summaryrefslogtreecommitdiff
path: root/users/app/controllers/users_controller.rb
diff options
context:
space:
mode:
authorazul <azul@riseup.net>2013-01-17 22:42:47 -0800
committerazul <azul@riseup.net>2013-01-17 22:42:47 -0800
commit19d563e2e2db98ecc5143229f554df6a09bc457e (patch)
tree954e7c9a1865150a0cf4d08842d1365b75259d57 /users/app/controllers/users_controller.rb
parentc172c91d8041fbf85ec6b0054c30f31d41a1008b (diff)
parent444dbca4054ccfb7a82bb4df2a6369959ef6c9b2 (diff)
Merge pull request #17 from leapcode/feature/tickets_controllers_simplification
Refactoring of tickets controller to fetch the ticket in a before filter...
Diffstat (limited to 'users/app/controllers/users_controller.rb')
-rw-r--r--users/app/controllers/users_controller.rb7
1 files changed, 7 insertions, 0 deletions
diff --git a/users/app/controllers/users_controller.rb b/users/app/controllers/users_controller.rb
index eb93fcb..c0fe243 100644
--- a/users/app/controllers/users_controller.rb
+++ b/users/app/controllers/users_controller.rb
@@ -2,6 +2,8 @@ class UsersController < ApplicationController
skip_before_filter :verify_authenticity_token, :only => [:create]
+
+ before_filter :authorize, :only => [:show, :edit, :update, :destroy]
before_filter :fetch_user, :only => [:show, :edit, :update, :destroy]
before_filter :set_anchor, :only => [:edit, :update]
before_filter :authorize_admin, :only => [:index]
@@ -48,7 +50,12 @@ class UsersController < ApplicationController
protected
def fetch_user
+ # authorize filter has been checked first, so won't get here unless authenticated
@user = User.find_by_param(params[:id])
+ if !@user and admin?
+ redirect_to users_path, :alert => t(:no_such_thing, :thing => 'user')
+ return
+ end
access_denied unless admin? or (@user == current_user)
end