From 9577859d452091731254d2f5858bd980e963657a Mon Sep 17 00:00:00 2001 From: manson Date: Fri, 1 Aug 2014 12:23:36 +0800 Subject: [PATCH] add authorization --- app/controllers/admin/honor_types_controller.rb | 4 +++- app/controllers/admin/honors_controller.rb | 7 +++++-- app/views/admin/honors/_form.html.erb | 1 + .../plugin/personal_honor/_profile.html.erb | 17 +++++++++-------- 4 files changed, 18 insertions(+), 11 deletions(-) diff --git a/app/controllers/admin/honor_types_controller.rb b/app/controllers/admin/honor_types_controller.rb index 0ccb48c..0685185 100644 --- a/app/controllers/admin/honor_types_controller.rb +++ b/app/controllers/admin/honor_types_controller.rb @@ -1,4 +1,6 @@ -class Admin::HonorTypesController < OrbitAdminController +class Admin::HonorTypesController < OrbitMemberController + before_action :allow_admin_only + def new @honor_type = HonorType.new @url = admin_honor_types_path(@honor_type) diff --git a/app/controllers/admin/honors_controller.rb b/app/controllers/admin/honors_controller.rb index 0c500e8..798c90d 100644 --- a/app/controllers/admin/honors_controller.rb +++ b/app/controllers/admin/honors_controller.rb @@ -4,6 +4,9 @@ class Admin::HonorsController < OrbitMemberController before_action :set_plugin before_action :get_settings,:only => [:new, :edit, :setting] + before_action :need_access_right + before_action :allow_admin_only, :only => [:index, :setting] + def index @honors = Honor.order_by(:year=>'desc').page(params[:page]).per(10) end @@ -17,7 +20,7 @@ class Admin::HonorsController < OrbitMemberController @member = MemberProfile.find(honor_params['member_profile_id']) rescue nil @honor = Honor.new(honor_params) @honor.save - redirect_to URI.encode('/admin/members/'+@member.to_param+'/Honor') + redirect_to params['referer_url'] end def edit @@ -30,7 +33,7 @@ class Admin::HonorsController < OrbitMemberController @honor = Honor.find(params[:id]) @honor.update_attributes(honor_params) @honor.save - redirect_to URI.encode('/admin/members/'+@member.to_param+'/Honor') + redirect_to params['referer_url'] end def destroy diff --git a/app/views/admin/honors/_form.html.erb b/app/views/admin/honors/_form.html.erb index 1450ba0..c8265e0 100644 --- a/app/views/admin/honors/_form.html.erb +++ b/app/views/admin/honors/_form.html.erb @@ -153,6 +153,7 @@
<%= f.hidden_field :user_id, :value => params[:user_id] if !params[:user_id].blank? %> + <%= f.submit t('submit'), class: 'btn btn-primary' %> <%= link_to t('cancel'), get_go_back, :class=>"btn" %>
\ No newline at end of file diff --git a/app/views/plugin/personal_honor/_profile.html.erb b/app/views/plugin/personal_honor/_profile.html.erb index 11a9198..cf16f86 100644 --- a/app/views/plugin/personal_honor/_profile.html.erb +++ b/app/views/plugin/personal_honor/_profile.html.erb @@ -6,15 +6,14 @@ <% end %> <% - is_autorized_user = (current_user==@member.user || current_user.is_admin?) - if is_autorized_user + if has_access? @honors = Honor.where(member_profile_id: @member.id).desc(:year).page(params[:page]).per(10) else @honors = Honor.where(is_hidden: false, member_profile_id: @member.id).desc(:year).page(params[:page]).per(10) end %> -<% if is_autorized_user %> +<% if has_access? %>
<%= link_to('Hide', '#', :class => "btn btn-mini list-active-btn disabled", "data-check-action" => "list-be-hide", :rel => toggle_hide_admin_honors_path(member_profile_id: params[:id], disable: 'true') ) %> @@ -26,7 +25,7 @@ - <% if is_autorized_user %> + <% if has_access? %> <% end -%> @@ -38,7 +37,7 @@ <% @honors.each do |honor| %> "> - <% if is_autorized_user %> + <% if has_access? %> @@ -48,8 +47,10 @@ <%= link_to honor.award_name, OrbitHelper.url_to_plugin_show(honor.to_param,'personal_honor'), target: "blank"%>
@@ -62,7 +63,7 @@
- <% if is_autorized_user %> + <% if has_access? %>
<%= link_to content_tag(:i, nil, :class => 'icon-edit') +' '+ t('setting'),'/admin/members/'+@member.to_param+'/honors/frontend_setting', :class => 'btn btn-primary' %> <%= link_to content_tag(:i, nil, :class => 'icon-plus') +' '+ t('new_'),
<%= t('personal_honor.year') %>
<%= check_box_tag 'to_change[]', honor.id.to_s, false, :class => "list-check" %>