gunghogeoduck/osem-fcy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Don't allow not_signed_in user to view private schedule

Browse source 
Fix bug i.e private schedule is viewable to not_signed_in user in the PR #1352 by fixing load_and_authorize of schedule in schedules_controller
This commit is contained in:
Chaitanya 2017-04-19 19:49:22 +05:30
parent be33f345a1
commit f4fdccd590
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
app/controllers/schedules_controller.rb
View file

@ -1,9 +1,9 @@
class SchedulesController < ApplicationController class SchedulesController < ApplicationController
load_and_authorize_resource
protect_from_forgery with: :null_session protect_from_forgery with: :null_session
before_action :respond_to_options before_action :respond_to_options
load_resource :conference, find_by: :short_title load_resource :conference, find_by: :short_title
load_resource :program, through: :conference, singleton: true, except: :index load_resource :program, through: :conference, singleton: true, except: :index
load_and_authorize_resource :selected_schedule, through: :program, singleton: true
def show def show
@rooms = @conference.venue.rooms if @conference.venue @rooms = @conference.venue.rooms if @conference.venue