summaryrefslogtreecommitdiff
path: root/users/app/controllers
diff options
context:
space:
mode:
authorAzul <azul@leap.se>2013-01-18 07:44:57 +0100
committerAzul <azul@leap.se>2013-01-18 07:44:57 +0100
commit27730c7e665ed64e691fdf6dbeebc39c8bfbbc4b (patch)
treecd1df0a9a7d3f0a9812b512cfb93db0f79b0421f /users/app/controllers
parent247a6f14db14543773beb1a1e96f2c335800eb82 (diff)
parent19d563e2e2db98ecc5143229f554df6a09bc457e (diff)
Merge remote-tracking branch 'origin/master' into feature/fixed-email-address
Conflicts: users/app/views/emails/_email.html.haml
Diffstat (limited to 'users/app/controllers')
-rw-r--r--users/app/controllers/users_controller.rb9
1 files changed, 8 insertions, 1 deletions
diff --git a/users/app/controllers/users_controller.rb b/users/app/controllers/users_controller.rb
index 75ae2da..6cb438b 100644
--- a/users/app/controllers/users_controller.rb
+++ b/users/app/controllers/users_controller.rb
@@ -2,7 +2,9 @@ class UsersController < ApplicationController
skip_before_filter :verify_authenticity_token, :only => [:create]
- before_filter :fetch_user, :only => [:edit, :update, :destroy]
+
+ before_filter :authorize, :only => [:show, :edit, :update, :destroy]
+ before_filter :fetch_user, :only => [:show, :edit, :update, :destroy]
before_filter :set_anchor, :only => [:edit, :update]
before_filter :authorize_admin, :only => [:index]
@@ -49,7 +51,12 @@ class UsersController < ApplicationController
protected
def fetch_user
+ # authorize filter has been checked first, so won't get here unless authenticated
@user = User.find_by_param(params[:id])
+ if !@user and admin?
+ redirect_to users_path, :alert => t(:no_such_thing, :thing => 'user')
+ return
+ end
access_denied unless admin? or (@user == current_user)
end