From dc16c6f8e5382f9e5470eb2a40081d41f4112437 Mon Sep 17 00:00:00 2001 From: jessib Date: Thu, 17 Jan 2013 11:25:39 -0800 Subject: Deal with corner case where we don't have authenticated user. Will write a test after merging in show view for users. --- users/app/controllers/users_controller.rb | 2 ++ 1 file changed, 2 insertions(+) (limited to 'users') diff --git a/users/app/controllers/users_controller.rb b/users/app/controllers/users_controller.rb index 3d5a6a7..b705f47 100644 --- a/users/app/controllers/users_controller.rb +++ b/users/app/controllers/users_controller.rb @@ -2,6 +2,7 @@ class UsersController < ApplicationController skip_before_filter :verify_authenticity_token, :only => [:create] + before_filter :authorize before_filter :fetch_user, :only => [:edit, :update, :destroy] before_filter :set_anchor, :only => [:edit, :update] before_filter :authorize_admin, :only => [:index] @@ -48,6 +49,7 @@ class UsersController < ApplicationController protected def fetch_user + # authorize filter has been checked first, so won't get here unless authenticated @user = User.find_by_param(params[:id]) if !@user and admin? redirect_to users_path, :alert => t(:no_such_thing, :thing => 'user') -- cgit v1.2.3