Add cancan authorization in all main urls

2015-08-10 14:59:42 +02:00
parent a9a4f4fb81
commit 30e738a2fe
4 changed files with 6 additions and 1 deletions
--- a/app/controllers/admin/base_controller.rb
+++ b/app/controllers/admin/base_controller.rb
@@ -1,5 +1,6 @@
 class Admin::BaseController < ApplicationController

+  skip_authorization_check
  before_filter :verify_administrator

  private
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -1,6 +1,9 @@
 require "application_responder"

 class ApplicationController < ActionController::Base
+
+  check_authorization unless: :devise_controller?
+
  self.responder = ApplicationResponder
  respond_to :html

--- a/app/controllers/moderation/base_controller.rb
+++ b/app/controllers/moderation/base_controller.rb
@@ -1,5 +1,6 @@
 class Moderation::BaseController < ApplicationController

+  skip_authorization_check
  before_filter :verify_moderator

  private
--- a/app/models/ability.rb
+++ b/app/models/ability.rb
@@ -7,7 +7,7 @@ class Ability

    if user # logged-in users
      can [:read, :create, :vote], Debate
-      can :edit, Debate do |debate|
+      can :update, Debate do |debate|
        debate.editable_by?(user)
      end