8c8c99eb2c
We were using `authorize_resource`, passing it an unnamed parameter. When that happens, CanCanCan only checks permissions to read that resource. But, in this case, we want to check the permission to update that resource before the `update` action. Most of the time, it doesn't really matter, but, for example, in our demo we're going to restrict the locales configuration so locales cannot be updated on the main tenant (but they can be updated on other tenants).
28 lines
635 B
Ruby
28 lines
635 B
Ruby
class Admin::LocalesController < Admin::BaseController
|
|
before_action :set_locales_settings
|
|
authorize_resource instance_name: :locales_settings, class: "Setting::LocalesSettings"
|
|
|
|
def show
|
|
end
|
|
|
|
def update
|
|
@locales_settings.update!(locales_settings_params)
|
|
|
|
redirect_to admin_locales_path, notice: t("admin.locales.update.notice")
|
|
end
|
|
|
|
private
|
|
|
|
def locales_settings_params
|
|
params.require(:setting_locales_settings).permit(allowed_params)
|
|
end
|
|
|
|
def allowed_params
|
|
[:default, enabled: []]
|
|
end
|
|
|
|
def set_locales_settings
|
|
@locales_settings = Setting::LocalesSettings.new
|
|
end
|
|
end
|