From e851c0b4ff7db6be992727e63bd281075521b158 Mon Sep 17 00:00:00 2001 From: Aditya Prakash Date: Thu, 24 Mar 2016 17:42:00 +0530 Subject: [PATCH] Add authorization rule for create user by unsigned user Add authorization to failed user save path cause it was complaining that no authorization was performed in that path. --- app/controllers/proposal_controller.rb | 1 + app/models/ability.rb | 2 +- spec/models/ability_spec.rb | 1 + 3 files changed, 3 insertions(+), 1 deletion(-) diff --git a/app/controllers/proposal_controller.rb b/app/controllers/proposal_controller.rb index 9bfca93c..b0678150 100644 --- a/app/controllers/proposal_controller.rb +++ b/app/controllers/proposal_controller.rb @@ -34,6 +34,7 @@ class ProposalController < ApplicationController # If user is not signed in then first create new user and then sign them in unless current_user @user = User.new(user_params) + authorize! :create, @user if @user.save sign_in(@user) else diff --git a/app/models/ability.rb b/app/models/ability.rb index 68f4ad8a..5a520afa 100644 --- a/app/models/ability.rb +++ b/app/models/ability.rb @@ -44,7 +44,7 @@ class Ability # can view Commercials of confirmed Events can :show, Commercial, commercialable_type: 'Event', commercialable_id: Event.where(state: 'confirmed').pluck(:id) - can :show, User + can [:show, :create], User unless CONFIG['authentication']['ichain']['enabled'] can [:show, :create], Registration do |registration| registration.new_record? diff --git a/spec/models/ability_spec.rb b/spec/models/ability_spec.rb index a4a8ace6..fedff97d 100644 --- a/spec/models/ability_spec.rb +++ b/spec/models/ability_spec.rb @@ -56,6 +56,7 @@ describe 'User' do it{ should_not be_able_to(:show, commercial_event_unconfirmed)} it{ should be_able_to(:show, User)} + it{ should be_able_to(:create, User)} it{ should be_able_to(:create, Registration)} it{ should be_able_to(:show, Registration.new)}