Foodsoft/foodsoft
1
1
Fork 0
Code Issues 36 Pull requests 5 Projects 1 Releases Wiki Activity

fix invite authentication

Browse source
This commit is contained in:
wvengen 2013-12-22 14:20:25 +01:00
parent cee96915f9
commit 7ef6832ab3
2 changed files with 10 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
app/controllers/application_controller.rb
View file

@ -80,8 +80,8 @@ class ApplicationController < ActionController::Base
# checks if the current_user is member of given group. # checks if the current_user is member of given group.
# if fails the user will redirected to startpage # if fails the user will redirected to startpage
def authenticate_membership_or_admin def authenticate_membership_or_admin(group_id = params[:id])
@group = Group.find(params[:id]) @group = Group.find(group_id)
unless @group.member?(@current_user) or @current_user.role_admin? unless @group.member?(@current_user) or @current_user.role_admin?
redirect_to root_path, alert: I18n.t('application.controller.error_members_only') redirect_to root_path, alert: I18n.t('application.controller.error_members_only')
end end

10
app/controllers/invites_controller.rb
View file

@ -1,13 +1,13 @@
class InvitesController < ApplicationController class InvitesController < ApplicationController
before_filter :authenticate_membership_or_admin, :only => [:new] before_filter :authenticate_membership_or_admin_for_invites
#TODO: authorize also for create action.
def new def new
@invite = Invite.new(:user => @current_user, :group => @group) @invite = Invite.new(:user => @current_user, :group => @group)
end end
def create def create
authenticate_membership_or_admin params[:invite][:group_id]
@invite = Invite.new(params[:invite]) @invite = Invite.new(params[:invite])
if @invite.save if @invite.save
Mailer.invite(@invite).deliver Mailer.invite(@invite).deliver
@ -23,4 +23,10 @@ class InvitesController < ApplicationController
render action: :new render action: :new
end end
end end
protected
def authenticate_membership_or_admin_for_invites
authenticate_membership_or_admin((params[:invite][:group_id] rescue params[:id]))
end
end end