developers
/
orbit-4-1
Archived
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

First version of app and object auth for web_resource module. Basic fund is ok. backend need to be secued

This commit is contained in:
Matthew K. Fu JuYuan 2012-05-15 18:55:16 +08:00 committed by Christophe Vilayphiou
parent 03387d3c07
commit 82d78acbad
13 changed files with 54 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/controllers/orbit_backend_controller.rb
View File

@ -1,6 +1,8 @@
class OrbitBackendController< ApplicationController
before_filter :force_order,:except => [:public]
before_filter :setup_vars
before_filter :set_current_user
# before_filter {|c| c.front_end_available(@app_title)}
# before_filter :check_user_can_use
include OrbitCoreLib::PermissionUnility

4
app/helpers/admin/ad_banner_helper.rb
View File

@ -26,8 +26,6 @@ module Admin::AdBannerHelper
link_to t('admin.ad.cate_auth'),admin_object_auth_ob_auth_path(oa),:class => "btn btn-warning"
end
def at_least_module_manager
is_manager? || is_admin?
end
end

11
app/helpers/admin/web_link_helper.rb Normal file
View File

@ -0,0 +1,11 @@
module Admin::WebLinkHelper
def show_web_link_permission_link(web_link)
type = 'edit'
oa = web_link.get_object_auth_by_title(type)
if oa.nil?
web_link.object_auths.new(title: type ).save
oa = web_link.get_object_auth_by_title(type)
end
link_to t('admin.web_link.cate_auth'),admin_object_auth_ob_auth_path(oa)
end
end

4
app/helpers/application_helper.rb
View File

@ -196,4 +196,8 @@ module ApplicationHelper
display_visitors(created_at: {'$gte' => Date.today.beginning_of_year, '$lte' => Date.today.end_of_year})
end
def at_least_module_manager
is_manager? || is_admin?
end
end

4
app/models/object_auth.rb
View File

@ -11,9 +11,7 @@ class ObjectAuth < PrototypeAuth
end
def check_user_has_app_auth
debugger
a=1
sub_managing_users = auth_obj.app_auth.sub_managing_users
sub_managing_users = auth_obj.app_auth.sub_managing_users rescue []
app_auth = auth_obj.app_auth
self.auth_users.each do |auth_user|
if !sub_managing_users.include? auth_user && !auth_user.admin?

2
app/views/admin/ad_banners/_ad_banner_tab.html.erb
View File

@ -15,7 +15,7 @@
<% end -%>
<h3><%= t("admin.ad.picture_list")%></h3>
<div class="adbanner-list">
<%if at_least_module_manager || sub_manager?(ad_banner_tab)%>
<%if (at_least_module_manager || ad_banner_tab.cur_user_is_sub_manager_of(:edit) )%>
<%= content_tag :div ,:class=>'adbanner-action' do%>
<%= link_to t("admin.ad.new_image"),new_admin_ad_banner_ad_image_path(ad_banner_tab) ,:class => "btn btn-primary"%>
<%= link_to t("modal.preview"), admin_realtime_preview_ad_banner_path(ad_banner_tab.id) , :class=>'preview_trigger btn btn-success'%>

3
app/views/layouts/_side_bar.html.erb
View File

@ -58,13 +58,14 @@
<% end -%>
<% end %>
<%= content_tag :li, :class => active_for_controllers('web_links', '/panel/web_resource/back_end/tags', 'web_link_categorys') do -%>
<%= content_tag :li, :class => active_for_controllers('web_links', '/panel/web_resource/back_end/tags', 'web_link_categorys') || active_for_app_auth('web_resource') do -%>
<%= link_to content_tag(:i, nil, :class => 'icons-link') + t('admin.link'), panel_web_resource_back_end_web_links_path %>
<%= content_tag :ul, :class => ("nav nav-list " + visible_for_controllers('web_links', '/panel/web_resource/back_end/tags', 'web_link_categorys')) do -%>
<%= content_tag :li, link_to(t('admin.all_articles'), panel_web_resource_back_end_web_links_path), :class => active_for_action('web_links', 'index') %>
<%= content_tag :li, link_to(t('announcement.add_new'), new_panel_web_resource_back_end_web_link_path), :class => active_for_action('web_links', 'new') %>
<%= content_tag :li, link_to(t('announcement.categories'), panel_web_resource_back_end_web_link_categorys_path), :class => active_for_action('web_link_categorys', 'index') %>
<%= content_tag :li, link_to(t('announcement.tags'), panel_web_resource_back_end_tags_path), :class => active_for_action('/panel/web_resource/back_end/tags', 'index') %>
<%= content_tag :li, link_to(t('admin.module.authorization'),admin_module_app_manager_auth_proc_path(ModuleApp.first(conditions: {title: "web_resource"}))), :class => active_for_app_auth('web_resource') if (is_admin? rescue nil) %>
<% end -%>
<% end -%>

4
lib/orbit_core_lib.rb
View File

@ -19,6 +19,10 @@ module OrbitCoreLib
end
def cur_user_is_sub_manager_of(title)
authed_users(title).include?(User.current)
end
def app_auth
ModuleApp.first(conditions: {:title => self.class::APP_NAME} )
end

4
vendor/built_in_modules/web_resource/app/controllers/panel/web_resource/back_end/web_links_controller.rb vendored
View File

@ -1,7 +1,7 @@
class Panel::WebResource::BackEnd::WebLinksController < OrbitBackendController
before_filter :authenticate_user!
before_filter :is_admin?
# before_filter :for_app_manager,:except => [:index,:show]
# before_filter :for_app_sub_manager
def index

9
vendor/built_in_modules/web_resource/app/models/web_link_category.rb vendored
View File

@ -3,7 +3,12 @@
class WebLinkCategory
include Mongoid::Document
include Mongoid::Timestamps
include OrbitCoreLib::ObjectAuthable
# include Mongoid::MultiParameterAttributes
AfterObjectAuthUrl = '/panel/page_content/back_end/page_contexts'
APP_NAME = 'web_resource'
ObjectAuthTitlesOptions = %W{edit}
field :key
@ -11,4 +16,8 @@ class WebLinkCategory
has_many :web_links
def pp_object
i18n_variable[I18n.locale]
end
end

3
vendor/built_in_modules/web_resource/app/views/panel/web_resource/back_end/web_link_categorys/_web_link_category.html.erb vendored
View File

@ -3,12 +3,15 @@
<tr id="<%= dom_id web_link_category %>" class="with_action">
<td>
<%= web_link_category.key %>
<%if at_least_module_manager %>
<div class="quick-edit">
<ul class="nav nav-pills hide">
<li><%= link_to t('web_link_category.edit'), edit_panel_web_resource_back_end_web_link_category_path(web_link_category), :remote => true %></li>
<li><%= link_to t('web_link_category.delete'), panel_web_resource_back_end_web_link_category_path(web_link_category), :confirm => t('announcement.sure?'), :method => :delete, :remote => true %></li>
<li><%= show_web_link_permission_link web_link_category %></li>
</ul>
</div>
<% end -%>
</td>
<% @site_valid_locales.each do |locale| %>
<td><%= web_link_category.i18n_variable[locale] rescue nil %></td>

2
vendor/built_in_modules/web_resource/app/views/panel/web_resource/back_end/web_link_categorys/index.html.erb vendored
View File

@ -34,6 +34,6 @@
</tbody>
</table>
<div id="form"><%= render :partial => "form" %></div>
<div id="form"><%= render :partial => "form" if at_least_module_manager%></div>

2
vendor/built_in_modules/web_resource/app/views/panel/web_resource/back_end/web_links/_web_link.html.erb vendored
View File

@ -24,8 +24,10 @@
<%= link_to web_link.name[I18n.locale], panel_web_resource_back_end_web_link_path(web_link) %>
<div class="quick-edit">
<ul class="nav nav-pills hide">
<%if at_least_module_manager || web_link.web_link_category.cur_user_is_sub_manager_of(:edit)%>
<li><%= link_to t('web_link.edit'), edit_panel_web_resource_back_end_web_link_path(web_link) %></li>
<li><%= link_to t('web_link.delete'), panel_web_resource_back_end_web_link_path(web_link), :confirm => t('sure?'), :method => :delete, :remote => true %></li>
<% end -%>
</ul>
</div>
</td>