From 73e9332dadde9f37a85753faf40b9b6b2d73dd88 Mon Sep 17 00:00:00 2001 From: jessib Date: Mon, 25 Feb 2013 14:02:28 -0800 Subject: Admins cannot update a user. Eventually we will want to allow admins to update some user fields. --- users/app/controllers/users_controller.rb | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'users/app/controllers/users_controller.rb') diff --git a/users/app/controllers/users_controller.rb b/users/app/controllers/users_controller.rb index 9325bc0..dff1ed5 100644 --- a/users/app/controllers/users_controller.rb +++ b/users/app/controllers/users_controller.rb @@ -1,7 +1,8 @@ class UsersController < ApplicationController - before_filter :authorize, :only => [:show, :edit, :update, :destroy] + before_filter :authorize, :only => [:show, :edit, :destroy, :update] before_filter :fetch_user, :only => [:show, :edit, :update, :destroy] + before_filter :authorize_self, :only => [:update] before_filter :set_anchor, :only => [:edit, :update] before_filter :authorize_admin, :only => [:index] @@ -57,6 +58,11 @@ class UsersController < ApplicationController access_denied unless admin? or (@user == current_user) end + def authorize_self + # have already checked that authorized + access_denied unless (@user == current_user) + end + def set_anchor @anchor = email_settings? ? :email : :account end -- cgit v1.2.3