summaryrefslogtreecommitdiff
path: root/users/app/controllers
diff options
context:
space:
mode:
authorjessib <jessib@leap.se>2013-02-25 14:02:28 -0800
committerjessib <jessib@leap.se>2013-02-25 14:02:28 -0800
commit73e9332dadde9f37a85753faf40b9b6b2d73dd88 (patch)
tree9d500a5f85438fad268d53f7900b1623d77aac31 /users/app/controllers
parentbace229e4d1cf593eaef80b8e8553d9d33c40c50 (diff)
Admins cannot update a user. Eventually we will want to allow admins to update some user fields.
Diffstat (limited to 'users/app/controllers')
-rw-r--r--users/app/controllers/users_controller.rb8
1 files changed, 7 insertions, 1 deletions
diff --git a/users/app/controllers/users_controller.rb b/users/app/controllers/users_controller.rb
index 9325bc0..dff1ed5 100644
--- a/users/app/controllers/users_controller.rb
+++ b/users/app/controllers/users_controller.rb
@@ -1,7 +1,8 @@
class UsersController < ApplicationController
- before_filter :authorize, :only => [:show, :edit, :update, :destroy]
+ before_filter :authorize, :only => [:show, :edit, :destroy, :update]
before_filter :fetch_user, :only => [:show, :edit, :update, :destroy]
+ before_filter :authorize_self, :only => [:update]
before_filter :set_anchor, :only => [:edit, :update]
before_filter :authorize_admin, :only => [:index]
@@ -57,6 +58,11 @@ class UsersController < ApplicationController
access_denied unless admin? or (@user == current_user)
end
+ def authorize_self
+ # have already checked that authorized
+ access_denied unless (@user == current_user)
+ end
+
def set_anchor
@anchor = email_settings? ? :email : :account
end