consul/nairobi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

users can view their own spending proposals

Browse Source
This commit is contained in:
rgarcia
2016-02-21 14:28:48 +01:00
parent 575b0e105f
commit 2291caa3fd
2 changed files with 30 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
app/controllers/spending_proposals_controller.rb
View File

@@ -1,11 +1,11 @@
class SpendingProposalsController < ApplicationController
include FeatureFlags
before_action :authenticate_user!, except: [:index]
before_action :verify_valuator, only: [:show]
load_and_authorize_resource
before_action :authenticate_user!, except: [:index]
before_action :verify_access, only: [:show]
feature_flag :spending_proposals
def index
@@ -20,7 +20,7 @@ class SpendingProposalsController < ApplicationController
@spending_proposal.author = current_user
if @spending_proposal.save_with_captcha
redirect_to spending_proposals_path, notice: t("flash.actions.create.spending_proposal")
redirect_to @spending_proposal, notice: t("flash.actions.create.spending_proposal")
else
render :new
end
@@ -32,8 +32,8 @@ class SpendingProposalsController < ApplicationController
params.require(:spending_proposal).permit(:title, :description, :external_url, :geozone_id, :association_name, :terms_of_service, :captcha, :captcha_key)
end
def verify_valuator
raise CanCan::AccessDenied unless current_user.try(:valuator?) || current_user.try(:administrator?)
def verify_access
raise CanCan::AccessDenied unless current_user.try(:valuator?) || current_user.try(:administrator?) || @spending_proposal.author == current_user
end
end