From 05ded8de03afda0da8696a9423a78f55ff19fd75 Mon Sep 17 00:00:00 2001 From: "Matthew K. Fu JuYuan" Date: Mon, 30 Apr 2012 03:14:15 +0800 Subject: [PATCH] Fix for NCCU 0430 all functions ok with two submanagers but different behavors --- .../admin/dashboards_controller.rb | 2 +- app/controllers/admin/designs_controller.rb | 3 +- app/controllers/application_controller.rb | 52 ++++++++++++++++++- app/helpers/orbit_backend_helper.rb | 6 +-- app/views/admin/dashboards/index.html.erb | 2 + app/views/layouts/_side_bar.html.erb | 4 ++ public/static/kernel.js | 1 + .../back_end/approvals_controller.rb | 1 + .../back_end/bulletin_categorys_controller.rb | 4 +- .../back_end/bulletins_controller.rb | 28 ++++++---- .../_bulletin_category.html.erb | 11 ++-- .../bulletin_categorys/index.html.erb | 2 +- .../back_end/bulletins/_bulletin.html.erb | 16 ++++-- .../back_end/bulletins/_sort_headers.html.erb | 2 +- 14 files changed, 107 insertions(+), 27 deletions(-) diff --git a/app/controllers/admin/dashboards_controller.rb b/app/controllers/admin/dashboards_controller.rb index 7b761361..b7f377d3 100644 --- a/app/controllers/admin/dashboards_controller.rb +++ b/app/controllers/admin/dashboards_controller.rb @@ -2,7 +2,7 @@ class Admin::DashboardsController < ApplicationController layout "new_admin" before_filter :authenticate_user! - before_filter :is_admin? +# before_filter :is_admin? def index end diff --git a/app/controllers/admin/designs_controller.rb b/app/controllers/admin/designs_controller.rb index 519b36a5..ff41c0b4 100644 --- a/app/controllers/admin/designs_controller.rb +++ b/app/controllers/admin/designs_controller.rb @@ -5,7 +5,8 @@ class Admin::DesignsController < ApplicationController layout "new_admin" before_filter :authenticate_user! - before_filter :is_admin? + before_filter :is_admin? + before_filter :for_admin_only def upload_package if !params[:design].nil? diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index fb82774e..2f6636b9 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -39,9 +39,59 @@ class ApplicationController < ActionController::Base @parent_item = Item.first(:conditions => { :id => BSON::ObjectId(params[:parent_id]) }) rescue nil end + def auth_failed_in_backend + redirect_to admin_dashboards_url + end + # Check if the current_user is admin def is_admin? - redirect_to root_url unless current_user.admin? + + auth_failed_in_backend unless current_user.admin? + end + + def is_manager? + @module_app.managing_users.include?(current_user) || is_admin? + end + + def for_admin_only + if is_admin? + true + else + flash[:notice] = "Access Denied for you are not Admin" + auth_failed_in_backend + end + end + + def for_app_manager + if is_manager? + true + else + flash[:notice] = "Access Denied for you are not Manager for this app" + auth_failed_in_backend + end + end + + def for_app_sub_manager + if (@module_app.sub_managing_users.include?(current_user) || is_manager?) + true + else + flash[:notice] = "Access Denied for you are not SubManager for this app" + auth_failed_in_backend + end + end + + def for_app_user + if (@module_app.app_auth.auth_users.include?(current_user) || for_app_sub_manager ) + true + else + flash[:notice] = "Access Denied for you are not User for this app" + auth_failed_in_backend + end + end + + def check_object_premission(obj,title) + flash[:notice] = "Access Denied for you don't have permission for this object" + auth_failed_in_backend unless (obj.get_object_auth_by_title(title).auth_users.include?(current_user) || is_manager? || is_admin? ) end # Render the page diff --git a/app/helpers/orbit_backend_helper.rb b/app/helpers/orbit_backend_helper.rb index b0da6df6..55f44d61 100644 --- a/app/helpers/orbit_backend_helper.rb +++ b/app/helpers/orbit_backend_helper.rb @@ -25,9 +25,9 @@ module OrbitBackendHelper content_tag :thead do content_tag :tr, :class => "sort-header" do concat (content_tag :th, :class => "span1 strong" do - concat check_box_tag :check_all - concat link_to content_tag(:i, nil, :class => "icon-trash"), '#', :class => "list-remove" - end) if delete_all + concat check_box_tag :check_all + concat link_to content_tag(:i, nil, :class => "icon-trash"), '#', :class => "list-remove" + end) if delete_all && is_manager? titles.each do |title| concat render_title(title[0], title[1], title[2], title[3]) end diff --git a/app/views/admin/dashboards/index.html.erb b/app/views/admin/dashboards/index.html.erb index e22d7dac..21bc7ffb 100644 --- a/app/views/admin/dashboards/index.html.erb +++ b/app/views/admin/dashboards/index.html.erb @@ -1,3 +1,5 @@ +<%= flash_messages %> +

<%= t(:content) %>

diff --git a/app/views/layouts/_side_bar.html.erb b/app/views/layouts/_side_bar.html.erb index 3baa8049..1a303a31 100644 --- a/app/views/layouts/_side_bar.html.erb +++ b/app/views/layouts/_side_bar.html.erb @@ -1,6 +1,10 @@ <%#= content_tag :li, :class => active_for_controllers('purchases') do -%> <%#= link_to content_tag(:i, nil, :class => 'icons-purchase') + t('admin.purchase'), admin_purchases_path %> <%# end -%> +<% content_for :page_specific_javascript do %> + <%= javascript_include_tag "/static/kernel.js" %> +<% end %> +<%= flash_messages %> <%= content_tag :li, :class => active_for_controllers('bulletins', '/panel/announcement/back_end/tags', 'bulletin_categorys','module_apps', 'approvals') do -%> <%= link_to content_tag(:i, nil, :class => 'icons-announcement') + t('admin.announcement'), panel_announcement_back_end_bulletins_path %> diff --git a/public/static/kernel.js b/public/static/kernel.js index c5b9a8a6..ba5b81c3 100644 --- a/public/static/kernel.js +++ b/public/static/kernel.js @@ -1,4 +1,5 @@ $(document).ready(function() { + $.each($(".notice"),function(k,v){ alert("EMPTY Cate");}); $.each($(".dymanic_load"),function(){ if($(this).attr("path")==''){$(this).html("App setting Failed");} diff --git a/vendor/built_in_modules/announcement/app/controllers/panel/announcement/back_end/approvals_controller.rb b/vendor/built_in_modules/announcement/app/controllers/panel/announcement/back_end/approvals_controller.rb index 2d10dd75..4338fdd1 100644 --- a/vendor/built_in_modules/announcement/app/controllers/panel/announcement/back_end/approvals_controller.rb +++ b/vendor/built_in_modules/announcement/app/controllers/panel/announcement/back_end/approvals_controller.rb @@ -1,5 +1,6 @@ class Panel::Announcement::BackEnd::ApprovalsController < OrbitBackendController before_filter :authenticate_user! + before_filter :is_admin? include AdminHelper # layout 'admin' diff --git a/vendor/built_in_modules/announcement/app/controllers/panel/announcement/back_end/bulletin_categorys_controller.rb b/vendor/built_in_modules/announcement/app/controllers/panel/announcement/back_end/bulletin_categorys_controller.rb index 0e3894b9..b9151125 100644 --- a/vendor/built_in_modules/announcement/app/controllers/panel/announcement/back_end/bulletin_categorys_controller.rb +++ b/vendor/built_in_modules/announcement/app/controllers/panel/announcement/back_end/bulletin_categorys_controller.rb @@ -1,5 +1,7 @@ class Panel::Announcement::BackEnd::BulletinCategorysController < OrbitBackendController - + before_filter :for_app_manager,:except => [:index] + + def index @bulletin_categorys = BulletinCategory.all @bulletin_category = BulletinCategory.new(:display => 'List') diff --git a/vendor/built_in_modules/announcement/app/controllers/panel/announcement/back_end/bulletins_controller.rb b/vendor/built_in_modules/announcement/app/controllers/panel/announcement/back_end/bulletins_controller.rb index 62de400d..6cf11158 100644 --- a/vendor/built_in_modules/announcement/app/controllers/panel/announcement/back_end/bulletins_controller.rb +++ b/vendor/built_in_modules/announcement/app/controllers/panel/announcement/back_end/bulletins_controller.rb @@ -1,8 +1,9 @@ class Panel::Announcement::BackEnd::BulletinsController < OrbitBackendController before_filter :authenticate_user! - before_filter :is_admin? - +# before_filter :for_admin_only,:only => [:] +# before_filter :for_app_manager,:only => [:index,:show,] + before_filter :for_app_sub_manager,:except => [:index,:show,:get_sorted_and_filtered_bulletins] def index # @bulletins = Bulletin.all # @bulletins = Bulletin.desc("postdate desc") @@ -42,6 +43,10 @@ class Panel::Announcement::BackEnd::BulletinsController < OrbitBackendController @bulletin_file = BulletinFile.new @file_url = panel_announcement_back_end_bulletins_path + @bulletins.delete_if{ |bulletin| + bulletin.is_pending == true && (!bulletin.bulletin_category.authed_users('fact_check').include?(current_user) || bulletin.create_user_id!=current_user.id) + } + respond_to do |format| format.html # index.html.erb format.js { } @@ -79,14 +84,17 @@ class Panel::Announcement::BackEnd::BulletinsController < OrbitBackendController # @bulletin.bulletin_files.build # @bulletin.bulletin_files.new - - get_categorys - get_tags - respond_to do |format| - format.html # new.html.erb - format.xml { render :xml => @bulletin } - end + if get_categorys.empty? + flash[:notice] = "You dont have any permission for post on cate" + redirect_to :action => :index + else + get_tags + respond_to do |format| + format.html # new.html.erb + format.xml { render :xml => @bulletin } + end + end end # GET /bulletins/1/edit @@ -314,7 +322,7 @@ class Panel::Announcement::BackEnd::BulletinsController < OrbitBackendController if(is_manager? || is_admin?) @bulletin_categorys = (id ? BulletinCategory.find(id).to_a : BulletinCategory.excludes('disabled' => true)) elsif is_sub_manager? - @bulletin_categorys = BulletinCategory.authed_for_user(current_user,'submit_new') + @bulletin_categorys = BulletinCategory.authed_for_user(current_user,'submit') end end diff --git a/vendor/built_in_modules/announcement/app/views/panel/announcement/back_end/bulletin_categorys/_bulletin_category.html.erb b/vendor/built_in_modules/announcement/app/views/panel/announcement/back_end/bulletin_categorys/_bulletin_category.html.erb index a75440e5..8ad4578e 100644 --- a/vendor/built_in_modules/announcement/app/views/panel/announcement/back_end/bulletin_categorys/_bulletin_category.html.erb +++ b/vendor/built_in_modules/announcement/app/views/panel/announcement/back_end/bulletin_categorys/_bulletin_category.html.erb @@ -4,10 +4,13 @@ <%= bulletin_category.key %>
diff --git a/vendor/built_in_modules/announcement/app/views/panel/announcement/back_end/bulletin_categorys/index.html.erb b/vendor/built_in_modules/announcement/app/views/panel/announcement/back_end/bulletin_categorys/index.html.erb index 4d31464f..26a88dab 100644 --- a/vendor/built_in_modules/announcement/app/views/panel/announcement/back_end/bulletin_categorys/index.html.erb +++ b/vendor/built_in_modules/announcement/app/views/panel/announcement/back_end/bulletin_categorys/index.html.erb @@ -35,7 +35,7 @@ -
<%= render :partial => "form" %>
+
<%= render :partial => "form" if is_manager?%>
diff --git a/vendor/built_in_modules/announcement/app/views/panel/announcement/back_end/bulletins/_bulletin.html.erb b/vendor/built_in_modules/announcement/app/views/panel/announcement/back_end/bulletins/_bulletin.html.erb index d171e0b3..5fb1fcaa 100644 --- a/vendor/built_in_modules/announcement/app/views/panel/announcement/back_end/bulletins/_bulletin.html.erb +++ b/vendor/built_in_modules/announcement/app/views/panel/announcement/back_end/bulletins/_bulletin.html.erb @@ -1,5 +1,8 @@ - <%= check_box_tag 'to_delete[]', bulletin.id, false, :class => "checkbox_in_list" %> + + <% if (bulletin.create_user_id == current_user.id) || is_manager? %> + <%= check_box_tag 'to_delete[]', bulletin.id, false, :class => "checkbox_in_list" %> + <% end -%>
@@ -27,8 +30,11 @@ <%= bulletin.bulletin_category.i18n_variable[I18n.locale] %> <%= link_to bulletin.title[I18n.locale], panel_announcement_front_end_bulletin_path(bulletin, :category_id => bulletin.bulletin_category.id) rescue ''%> +
diff --git a/vendor/built_in_modules/announcement/app/views/panel/announcement/back_end/bulletins/_sort_headers.html.erb b/vendor/built_in_modules/announcement/app/views/panel/announcement/back_end/bulletins/_sort_headers.html.erb index bca2db6a..f0d41dea 100644 --- a/vendor/built_in_modules/announcement/app/views/panel/announcement/back_end/bulletins/_sort_headers.html.erb +++ b/vendor/built_in_modules/announcement/app/views/panel/announcement/back_end/bulletins/_sort_headers.html.erb @@ -4,4 +4,4 @@ ['start_date', 'postdate', 'span1-2', 'bulletin.start_date'], ['end_date', 'deadline', 'span1-2', 'bulletin.end_date'], ['tags', 'tags', 'span1-2', 'bulletin.tags'], - ['last_modified', 'update_user_id','span1-3', 'bulletin.last_modified']).html_safe %> \ No newline at end of file + ['last_modified', 'update_user_id','span1-3', 'bulletin.last_modified']).html_safe %>