Foodsoft/foodsoft
1
1
Fork 0
Code Issues 36 Pull requests 5 Projects 1 Releases Wiki Activity

Add missing authorization for InvoicesController

Browse source
This commit is contained in:
Patrick Gansterer 2020-04-11 00:04:35 +02:00
parent 3b79c05ffe
commit a3946ed3d4
2 changed files with 16 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
app/controllers/concerns/auth.rb
View file

@ -62,6 +62,7 @@ module Concerns::Auth
when 'pickups' then current_user.role_pickups? when 'pickups' then current_user.role_pickups?
when 'suppliers' then current_user.role_suppliers? when 'suppliers' then current_user.role_suppliers?
when 'orders' then current_user.role_orders? when 'orders' then current_user.role_orders?
when 'finance_or_invoices' then (current_user.role_finance? || current_user.role_invoices?)
when 'finance_or_orders' then (current_user.role_finance? || current_user.role_orders?) when 'finance_or_orders' then (current_user.role_finance? || current_user.role_orders?)
when 'pickups_or_orders' then (current_user.role_pickups? || current_user.role_orders?) when 'pickups_or_orders' then (current_user.role_pickups? || current_user.role_orders?)
when 'any' then true # no role required when 'any' then true # no role required
@ -99,6 +100,10 @@ module Concerns::Auth
authenticate('orders') authenticate('orders')
end end
def authenticate_finance_or_invoices
authenticate('finance_or_invoices')
end
def authenticate_finance_or_orders def authenticate_finance_or_orders
authenticate('finance_or_orders') authenticate('finance_or_orders')
end end

1
app/controllers/finance/invoices_controller.rb
View file

@ -1,4 +1,5 @@
class Finance::InvoicesController < ApplicationController class Finance::InvoicesController < ApplicationController
before_action :authenticate_finance_or_invoices
before_action :find_invoice, only: [:show, :edit, :update, :destroy] before_action :find_invoice, only: [:show, :edit, :update, :destroy]
before_action :ensure_can_edit, only: [:edit, :update, :destroy] before_action :ensure_can_edit, only: [:edit, :update, :destroy]