicationController
before_filter :verify_organizer
load_and_authorize_resource :conference, find_by: :short_title
# load_and_authorize_resource :cfp, class: 'CallForPapers', through: :conference
def show
authorize! :show, CallForPapers.new(conference_id: @conference.id)
@cfp = @conference.call_for_papers
if @cfp.nil?
@cfp = CallForPapers.new
@ -10,6 +12,7 @@ module Admin
end
def update
authorize! :update, @conference.call_for_papers
@cfp = @conference.call_for_papers
@cfp.assign_attributes(params[:call_for_papers])
send_mail_on_schedule_public = @cfp.notify_on_schedule_public?
@ -30,6 +33,7 @@ module Admin
end
def create
authorize! :update, CallForPapers.new(conference_id: @conference.id)
@cfp = CallForPapers.new(params[:call_for_papers])
if @cfp.valid?
@cfp.save

18
app/controllers/admin/campaigns_controller.rb
View file

@ -1,16 +1,15 @@
module Admin
class CampaignsController < ApplicationController
before_filter :verify_organizer
load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource :campaign, through: :conference
def index
@conference = Conference.find_by(short_title: params[:conference_id])
authorize! :show, Campaign.new(conference_id: @conference.id)
@campaigns = @conference.campaigns
end
def create
@conference = Conference.find_by(short_title: params[:conference_id])
@campaign = @conference.campaigns.new(params[:campaign])
@campaign.conference_id = @conference.id
@campaign.attributes = params[:campaign]
if @conference.save
redirect_to(admin_conference_campaigns_path(conference_id: @conference.short_title),
@ -23,19 +22,12 @@ module Admin
end
def new
@conference = Conference.find_by(short_title: params[:conference_id])
@campaign = @conference.campaigns.new
end
def edit
@conference = Conference.find_by(short_title: params[:conference_id])
@campaign = Campaign.find(params[:id])
end
def update
@conference = Conference.find_by(short_title: params[:conference_id])
@campaign = Campaign.find(params[:id])
if @campaign.update_attributes(params[:campaign])
redirect_to(admin_conference_campaigns_path(
conference_id: @conference.short_title),
@ -50,8 +42,6 @@ module Admin
end
def destroy
@conference = Conference.find_by(short_title: params[:conference_id])
@campaign = Campaign.find(params[:id])
if @campaign.destroy
redirect_to(admin_conference_campaigns_path(conference_id: @conference.short_title),
notice: "Campaign '#{@campaign.name}' successfully deleted.")

12
app/controllers/admin/commercials_controller.rb
View file

@ -1,7 +1,7 @@
module Admin
class CommercialsController < ApplicationController
before_action :set_conference
before_action :set_commercial, only: [:edit, :update, :destroy]
load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource through: :conference
def index
@commercials = @conference.commercials
@ -43,14 +43,6 @@ module Admin
private
def set_commercial
@commercial = @conference.commercials.find(params[:id])
end
def set_conference
@conference = Conference.find_by(short_title: params[:conference_id])
end
def commercial_params
#params.require(:commercial).permit(:commercial_id, :commercial_type)
params[:commercial]

6
app/controllers/admin/conference_controller.rb
View file

@ -1,6 +1,6 @@
module Admin
class ConferenceController < ApplicationController
before_filter :verify_organizer
load_and_authorize_resource :conference, find_by: :short_title
def index
# Redirect to new form if there is no conference
@ -63,8 +63,11 @@ module Admin
def create
@conference = Conference.new(params[:conference])
if @conference.valid?
@conference.save
# user that creates the conference becomes organizer of that conference
current_user.add_role :organizer, @conference
redirect_to(admin_conference_path(id: @conference.short_title),
notice: 'Conference was successfully created.')
else
@ -108,6 +111,7 @@ module Admin
if @conference.update_attributes(params[:conference])
Mailbot.delay.conference_date_update_mail(@conference) if notify_on_conf_dates_updates
Mailbot.delay.conference_registration_date_update_mail(@conference) if notify_on_conf_reg_dates_updates
redirect_to(edit_admin_conference_path(id: @conference.short_title),
notice: 'Conference was successfully updated.')
else

45
app/controllers/admin/contacts_controller.rb
View file

@ -1,33 +1,30 @@
module Admin
class ContactsController < ApplicationController
before_action :set_conference
before_action :set_conference
before_action :set_contact, only: [:edit, :update]
load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource through: :conference, singleton: true
# GET /:conference/contact/edit
def edit
# GET /:conference/contact
def show; end
# GET /:conference/contact/edit
def edit; end
# PATCH/PUT /:conference/contact
def update
if @contact.update(contact_params)
redirect_to admin_conference_contact_path, notice: 'Contact details were successfully updated.'
else
render :edit
end
end
# PATCH/PUT /:conference/contact
def update
if @contact.update(contact_params)
redirect_to edit_admin_conference_contact_path, notice: 'Contact details were successfully updated.'
else
render :edit
end
end
private
# Use callbacks to share common setup or constraints between actions.
def set_contact
@contact = @conference.contact
end
def set_conference
@conference = Conference.find_by(short_title: params[:conference_id])
end
# DELETE /:conference/contact
def destroy
@contact.destroy
redirect_to admin_conference_contacts_url, notice: 'Contact details were successfully destroyed.'
end
private
# Only allow a trusted parameter "white list" through.
def contact_params
# params.require(:contact).permit(:social_tag, :email, :facebook, :googleplus, :twitter, :instagram, :public)

7
app/controllers/admin/dietchoices_controller.rb
View file

@ -1,6 +1,7 @@
module Admin
class DietchoicesController < ApplicationController
before_filter :verify_organizer
load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource :dietary_choice, through: :conference
def show
render :diets_list
@ -9,9 +10,9 @@ module Admin
def update
begin
@conference.update_attributes!(params[:conference])
redirect_to(admin_conference_dietary_list_path(conference_id: @conference.short_title), notice: 'Dietary choices were successfully updated.')
redirect_to(admin_conference_dietary_list_path(:conference_id => @conference.short_title), :notice => 'Dietary choices were successfully updated.')
rescue => e
redirect_to(admin_conference_dietary_list_path(conference_id: @conference.short_title), alert: "Dietary choices update failed: #{e.message}")
redirect_to(admin_conference_dietary_list_path(:conference_id => @conference.short_title), :alert => "Dietary choices update failed: #{e.message}")
end
end
end

13
app/controllers/admin/difficulty_levels_controller.rb
View file

@ -1,9 +1,10 @@
module Admin
class DifficultyLevelsController < ApplicationController
before_filter :verify_organizer
load_and_authorize_resource :conference, find_by: :short_title
authorize_resource through: :conference
def index
@conference = Conference.find_by(short_title: params[:conference_id])
authorize! :index, DifficultyLevel.new(conference_id: @conference.id)
end
def update
@ -13,18 +14,18 @@ module Admin
@conference.use_difficulty_levels = false
@conference.save!
flash[:error] = "You cannot enable the usage of difficulty levels without having set any levels."
redirect_to(admin_conference_difficulty_levels_path(conference_id: @conference.short_title))
redirect_to(admin_conference_difficulty_levels_path(:conference_id => @conference.short_title))
rescue ActiveRecord::RecordInvalid
flash[:error] = "Something went wrong. Difficulty Levels update failed."
redirect_to(admin_conference_difficulty_levels_path(conference_id: @conference.short_title))
redirect_to(admin_conference_difficulty_levels_path(:conference_id => @conference.short_title))
end
else
flash[:notice] = "Difficulty Levels were successfully updated."
redirect_to(admin_conference_difficulty_levels_path(conference_id: @conference.short_title))
redirect_to(admin_conference_difficulty_levels_path(:conference_id => @conference.short_title))
end
else
flash[:error] = "Difficulty Levels update failed."
redirect_to(admin_conference_difficulty_levels_path(conference_id: @conference.short_title))
redirect_to(admin_conference_difficulty_levels_path(:conference_id => @conference.short_title))
end
end
end

4
app/controllers/admin/emails_controller.rb
View file

@ -1,6 +1,7 @@
module Admin
class EmailsController < ApplicationController
before_filter :verify_organizer
load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource class: EmailSettings
def update
@conference.email_settings.update_attributes(params[:email_settings])
@ -10,6 +11,7 @@ module Admin
end
def index
authorize! :index, @conference.email_settings
@settings = @conference.email_settings
end
end

25
app/controllers/admin/event_types_controller.rb Normal file
View file

@ -0,0 +1,25 @@
module Admin
class EventTypesController < ApplicationController
load_and_authorize_resource :conference, find_by: :short_title
authorize_resource :event_type, through: :conference
def index
authorize! :index, EventType.new(conference_id: @conference.id)
end
def show
render :eventtypes
end
def update
@conference.update_attributes!(params[:conference])
redirect_to(admin_conference_event_types_path(
conference_id: @conference.short_title),
notice: 'Event types were successfully updated.')
rescue Exception => e
redirect_to(admin_conference_event_types_path(
conference_id: @conference.short_title),
alert: "Event types update failed: #{e.message}")
end
end
end

5
app/controllers/admin/events_controller.rb
View file

@ -1,6 +1,7 @@
module Admin
class EventsController < ApplicationController
before_filter :verify_organizer
load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource :event, through: :conference
before_action :get_event, except: [:index, :create]
@ -13,6 +14,8 @@ module Admin
end
def index
authorize! :index, @conference.events.build
@conference = Conference.find_by(short_title: params[:conference_id])
@events = @conference.events
@tracks = @conference.tracks
@machine_states = @events.state_machine.states.map

7
app/controllers/admin/lodgings_controller.rb
View file

@ -1,16 +1,17 @@
module Admin
class LodgingsController < ApplicationController
before_filter :verify_organizer
load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource :venue, through: :conference, singleton: true
authorize_resource :lodging, through: :venue
def index
@venue = @conference.venue
authorize! :update, Lodging.new(venue_id: @venue.id)
end
def show
end
def update
@venue = @conference.venue
if @venue.update_attributes(params[:venue])
redirect_to(admin_conference_lodgings_path(conference_id: @conference.short_title),
notice: 'Lodgings were successfully updated.')

42
app/controllers/admin/questions_controller.rb
View file

@ -1,23 +1,24 @@
module Admin
class QuestionsController < ApplicationController
before_filter :verify_organizer
load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource through: :conference, except: [:new, :create]
def index
@conference = Conference.find_by(short_title: params[:conference_id])
@questions = Question.where(global: true).all | Question.where(conference_id: @conference.id)
authorize! :update, Question.new(conference_id: @conference.id)
@questions = Question.where(:global => true).all | Question.where(:conference_id => @conference.id)
@questions_conference = @conference.questions
@new_question = @conference.questions.new
end
def new
@conference = Conference.find_by(short_title: params[:conference_id])
@new_question = @conference.questions.new
@question = Question.new(conference_id: @conference.id)
authorize! :create, @question
end
def create
@conference = Conference.find_by(short_title: params[:conference_id])
@question = @conference.questions.new(params[:question])
@question.conference_id = @conference.id
authorize! :create, @question
respond_to do |format|
if @conference.save
@ -31,42 +32,33 @@ module Admin
# GET questions/1/edit
def edit
@conference = Conference.find_by(short_title: params[:conference_id])
@question = Question.find(params[:id])
if @question.global == true && !has_role?(current_user, "Admin")
redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), alert: "Sorry, you cannot edit global questions. Create a new one.")
if @question.global == true && !(current_user.has_role? :organizer, @conference)
redirect_to(admin_conference_questions_path(:conference_id => @conference.short_title), :alert => "Sorry, you cannot edit global questions. Create a new one.")
end
end
# PUT questions/1
def update
@conference = Conference.find_by(short_title: params[:conference_id])
@question = Question.find(params[:id])
if @question.update_attributes(params[:question])
redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Question '#{@question.title}' for #{@conference.short_title} successfully updated.")
redirect_to(admin_conference_questions_path(:conference_id => @conference.short_title), :notice => "Question '#{@question.title}' for #{@conference.short_title} successfully updated.")
else
redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Update of questions for #{@conference.short_title} failed.")
redirect_to(admin_conference_questions_path(:conference_id => @conference.short_title), :notice => "Update of questions for #{@conference.short_title} failed.")
end
end
# Update questions used for the conference
def update_conference
@conference = Conference.find_by(short_title: params[:conference_id])
if @conference.update_attributes(params[:conference])
redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Questions for #{@conference.short_title} successfully updated.")
redirect_to(admin_conference_questions_path(:conference_id => @conference.short_title), :notice => "Questions for #{@conference.short_title} successfully updated.")
else
redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Update of questions for #{@conference.short_title} failed.")
redirect_to(admin_conference_questions_path(:conference_id => @conference.short_title), :notice => "Update of questions for #{@conference.short_title} failed.")
end
end
# DELETE questions/1
def destroy
if has_role?(current_user, "Admin")
@question = Question.find(params[:id])
if can? :destroy, @question
# Do not delete global questions
if @question.global == false
@ -74,12 +66,12 @@ module Admin
begin
Question.transaction do
@question.delete
@question.destroy
@question.answers.each do |a|
a.delete
end
flash[:notice] = "Deleted question: #{@question.title} and its answers: #{@question.answers.map {|a| a.title}.join ','}"
end
end
rescue ActiveRecord::RecordInvalid
flash[:error] = "Could not delete question."
end
@ -90,7 +82,7 @@ module Admin
flash[:error] = "You must be an admin to delete a question."
end
@questions = Question.where(global: true).all | Question.where(conference_id: @conference.id)
@questions = Question.where(:global => true).all | Question.where(:conference_id => @conference.id)
@questions_conference = @conference.questions
end
end

10
app/controllers/admin/registrations_controller.rb
View file

@ -1,8 +1,10 @@
module Admin
class RegistrationsController < ApplicationController
before_filter :verify_organizer
load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource through: :conference
def index
authorize! :show, Registration.new(conference_id: @conference.id)
session[:return_to] ||= request.referer
@pdf_filename = "#{@conference.title}.pdf"
@registrations = @conference.registrations.includes(:user)
@ -12,7 +14,6 @@ module Admin
end
def change_field
@registration = Registration.find(params[:id])
field = params[:view_field]
if @registration.send(field.to_sym)
@registration.update_attribute(:"#{field}", 0)
@ -26,12 +27,10 @@ module Admin
end
def edit
@registration = @conference.registrations.where('id = ?', params[:id]).first
@user = User.where('id = ?', @registration.user_id).first
end
def update
@registration = @conference.registrations.where('id = ?', params[:id]).first
@user = User.where('id = ?', @registration.user_id).first
begin
@user.update_attributes!(params[:registration][:user_attributes])
@ -55,6 +54,7 @@ module Admin
def new
@user = User.new
@registration = @user.registrations.new
@registration.conference_id = @conference.id
@supporter_registration = @conference.supporter_registrations.new
end
@ -97,7 +97,7 @@ module Admin
end
def destroy
if has_role?(current_user, 'Admin')
if can? :destroy, @registration
registration = @conference.registrations.where(id: params[:id]).first
user = User.where('id = ?', registration.user_id).first

7
app/controllers/admin/rooms_controller.rb
View file

@ -1,6 +1,11 @@
module Admin
class RoomsController < ApplicationController
before_filter :verify_organizer
load_and_authorize_resource :conference, find_by: :short_title
authorize_resource through: :conference
def index
authorize! :index, Room.new(conference_id: @conference.id)
end
def show
render :rooms_list

7
app/controllers/admin/schedules_controller.rb
View file

@ -1,10 +1,14 @@
module Admin
class SchedulesController < ApplicationController
before_filter :verify_organizer
# By authorizing 'conference' resource, we can ensure there will be no unauthorized access to
# the schedule of a conference, which should not be accessed in the first place
load_and_authorize_resource :conference, find_by: :short_title
skip_before_filter :verify_authenticity_token, only: [:update]
layout 'schedule'
def show
authorize! :update, @conference.events.new
if @conference.nil?
redirect_to admin_conference_index_path
return
@ -14,6 +18,7 @@ module Admin
end
def update
authorize! :update, @conference.events.new
event = Event.where(guid: params[:event]).first
error_message = nil
if event.nil?

7
app/controllers/admin/social_events_controller.rb
View file

@ -1,6 +1,7 @@
module Admin
class SocialEventsController < ApplicationController
before_filter :verify_organizer
load_and_authorize_resource :conference, find_by: :short_title
authorize_resource :social_event, through: :conference
def show
render :social_events_list
@ -8,9 +9,9 @@ module Admin
def update
if @conference.update_attributes(params[:conference])
redirect_to(admin_conference_social_events_path(conference_id: @conference.short_title), notice: 'Social events were successfully updated.')
redirect_to(admin_conference_social_events_path(:conference_id => @conference.short_title), :notice => 'Social events were successfully updated.')
else
redirect_to(admin_conference_social_events_path(conference_id: @conference.short_title), notice: 'Social events update failed.')
redirect_to(admin_conference_social_events_path(:conference_id => @conference.short_title), :notice => 'Social events update failed.')
end
end
end

8
app/controllers/admin/speakers_controller.rb
View file

@ -1,15 +1,17 @@
module Admin
class SpeakersController < ApplicationController
before_filter :verify_organizer
load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource :event
respond_to :js, :html
def edit
@event = @conference.events.find(params[:event_id])
authorize! :update, @conference.events.new
@speaker = @event.event_users.where(event_role: 'speaker').first
end
def update
@event = @conference.events.find(params[:event_id])
authorize! :update, @conference.events.new
@speaker = @event.event_users.where(event_role: 'speaker').first
@speaker.user_id = params[:speaker][:user_id]
@speaker.save

7
app/controllers/admin/sponsors_controller.rb
View file

@ -1,6 +1,11 @@
module Admin
class SponsorsController < ApplicationController
before_filter :verify_organizer
load_and_authorize_resource :conference, find_by: :short_title
authorize_resource :sponsor, through: :conference
def index
authorize! :index, Sponsor.new(conference_id: @conference.id)
end
def update
if @conference.update_attributes(params[:conference])

7
app/controllers/admin/sponsorship_levels_controller.rb
View file

@ -1,6 +1,11 @@
module Admin
class SponsorshipLevelsController < ApplicationController
before_filter :verify_organizer
load_and_authorize_resource :conference, find_by: :short_title
authorize_resource through: :conference
def index
authorize! :index, SponsorshipLevel.new(conference_id: @conference.id)
end
def update
if @conference.update_attributes(params[:conference])

3
app/controllers/admin/stats_controller.rb
View file

@ -1,6 +1,7 @@
module Admin
class StatsController < ApplicationController
before_filter :verify_organizer
load_and_authorize_resource
load_and_authorize_resource :conference, find_by: :short_title
def index
@registrations = @conference.registrations.includes(:user)

7
app/controllers/admin/supporter_levels_controller.rb
View file

@ -1,6 +1,11 @@
module Admin
class SupporterLevelsController < ApplicationController
before_filter :verify_organizer
load_and_authorize_resource :conference, find_by: :short_title
authorize_resource through: :conference
def index
authorize! :update, SupporterLevel.new(conference_id: @conference.id)
end
def show
render :supporter_levels

3
app/controllers/admin/supporters_controller.rb
View file

@ -1,6 +1,7 @@
module Admin
class SupportersController < ApplicationController
before_filter :verify_organizer
load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource through: :conference
def index
respond_to do |format|

6
app/controllers/admin/targets_controller.rb
View file

@ -1,11 +1,15 @@
module Admin
class TargetsController < ApplicationController
before_filter :verify_organizer
load_and_authorize_resource :conference, find_by: :short_title
authorize_resource through: :conference
def index
authorize! :index, Target.new(conference_id: @conference.id)
end
def update
authorize! :update, @conference => Target
if @conference.update_attributes(params[:conference])
redirect_to(admin_conference_targets_path(
conference_id: @conference.short_title),

7
app/controllers/admin/tracks_controller.rb
View file

@ -1,6 +1,11 @@
module Admin
class TracksController < ApplicationController
before_filter :verify_organizer
load_and_authorize_resource :conference, find_by: :short_title
authorize_resource through: :conference
def index
authorize! :index, Track.new(conference_id: @conference.id)
end
def show
respond_to do |format|

32
app/controllers/admin/users_controller.rb
View file

@ -1,6 +1,7 @@
module Admin
class UsersController < ApplicationController
before_filter :verify_admin
load_and_authorize_resource
def new
@user = User.new
end
@ -10,34 +11,37 @@ module Admin
end
def show
@user = User.find(params[:id])
# Variable @show_attributes holds the attributes that are visible for the 'show' action
# If you want to change the attributes that are shown in the 'show' action of users
# add/remove the attributes in the following string array
@show_attributes = %w(name email affiliation biography registered attended created_at
@show_attributes = %w(name email affiliation biography registered attended roles created_at
updated_at sign_in_count current_sign_in_at last_sign_in_at
current_sign_in_ip last_sign_in_ip)
end
def update
user = User.find(params[:id])
user.update_attributes!(params[:user])
redirect_to admin_users_path, notice: "Updated #{user.email}"
params[:user].delete :roles_attributes if params[:user]
@user.update_attributes!(params[:user])
redirect_to admin_users_path, notice: "Updated #{@user.email}"
end
def add_role
role = params[:user][:roles_attributes][:"0"]
@user.add_role role['name'].parameterize.underscore.to_sym, Conference.find(role['resource_id'])
respond_to do |format|
format.html
format.js
end
end
def edit
@user = User.find(params[:id])
end
def delete
@user = User.find(params[:id])
end
def destroy
@user = User.find(params[:id])
@user.destroy
redirect_to admin_users_path, notice: 'User got deleted'
redirect_to admin_users_path, notice: "User #{@user.name} (#{@user.email})got deleted"
end
end
end

3
app/controllers/admin/venue_controller.rb
View file

@ -1,6 +1,7 @@
module Admin
class VenueController < ApplicationController
before_filter :verify_organizer
load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource :venue, through: :conference, singleton: true
def index
end

35
app/controllers/admin/volunteers_controller.rb
View file

@ -1,26 +1,37 @@
module Admin
class VolunteersController < ApplicationController
load_and_authorize_resource :conference, find_by: :short_title
def index
@conference = Conference.find_by(short_title: params[:conference_id])
render :index
if (current_user.has_role? :organizer, @conference) || (current_user.has_role? :volunteer_coordinator, @conference)
render :index
else
authorize! :index, :volunteer
end
end
def show
@conference = Conference.find_by(short_title: params[:conference_id])
if @conference.use_vpositions
@volunteers = @conference.registrations.joins(:vchoices).uniq
if (current_user.has_role? :organizer, @conference) || (current_user.has_role? :volunteer_coordinator, @conference)
if @conference.use_vpositions
@volunteers = @conference.registrations.joins(:vchoices).uniq
else
@volunteers = @conference.registrations.where(:volunteer => true)
end
else
@volunteers = @conference.registrations.where(volunteer: true)
authorize! :index, :volunteer
end
end
def update
@conference = Conference.find_by(short_title: params[:conference_id])
begin
@conference.update_attributes!(params[:conference])
redirect_to(admin_conference_volunteers_info_path(conference_id: params[:conference_id]), notice: "Volunteering options were successfully updated.")
rescue => e
redirect_to(admin_conference_volunteers_info_path(conference_id: params[:conference_id]), alert: "Volunteering options update failed: #{e.message}")
if (current_user.has_role? :organizer, @conference) || (current_user.has_role? :volunteer_coordinator, @conference)
begin
@conference.update_attributes!(params[:conference])
redirect_to(admin_conference_volunteers_info_path(:conference_id => params[:conference_id]), :notice => "Volunteering options were successfully updated.")
rescue Exception => e
redirect_to(admin_conference_volunteers_info_path(:conference_id => params[:conference_id]), :alert => "Volunteering options update failed: #{e.message}")
end
else
authorize! :index, :volunteer
end
end
end

38
app/controllers/application_controller.rb
View file

@ -3,14 +3,17 @@ class ApplicationController < ActionController::Base
protect_from_forgery
before_filter :get_conferences
before_filter :store_location
before_filter :verify_user_admin
helper_method :date_string
# Ensure every controller authorizes resource or skips authorization (skip_authorization_check)
check_authorization unless: :devise_controller?
def store_location
session[:return_to] = request.fullpath if request.get? && controller_name != "user_sessions" && controller_name != "sessions"
end
def after_sign_in_path_for(resource)
if organizer_or_admin? &&
if (can? :view, Conference) &&
(!session[:return_to] ||
session[:return_to] &&
session[:return_to] == root_path)
@ -31,6 +34,16 @@ class ApplicationController < ActionController::Base
@conferences =Conference.all
end
def verify_user_admin
if self.class.to_s.split('::').first == 'Admin' && verify_user
unless (current_user.has_role? :organizer, :any) || (current_user.has_role? :cfp, :any) ||
(current_user.has_role? :info_desk, :any) ||
(current_user.has_role? :volunteers_coordinator, :any) || current_user.is_admin
raise CanCan::AccessDenied.new('You are not authorized to access this area!')
end
end
end
def verify_user
:authenticate_user!
@ -39,36 +52,17 @@ class ApplicationController < ActionController::Base
return false
end
@conference = Conference.find_by(short_title: params[:conference_id])
true
end
def organizer_or_admin?
has_role?(current_user, 'admin') || has_role?(current_user, 'organizer')
end
def verify_organizer
if !verify_user
return
end
## Todo simplify this
redirect_to root_path unless has_role?(current_user, 'admin') || has_role?(current_user, 'organizer')
end
def verify_admin
if !verify_user
return
end
redirect_to root_path unless has_role?(current_user, 'admin')
def current_ability
@current_ability ||= Ability.new(current_user)
end
rescue_from CanCan::AccessDenied do |exception|
Rails.logger.debug("Access denied!")
redirect_to root_path, alert: exception.message
end
helper_method :organizer_or_admin?
def not_found
raise ActionController::RoutingError.new('Not Found')

14
app/controllers/commercials_controller.rb
View file

@ -1,10 +1,11 @@
class CommercialsController < ApplicationController
before_action :set_conference
load_and_authorize_resource :conference, find_by: :short_title
before_action :set_event
before_action :set_commercial, only: [:edit, :update, :destroy]
load_and_authorize_resource through: @event, except: [:new, :create]
def new
@commercial = @event.commercials.build
authorize! :new, @commercial
end
def edit
@ -12,6 +13,7 @@ class CommercialsController < ApplicationController
def create
@commercial = @event.commercials.build(commercial_params)
authorize! :create, @commercial
if @commercial.save
redirect_to edit_conference_proposal_path(conference_id: @conference.short_title, id: @event.id),
@ -40,14 +42,6 @@ class CommercialsController < ApplicationController
private
def set_commercial
@commercial = @event.commercials.find(params[:id])
end
def set_conference
@conference = Conference.find_by(short_title: params[:conference_id])
end
def set_event
@event = @conference.events.find(params[:proposal_id])
end

6
app/controllers/conference_controller.rb
View file

@ -1,7 +1,7 @@
class ConferenceController < ApplicationController
load_and_authorize_resource find_by: :short_title
def show
@conference = Conference.find_by_short_title(params[:id])
redirect_to root_path, notice: "Conference not ready yet!!" unless @conference.make_conference_public?
end
def subscribe
@ -41,7 +41,7 @@ class ConferenceController < ApplicationController
end
def gallery_photos
@photos = Conference.find_by_short_title(params[:id]).photos
@photos = @conference.photos
render "photos", formats: [:js]
end
end

28
app/controllers/conference_registration_controller.rb
View file

@ -1,9 +1,9 @@
class ConferenceRegistrationController < ApplicationController
before_filter :verify_user
load_resource :conference, find_by: :short_title
authorize_resource :conference_registration, class: Registration
def register
# TODO Figure out how to change the route's id from :id to :conference_id
@conference = Conference.find_by(short_title: params[:id])
@workshops = @conference.events.where('require_registration = ? AND state LIKE ?',
true, 'confirmed')
@user = current_user
@ -23,9 +23,8 @@ class ConferenceRegistrationController < ApplicationController
# TODO this is ugly
def update
conference = Conference.find_by(short_title: params[:id])
user = current_user
registration = user.registrations.where(conference_id: conference.id).first
registration = user.registrations.where(conference_id: @conference.id).first
update_registration = true
# First verify that the supporter code is legit
if !params[:registration][:supporter_registration_attributes].nil? &&
@ -35,7 +34,7 @@ class ConferenceRegistrationController < ApplicationController
if regs.count != 0
if regs.where(email: user.email).count == 0
redirect_to(register_conference_path(id: conference.short_title),
redirect_to(conference_register_path(conference_id: @conference.short_title),
alert: "This code is already in use.
Please contact #{conference.contact.email} for assistance.")
return
@ -50,7 +49,7 @@ class ConferenceRegistrationController < ApplicationController
supporter_reg = params[:registration][:supporter_registration_attributes]
params[:registration].delete :supporter_registration_attributes
registration = user.registrations.new(registration_params)
if conference.use_supporter_levels? && !supporter_reg.nil?
if @conference.use_supporter_levels? && !supporter_reg.nil?
if !supporter_reg[:id].blank?
# Means that their supporter registration was entered ahead of time, by an admin
registration.supporter_registration = SupporterRegistration.find(supporter_reg[:id])
@ -58,12 +57,12 @@ class ConferenceRegistrationController < ApplicationController
raise 'Invalid code'
end
else
registration.supporter_registration = conference.
registration.supporter_registration = @conference.
supporter_registrations.new(registration_params[:supporter_registration_attributes])
end
end
registration.conference_id = conference.id
registration.conference_id = @conference.id
registration.save!
if user.subscriptions.where(conference: conference).blank?
subscription = Subscription.new(conference_id: conference.id, user_id: user.id)
@ -74,7 +73,7 @@ class ConferenceRegistrationController < ApplicationController
end
rescue => e
Rails.logger.debug e.backtrace.join('\n')
redirect_to(register_conference_path(id: conference.short_title),
redirect_to(conference_register_path(conference_id: @conference.short_title),
alert: 'Registration failed:' + e.message)
return
end
@ -84,19 +83,18 @@ class ConferenceRegistrationController < ApplicationController
else
# Track ahoy event
ahoy.track 'Registered', title: 'New registration'
if conference.email_settings.send_on_registration?
Mailbot.delay.registration_mail(conference, current_user)
if @conference.email_settings.send_on_registration?
Mailbot.delay.registration_mail(@conference, current_user)
end
end
redirect_to(register_conference_path(id: conference.short_title),
redirect_to(conference_register_path(conference_id: @conference.short_title),
notice: redirect_message)
end
def unregister
conference = Conference.find_by(short_title: params[:id])
user = current_user
registration = user.registrations.where(conference_id: conference.id).first
subscription = user.subscriptions.where(conference: conference)
registration = user.registrations.where(conference_id: @conference.id).first
subscription = user.subscriptions.where(conference: @conference)
unless subscription.blank?
subscription.first.destroy
end

36
app/controllers/event_attachments_controller.rb
View file

@ -1,9 +1,11 @@
class EventAttachmentsController < ApplicationController
load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource :proposal, class: Event
load_and_authorize_resource :upload, class: EventAttachment, through: :proposal
before_filter :verify_user
skip_before_filter :verify_user, only: [:show]
def index
@proposal = Event.find(params[:proposal_id])
@uploads = @proposal.event_attachments
@uploads = @uploads.map{|upload| upload.to_jq_upload }
@ -14,9 +16,9 @@ class EventAttachmentsController < ApplicationController
end
def show
upload = EventAttachment.find(params[:id])
if upload.public?
send_file upload.attachment.path
if @upload.public?
send_file @upload.attachment.path
return
end
@ -26,7 +28,7 @@ class EventAttachmentsController < ApplicationController
end
if organizer_or_admin? || current_user == upload.event.submitter
send_file upload.attachment.path
send_file @upload.attachment.path
else
raise ActionController::RoutingError.new('Not Found')
end
@ -42,7 +44,6 @@ class EventAttachmentsController < ApplicationController
end
def edit
@upload = EventAttachment.find(params[:id])
end
def create
@ -50,7 +51,7 @@ class EventAttachmentsController < ApplicationController
params[:event_attachment][:public] = false
params[:event_attachment][:event_id] = params[:proposal_id]
if !organizer_or_admin?
if cannot? :create, EventAttachment
begin
current_user.events.find(params[:proposal_id])
rescue
@ -66,6 +67,7 @@ class EventAttachmentsController < ApplicationController
respond_to do |format|
if @upload.save
<<<<<<< HEAD
format.html do
render json: [@upload.to_jq_upload].to_json,
content_type: 'text/html',
@ -75,6 +77,15 @@ class EventAttachmentsController < ApplicationController
render json: [@upload.to_jq_upload].to_json, status: :created,
location: conference_proposal_event_attachment_path(@upload.event.conference.short_title, @upload.event, @upload)
end
=======
format.html {
render :json => [@upload.to_jq_upload].to_json,
:content_type => 'text/html',
:layout => false
}
format.json { render json: {files: [@upload.to_jq_upload]}, status: :created,
location: conference_proposal_event_attachment_path(@upload.event.conference.short_title, @upload.event, @upload) }
>>>>>>> authorization with cancancan
else
format.html { render action: "new" }
format.json { render json: @upload.errors, status: :unprocessable_entity }
@ -83,8 +94,6 @@ class EventAttachmentsController < ApplicationController
end
def update
@proposal = current_user.events.find(params[:proposal_id])
@upload = @proposal.event_attachments.find(params[:proposal_id])
respond_to do |format|
if @upload.update_attributes(params[:upload])
@ -98,14 +107,13 @@ class EventAttachmentsController < ApplicationController
end
def destroy
@proposal = Event.find(params[:proposal_id])
if organizer_or_admin? || current_user == @proposal.submitter
if can? :destroy, @proposal
@upload = @proposal.event_attachments.find(params[:id])
end
@upload.destroy if !@upload.nil?
respond_to do |format|
format.html { redirect_back_or_to conference_proposal_index_path(@conference.short_title), notice: "Deleted successfully attachment '#{@upload.title}' for proposal '#{@proposal.title}'" }

1
app/controllers/home_controller.rb
View file

@ -1,5 +1,6 @@
class HomeController < ApplicationController
before_filter :respond_to_options
skip_authorization_check
def index
@today = Date.current

24
app/controllers/proposal_controller.rb
View file

@ -1,22 +1,19 @@
class ProposalController < ApplicationController
before_filter :verify_user, except: [:show]
before_action :set_conference, only: [:show]
before_action :set_event, only: [:show, :edit, :update, :destroy, :confirm, :restart]
load_resource :conference, find_by: :short_title
load_and_authorize_resource :event, parent: false, through: :conference
def index
@events = current_user.proposals(@conference)
end
def show
authorize! :show, @event
# FIXME: We should show more than the first speaker
@speaker = @event.speakers.first || @event.submitter
end
def new
authorize! :new, Event
@url = conference_proposal_index_path(@conference.short_title)
@event = Event.new
end
def edit
@ -26,7 +23,6 @@ class ProposalController < ApplicationController
end
def create
authorize! :create, Event
@url = conference_proposal_index_path(@conference.short_title)
params[:event].delete :user
@ -53,7 +49,7 @@ class ProposalController < ApplicationController
registration = current_user.registrations.where(conference_id: @conference.id).first
ahoy.track 'Event submission', title: 'New submission'
if registration.nil?
redirect_to(register_conference_path(@conference.short_title),
redirect_to(conference_register_path(@conference.short_title),
alert: 'Event was successfully submitted.
You should register for the conference now.')
else
@ -120,7 +116,7 @@ class ProposalController < ApplicationController
end
if !@conference.user_registered?(current_user)
redirect_to(register_conference_path(@conference.short_title),
redirect_to(conference_register_path(@conference.short_title),
alert: 'The proposal was confirmed. Please register to attend the conference.')
return
end
@ -131,7 +127,7 @@ class ProposalController < ApplicationController
def restart
authorize! :update, @event
@url = conference_proposal_path(@conference.short_title, params[:id])
begin
@event.restart
rescue Transitions::InvalidTransition
@ -149,14 +145,4 @@ class ProposalController < ApplicationController
redirect_to(conference_proposal_index_path(conference_id: @conference.short_title),
notice: "The proposal was re-submitted. The #{@conference.short_title} organizers will review it again.")
end
private
def set_conference
@conference = Conference.find_by(short_title: params[:conference_id])
end
def set_event
@event = Event.find(params[:id])
end
end

6
app/controllers/schedule_controller.rb
View file

@ -1,6 +1,10 @@
class ScheduleController < ApplicationController
<<<<<<< HEAD
=======
authorize_resource class: false
>>>>>>> authorization with cancancan
layout "application"
def index
@conference = Conference.includes(:rooms, events: [:speakers, :track, :event_type]).where("conferences.short_title" => params[:conference_id]).first
@rooms = @conference.rooms

1
app/controllers/users/omniauth_callbacks_controller.rb
View file

@ -1,6 +1,7 @@
module Users
class OmniauthCallbacksController < Devise::OmniauthCallbacksController
skip_before_filter :verify_authenticity_token
skip_authorization_check
User.omniauth_providers.each do |provider|
define_method(provider) { handle(provider) }