Implement role authorization

app/controllers/admin/callforpapers_controller.rb

@@ -1,8 +1,10 @@
 module Admin
   class CallforpapersController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+#     load_and_authorize_resource :cfp, class: 'CallForPapers', through: :conference
 
     def show
+      authorize! :show, CallForPapers.new(conference_id: @conference.id)
       @cfp = @conference.call_for_papers
       if @cfp.nil?
         @cfp = CallForPapers.new
@@ -10,6 +12,7 @@ module Admin
     end
 
     def update
+      authorize! :update, @conference.call_for_papers
       @cfp = @conference.call_for_papers
       @cfp.assign_attributes(params[:call_for_papers])
       send_mail_on_schedule_public = @cfp.notify_on_schedule_public?
@@ -30,6 +33,7 @@ module Admin
     end
 
     def create
+      authorize! :update, CallForPapers.new(conference_id: @conference.id)
       @cfp = CallForPapers.new(params[:call_for_papers])
       if @cfp.valid?
         @cfp.save

app/controllers/admin/campaigns_controller.rb

@@ -1,16 +1,15 @@
 module Admin
   class CampaignsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    load_and_authorize_resource :campaign, through: :conference
 
     def index
-      @conference = Conference.find_by(short_title: params[:conference_id])
+      authorize! :show, Campaign.new(conference_id: @conference.id)
       @campaigns = @conference.campaigns
     end
 
     def create
-      @conference = Conference.find_by(short_title: params[:conference_id])
-      @campaign = @conference.campaigns.new(params[:campaign])
-      @campaign.conference_id = @conference.id
+      @campaign.attributes = params[:campaign]
 
       if @conference.save
         redirect_to(admin_conference_campaigns_path(conference_id: @conference.short_title),
@@ -23,19 +22,12 @@ module Admin
     end
 
     def new
-      @conference = Conference.find_by(short_title: params[:conference_id])
-      @campaign = @conference.campaigns.new
     end
 
     def edit
-      @conference = Conference.find_by(short_title: params[:conference_id])
-      @campaign = Campaign.find(params[:id])
     end
 
     def update
-      @conference = Conference.find_by(short_title: params[:conference_id])
-      @campaign = Campaign.find(params[:id])
-
       if @campaign.update_attributes(params[:campaign])
         redirect_to(admin_conference_campaigns_path(
                         conference_id: @conference.short_title),
@@ -50,8 +42,6 @@ module Admin
     end
 
     def destroy
-      @conference = Conference.find_by(short_title: params[:conference_id])
-      @campaign = Campaign.find(params[:id])
       if @campaign.destroy
         redirect_to(admin_conference_campaigns_path(conference_id: @conference.short_title),
                     notice: "Campaign '#{@campaign.name}' successfully deleted.")

app/controllers/admin/commercials_controller.rb

@@ -1,7 +1,7 @@
 module Admin
   class CommercialsController < ApplicationController
-    before_action :set_conference
-    before_action :set_commercial, only: [:edit, :update, :destroy]
+    load_and_authorize_resource :conference, find_by: :short_title
+    load_and_authorize_resource through: :conference
 
     def index
       @commercials = @conference.commercials
@@ -43,14 +43,6 @@ module Admin
 
     private
 
-    def set_commercial
-      @commercial = @conference.commercials.find(params[:id])
-    end
-
-    def set_conference
-      @conference = Conference.find_by(short_title: params[:conference_id])
-    end
-
     def commercial_params
       #params.require(:commercial).permit(:commercial_id, :commercial_type)
       params[:commercial]

app/controllers/admin/conference_controller.rb

@@ -1,6 +1,6 @@
 module Admin
   class ConferenceController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
 
     def index
       # Redirect to new form if there is no conference
@@ -63,8 +63,11 @@ module Admin
 
     def create
       @conference = Conference.new(params[:conference])
+
       if @conference.valid?
         @conference.save
+        # user that creates the conference becomes organizer of that conference
+        current_user.add_role :organizer, @conference
         redirect_to(admin_conference_path(id: @conference.short_title),
                     notice: 'Conference was successfully created.')
       else
@@ -108,6 +111,7 @@ module Admin
       if @conference.update_attributes(params[:conference])
         Mailbot.delay.conference_date_update_mail(@conference) if notify_on_conf_dates_updates
         Mailbot.delay.conference_registration_date_update_mail(@conference) if notify_on_conf_reg_dates_updates
+
         redirect_to(edit_admin_conference_path(id: @conference.short_title),
                     notice: 'Conference was successfully updated.')
       else

app/controllers/admin/contacts_controller.rb

@@ -1,33 +1,30 @@
 module Admin
   class ContactsController < ApplicationController
-    before_action :set_conference
-    before_action :set_conference
-    before_action :set_contact, only: [:edit, :update]
+  load_and_authorize_resource :conference, find_by: :short_title
+  load_and_authorize_resource through: :conference, singleton: true
 
-    # GET /:conference/contact/edit
-    def edit
+  # GET /:conference/contact
+  def show; end
+
+  # GET /:conference/contact/edit
+  def edit; end
+
+  # PATCH/PUT /:conference/contact
+  def update
+    if @contact.update(contact_params)
+      redirect_to admin_conference_contact_path, notice: 'Contact details were successfully updated.'
+    else
+      render :edit
     end
+  end
 
-    # PATCH/PUT /:conference/contact
-    def update
-      if @contact.update(contact_params)
-        redirect_to edit_admin_conference_contact_path, notice: 'Contact details were successfully updated.'
-      else
-        render :edit
-      end
-    end
-
-    private
-
-    # Use callbacks to share common setup or constraints between actions.
-    def set_contact
-      @contact = @conference.contact
-    end
-
-    def set_conference
-      @conference = Conference.find_by(short_title: params[:conference_id])
-    end
+  # DELETE /:conference/contact
+  def destroy
+    @contact.destroy
+    redirect_to admin_conference_contacts_url, notice: 'Contact details were successfully destroyed.'
+  end
 
+  private
     # Only allow a trusted parameter "white list" through.
     def contact_params
       # params.require(:contact).permit(:social_tag, :email, :facebook, :googleplus, :twitter, :instagram, :public)

app/controllers/admin/dietchoices_controller.rb

@@ -1,6 +1,7 @@
 module Admin
   class DietchoicesController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    load_and_authorize_resource :dietary_choice, through: :conference
 
     def show
       render :diets_list
@@ -9,9 +10,9 @@ module Admin
     def update
       begin
         @conference.update_attributes!(params[:conference])
-        redirect_to(admin_conference_dietary_list_path(conference_id: @conference.short_title), notice: 'Dietary choices were successfully updated.')
+        redirect_to(admin_conference_dietary_list_path(:conference_id => @conference.short_title), :notice => 'Dietary choices were successfully updated.')
       rescue => e
-        redirect_to(admin_conference_dietary_list_path(conference_id: @conference.short_title), alert: "Dietary choices update failed: #{e.message}")
+        redirect_to(admin_conference_dietary_list_path(:conference_id => @conference.short_title), :alert => "Dietary choices update failed: #{e.message}")
       end
     end
   end

app/controllers/admin/difficulty_levels_controller.rb

@@ -1,9 +1,10 @@
 module Admin
   class DifficultyLevelsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    authorize_resource through: :conference
 
     def index
-      @conference = Conference.find_by(short_title: params[:conference_id])
+      authorize! :index, DifficultyLevel.new(conference_id: @conference.id)
     end
 
     def update
@@ -13,18 +14,18 @@ module Admin
             @conference.use_difficulty_levels = false
             @conference.save!
             flash[:error] = "You cannot enable the usage of difficulty levels without having set any levels."
-            redirect_to(admin_conference_difficulty_levels_path(conference_id: @conference.short_title))
+            redirect_to(admin_conference_difficulty_levels_path(:conference_id => @conference.short_title))
           rescue ActiveRecord::RecordInvalid
             flash[:error] = "Something went wrong. Difficulty Levels update failed."
-            redirect_to(admin_conference_difficulty_levels_path(conference_id: @conference.short_title))
+            redirect_to(admin_conference_difficulty_levels_path(:conference_id => @conference.short_title))
           end
         else
           flash[:notice] = "Difficulty Levels were successfully updated."
-          redirect_to(admin_conference_difficulty_levels_path(conference_id: @conference.short_title))
+          redirect_to(admin_conference_difficulty_levels_path(:conference_id => @conference.short_title))
         end
       else
         flash[:error] = "Difficulty Levels update failed."
-        redirect_to(admin_conference_difficulty_levels_path(conference_id: @conference.short_title))
+        redirect_to(admin_conference_difficulty_levels_path(:conference_id => @conference.short_title))
       end
     end
   end

app/controllers/admin/emails_controller.rb

@@ -1,6 +1,7 @@
 module Admin
   class EmailsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    load_and_authorize_resource class: EmailSettings
 
     def update
       @conference.email_settings.update_attributes(params[:email_settings])
@@ -10,6 +11,7 @@ module Admin
     end
 
     def index
+      authorize! :index, @conference.email_settings
       @settings = @conference.email_settings
     end
   end

app/controllers/admin/event_types_controller.rb

@@ -0,0 +1,25 @@
+module Admin
+  class EventTypesController < ApplicationController
+    load_and_authorize_resource :conference, find_by: :short_title
+    authorize_resource :event_type, through: :conference
+
+    def index
+      authorize! :index, EventType.new(conference_id: @conference.id)
+    end
+
+    def show
+      render :eventtypes
+    end
+
+    def update
+      @conference.update_attributes!(params[:conference])
+      redirect_to(admin_conference_event_types_path(
+                  conference_id: @conference.short_title),
+                  notice: 'Event types were successfully updated.')
+    rescue Exception => e
+      redirect_to(admin_conference_event_types_path(
+                  conference_id: @conference.short_title),
+                  alert: "Event types update failed: #{e.message}")
+    end
+  end
+end

app/controllers/admin/events_controller.rb

@@ -1,6 +1,7 @@
 module Admin
   class EventsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    load_and_authorize_resource :event, through: :conference
 
     before_action :get_event, except: [:index, :create]
 
@@ -13,6 +14,8 @@ module Admin
     end
 
     def index
+      authorize! :index, @conference.events.build
+      @conference = Conference.find_by(short_title: params[:conference_id])
       @events = @conference.events
       @tracks = @conference.tracks
       @machine_states = @events.state_machine.states.map

app/controllers/admin/lodgings_controller.rb

@@ -1,16 +1,17 @@
 module Admin
   class LodgingsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    load_and_authorize_resource :venue, through: :conference, singleton: true
+    authorize_resource :lodging, through: :venue
 
     def index
-      @venue = @conference.venue
+      authorize! :update, Lodging.new(venue_id: @venue.id)
     end
 
     def show
     end
 
     def update
-      @venue = @conference.venue
       if @venue.update_attributes(params[:venue])
         redirect_to(admin_conference_lodgings_path(conference_id: @conference.short_title),
                     notice: 'Lodgings were successfully updated.')

app/controllers/admin/questions_controller.rb

@@ -1,23 +1,24 @@
 module Admin
   class QuestionsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    load_and_authorize_resource through: :conference, except: [:new, :create]
 
     def index
-      @conference = Conference.find_by(short_title: params[:conference_id])
-      @questions = Question.where(global: true).all | Question.where(conference_id: @conference.id)
+      authorize! :update, Question.new(conference_id: @conference.id)
+      @questions = Question.where(:global => true).all | Question.where(:conference_id => @conference.id)
       @questions_conference = @conference.questions
       @new_question = @conference.questions.new
     end
 
     def new
-      @conference = Conference.find_by(short_title: params[:conference_id])
-      @new_question = @conference.questions.new
+      @question = Question.new(conference_id: @conference.id)
+      authorize! :create, @question
     end
 
     def create
-      @conference = Conference.find_by(short_title: params[:conference_id])
       @question = @conference.questions.new(params[:question])
       @question.conference_id = @conference.id
+      authorize! :create, @question
 
       respond_to do |format|
         if @conference.save
@@ -31,42 +32,33 @@ module Admin
 
     # GET questions/1/edit
     def edit
-      @conference = Conference.find_by(short_title: params[:conference_id])
-      @question = Question.find(params[:id])
-
-      if @question.global == true && !has_role?(current_user, "Admin")
-        redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), alert: "Sorry, you cannot edit global questions. Create a new one.")
+      if @question.global == true && !(current_user.has_role? :organizer, @conference)
+        redirect_to(admin_conference_questions_path(:conference_id => @conference.short_title), :alert => "Sorry, you cannot edit global questions. Create a new one.")
       end
     end
 
     # PUT questions/1
     def update
-      @conference = Conference.find_by(short_title: params[:conference_id])
-      @question = Question.find(params[:id])
-
       if @question.update_attributes(params[:question])
-        redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Question '#{@question.title}' for #{@conference.short_title} successfully updated.")
+        redirect_to(admin_conference_questions_path(:conference_id => @conference.short_title), :notice => "Question '#{@question.title}' for #{@conference.short_title} successfully updated.")
       else
-        redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Update of questions for #{@conference.short_title} failed.")
+        redirect_to(admin_conference_questions_path(:conference_id => @conference.short_title), :notice => "Update of questions for #{@conference.short_title} failed.")
       end
     end
 
     # Update questions used for the conference
     def update_conference
-      @conference = Conference.find_by(short_title: params[:conference_id])
-
       if @conference.update_attributes(params[:conference])
-        redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Questions for #{@conference.short_title} successfully updated.")
+        redirect_to(admin_conference_questions_path(:conference_id => @conference.short_title), :notice => "Questions for #{@conference.short_title} successfully updated.")
       else
-        redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Update of questions for #{@conference.short_title} failed.")
+        redirect_to(admin_conference_questions_path(:conference_id => @conference.short_title), :notice => "Update of questions for #{@conference.short_title} failed.")
       end
     end
 
     # DELETE questions/1
     def destroy
-      if has_role?(current_user, "Admin")
-        @question = Question.find(params[:id])
 
+      if can? :destroy, @question
         # Do not delete global questions
         if @question.global == false
 
@@ -74,12 +66,12 @@ module Admin
           begin
             Question.transaction do
 
-              @question.delete
+              @question.destroy
               @question.answers.each do |a|
                 a.delete
               end
               flash[:notice] = "Deleted question: #{@question.title} and its answers: #{@question.answers.map {|a| a.title}.join ','}"
-            end
+          end
           rescue ActiveRecord::RecordInvalid
             flash[:error] = "Could not delete question."
           end
@@ -90,7 +82,7 @@ module Admin
         flash[:error] = "You must be an admin to delete a question."
       end
 
-      @questions = Question.where(global: true).all | Question.where(conference_id: @conference.id)
+      @questions = Question.where(:global => true).all | Question.where(:conference_id => @conference.id)
       @questions_conference = @conference.questions
     end
   end

app/controllers/admin/registrations_controller.rb

@@ -1,8 +1,10 @@
 module Admin
   class RegistrationsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    load_and_authorize_resource through: :conference
 
     def index
+      authorize! :show, Registration.new(conference_id: @conference.id)
       session[:return_to] ||= request.referer
       @pdf_filename = "#{@conference.title}.pdf"
       @registrations = @conference.registrations.includes(:user)
@@ -12,7 +14,6 @@ module Admin
     end
 
     def change_field
-      @registration = Registration.find(params[:id])
       field = params[:view_field]
       if @registration.send(field.to_sym)
         @registration.update_attribute(:"#{field}", 0)
@@ -26,12 +27,10 @@ module Admin
     end
 
     def edit
-      @registration = @conference.registrations.where('id = ?', params[:id]).first
       @user = User.where('id = ?', @registration.user_id).first
     end
 
     def update
-      @registration = @conference.registrations.where('id = ?', params[:id]).first
       @user = User.where('id = ?', @registration.user_id).first
       begin
         @user.update_attributes!(params[:registration][:user_attributes])
@@ -55,6 +54,7 @@ module Admin
     def new
       @user = User.new
       @registration = @user.registrations.new
+      @registration.conference_id = @conference.id
       @supporter_registration = @conference.supporter_registrations.new
     end
 
@@ -97,7 +97,7 @@ module Admin
     end
 
     def destroy
-      if has_role?(current_user, 'Admin')
+      if can? :destroy, @registration
         registration = @conference.registrations.where(id: params[:id]).first
         user = User.where('id = ?', registration.user_id).first
 

app/controllers/admin/rooms_controller.rb

@@ -1,6 +1,11 @@
 module Admin
   class RoomsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    authorize_resource through: :conference
+
+    def index
+      authorize! :index, Room.new(conference_id: @conference.id)
+    end
 
     def show
       render :rooms_list

app/controllers/admin/schedules_controller.rb

@@ -1,10 +1,14 @@
 module Admin
   class SchedulesController < ApplicationController
-    before_filter :verify_organizer
+    # By authorizing 'conference' resource, we can ensure there will be no unauthorized access to
+    # the schedule of a conference, which should not be accessed in the first place
+    load_and_authorize_resource :conference, find_by: :short_title
+
     skip_before_filter :verify_authenticity_token, only: [:update]
     layout 'schedule'
 
     def show
+      authorize! :update, @conference.events.new
       if @conference.nil?
         redirect_to admin_conference_index_path
         return
@@ -14,6 +18,7 @@ module Admin
     end
 
     def update
+      authorize! :update, @conference.events.new
       event = Event.where(guid: params[:event]).first
       error_message = nil
       if event.nil?

app/controllers/admin/social_events_controller.rb

@@ -1,6 +1,7 @@
 module Admin
   class SocialEventsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    authorize_resource :social_event, through: :conference
 
     def show
       render :social_events_list
@@ -8,9 +9,9 @@ module Admin
 
     def update
       if @conference.update_attributes(params[:conference])
-        redirect_to(admin_conference_social_events_path(conference_id: @conference.short_title), notice: 'Social events were successfully updated.')
+        redirect_to(admin_conference_social_events_path(:conference_id => @conference.short_title), :notice => 'Social events were successfully updated.')
       else
-        redirect_to(admin_conference_social_events_path(conference_id: @conference.short_title), notice: 'Social events update failed.')
+        redirect_to(admin_conference_social_events_path(:conference_id => @conference.short_title), :notice => 'Social events update failed.')
       end
     end
   end

app/controllers/admin/speakers_controller.rb

@@ -1,15 +1,17 @@
 module Admin
   class SpeakersController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    load_and_authorize_resource :event
+
     respond_to :js, :html
 
     def edit
-      @event = @conference.events.find(params[:event_id])
+      authorize! :update, @conference.events.new
       @speaker = @event.event_users.where(event_role: 'speaker').first
     end
 
     def update
-      @event = @conference.events.find(params[:event_id])
+      authorize! :update, @conference.events.new
       @speaker = @event.event_users.where(event_role: 'speaker').first
       @speaker.user_id = params[:speaker][:user_id]
       @speaker.save

app/controllers/admin/sponsors_controller.rb

@@ -1,6 +1,11 @@
 module Admin
   class SponsorsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    authorize_resource :sponsor, through: :conference
+
+    def index
+      authorize! :index, Sponsor.new(conference_id: @conference.id)
+    end
 
     def update
       if @conference.update_attributes(params[:conference])

app/controllers/admin/sponsorship_levels_controller.rb

@@ -1,6 +1,11 @@
 module Admin
   class SponsorshipLevelsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    authorize_resource through: :conference
+
+    def index
+      authorize! :index, SponsorshipLevel.new(conference_id: @conference.id)
+    end
 
     def update
       if @conference.update_attributes(params[:conference])

app/controllers/admin/stats_controller.rb

@@ -1,6 +1,7 @@
 module Admin
   class StatsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource
+    load_and_authorize_resource :conference, find_by: :short_title
 
     def index
       @registrations = @conference.registrations.includes(:user)

app/controllers/admin/supporter_levels_controller.rb

@@ -1,6 +1,11 @@
 module Admin
   class SupporterLevelsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    authorize_resource through: :conference
+
+    def index
+      authorize! :update, SupporterLevel.new(conference_id: @conference.id)
+    end
 
     def show
       render :supporter_levels

app/controllers/admin/supporters_controller.rb

@@ -1,6 +1,7 @@
 module Admin
   class SupportersController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    load_and_authorize_resource through: :conference
 
     def index
       respond_to do |format|

app/controllers/admin/targets_controller.rb

@@ -1,11 +1,15 @@
 module Admin
   class TargetsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    authorize_resource through: :conference
 
     def index
+      authorize! :index, Target.new(conference_id: @conference.id)
     end
 
     def update
+      authorize! :update, @conference => Target
+
       if @conference.update_attributes(params[:conference])
         redirect_to(admin_conference_targets_path(
                     conference_id: @conference.short_title),

app/controllers/admin/tracks_controller.rb

@@ -1,6 +1,11 @@
 module Admin
   class TracksController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    authorize_resource through: :conference
+
+    def index
+      authorize! :index, Track.new(conference_id: @conference.id)
+    end
 
     def show
       respond_to do |format|

app/controllers/admin/users_controller.rb

@@ -1,6 +1,7 @@
 module Admin
   class UsersController < ApplicationController
-    before_filter :verify_admin
+    load_and_authorize_resource
+
     def new
       @user = User.new
     end
@@ -10,34 +11,37 @@ module Admin
     end
 
     def show
-      @user = User.find(params[:id])
-
       # Variable @show_attributes holds the attributes that are visible for the 'show' action
       # If you want to change the attributes that are shown in the 'show' action of users
       # add/remove the attributes in the following string array
-      @show_attributes = %w(name email affiliation biography registered attended created_at
+      @show_attributes = %w(name email affiliation biography registered attended roles created_at
                             updated_at sign_in_count current_sign_in_at last_sign_in_at
                             current_sign_in_ip last_sign_in_ip)
     end
 
     def update
-      user = User.find(params[:id])
-      user.update_attributes!(params[:user])
-      redirect_to admin_users_path, notice: "Updated #{user.email}"
+      params[:user].delete :roles_attributes if params[:user]
+      @user.update_attributes!(params[:user])
+      redirect_to admin_users_path, notice: "Updated #{@user.email}"
+    end
+
+    def add_role
+      role = params[:user][:roles_attributes][:"0"]
+      @user.add_role role['name'].parameterize.underscore.to_sym, Conference.find(role['resource_id'])
+
+      respond_to do |format|
+        format.html
+        format.js
+      end
+
     end
 
     def edit
-      @user = User.find(params[:id])
-    end
-
-    def delete
-      @user = User.find(params[:id])
     end
 
     def destroy
-      @user = User.find(params[:id])
       @user.destroy
-      redirect_to admin_users_path, notice: 'User got deleted'
+      redirect_to admin_users_path, notice: "User #{@user.name} (#{@user.email})got deleted"
     end
   end
 end

app/controllers/admin/venue_controller.rb

@@ -1,6 +1,7 @@
 module Admin
   class VenueController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    load_and_authorize_resource :venue, through: :conference, singleton: true
 
     def index
     end

app/controllers/admin/volunteers_controller.rb

@@ -1,26 +1,37 @@
 module Admin
   class VolunteersController < ApplicationController
+    load_and_authorize_resource :conference, find_by: :short_title
+
     def index
-      @conference = Conference.find_by(short_title: params[:conference_id])
-      render :index
+      if (current_user.has_role? :organizer, @conference) || (current_user.has_role? :volunteer_coordinator, @conference)
+        render :index
+      else
+        authorize! :index, :volunteer
+      end
     end
 
     def show
-      @conference = Conference.find_by(short_title: params[:conference_id])
-      if @conference.use_vpositions
-        @volunteers = @conference.registrations.joins(:vchoices).uniq
+      if (current_user.has_role? :organizer, @conference) || (current_user.has_role? :volunteer_coordinator, @conference)
+        if @conference.use_vpositions
+          @volunteers = @conference.registrations.joins(:vchoices).uniq
+        else
+          @volunteers = @conference.registrations.where(:volunteer => true)
+        end
       else
-        @volunteers = @conference.registrations.where(volunteer: true)
+        authorize! :index, :volunteer
       end
     end
 
     def update
-      @conference = Conference.find_by(short_title: params[:conference_id])
-      begin
-        @conference.update_attributes!(params[:conference])
-        redirect_to(admin_conference_volunteers_info_path(conference_id: params[:conference_id]), notice: "Volunteering options were successfully updated.")
-      rescue => e
-        redirect_to(admin_conference_volunteers_info_path(conference_id: params[:conference_id]), alert: "Volunteering options update failed: #{e.message}")
+      if (current_user.has_role? :organizer, @conference) || (current_user.has_role? :volunteer_coordinator, @conference)
+        begin
+          @conference.update_attributes!(params[:conference])
+          redirect_to(admin_conference_volunteers_info_path(:conference_id => params[:conference_id]), :notice => "Volunteering options were successfully updated.")
+        rescue Exception => e
+          redirect_to(admin_conference_volunteers_info_path(:conference_id => params[:conference_id]), :alert => "Volunteering options update failed: #{e.message}")
+        end
+      else
+        authorize! :index, :volunteer
       end
     end
   end