summaryrefslogtreecommitdiff
path: root/engines/support/app/controllers
diff options
context:
space:
mode:
authorazul <azul@riseup.net>2014-04-25 12:15:37 +0200
committerazul <azul@riseup.net>2014-04-25 12:15:37 +0200
commit76ad25ba0ee344f185f8e8cdfe066685cd3b0447 (patch)
treed8122b5b5144c917f5e1924c1428a3a871e94149 /engines/support/app/controllers
parent2b6200f508ddb8e1c8a76fd3778881c39d787d8d (diff)
parentbe81b7430e0a2046125be7c3a4b01b8725f4afe6 (diff)
Merge pull request #148 from azul/feature/api-quota-support
Feature/api quota support + current_user null pattern
Diffstat (limited to 'engines/support/app/controllers')
-rw-r--r--engines/support/app/controllers/tickets_controller.rb36
1 files changed, 23 insertions, 13 deletions
diff --git a/engines/support/app/controllers/tickets_controller.rb b/engines/support/app/controllers/tickets_controller.rb
index 4be3493..650f628 100644
--- a/engines/support/app/controllers/tickets_controller.rb
+++ b/engines/support/app/controllers/tickets_controller.rb
@@ -5,7 +5,8 @@ class TicketsController < ApplicationController
#has_scope :open, :type => boolean
before_filter :require_login, :only => [:index]
- before_filter :fetch_ticket, :only => [:show, :update, :destroy] # don't now have an edit method
+ before_filter :fetch_ticket, :only => [:show, :update, :destroy]
+ before_filter :require_ticket_access, :only => [:show, :update, :destroy]
before_filter :fetch_user
before_filter :set_title
@@ -17,11 +18,11 @@ class TicketsController < ApplicationController
def create
@ticket = Ticket.new(params[:ticket])
- @ticket.comments.last.posted_by = (logged_in? ? current_user.id : nil) #protecting posted_by isn't working, so this should protect it.
+ #protecting posted_by isn't working, so this should protect it:
+ @ticket.comments.last.posted_by = current_user.id
@ticket.comments.last.private = false unless admin?
- @ticket.created_by = current_user.id if logged_in?
- @ticket.email = current_user.email_address if logged_in? and current_user.email_address
-
+ @ticket.created_by = current_user.id
+ @ticket.email = current_user.email_address if current_user.email_address
if @ticket.save
flash[:notice] = t(:thing_was_successfully_created, :thing => t(:ticket))
@@ -58,7 +59,7 @@ class TicketsController < ApplicationController
end
if @ticket.comments_changed?
- @ticket.comments.last.posted_by = (current_user ? current_user.id : nil)
+ @ticket.comments.last.posted_by = current_user.id
@ticket.comments.last.private = false unless admin?
end
@@ -120,19 +121,28 @@ class TicketsController < ApplicationController
return ticket
end
- def ticket_access?
- @ticket and (admin? or !@ticket.created_by or (current_user and current_user.id == @ticket.created_by))
- end
-
def fetch_ticket
@ticket = Ticket.find(params[:id])
- if !@ticket and admin?
- redirect_to auto_tickets_path, :alert => t(:no_such_thing, :thing => 'ticket')
- return
+ if !@ticket
+ if admin?
+ redirect_to auto_tickets_path,
+ alert: t(:no_such_thing, thing: 'ticket')
+ else
+ access_denied
+ end
end
+ end
+
+ def require_ticket_access
access_denied unless ticket_access?
end
+ def ticket_access?
+ admin? or
+ @ticket.created_by.blank? or
+ current_user.id == @ticket.created_by
+ end
+
def fetch_user
if params[:user_id]
@user = User.find(params[:user_id])