From 510fb3bf0b2f4c0e172972e2948c48de8b21ac26 Mon Sep 17 00:00:00 2001 From: manson Date: Fri, 1 Aug 2014 12:24:34 +0800 Subject: [PATCH] add authorization --- .../admin/patent_types_controller.rb | 4 +++- app/controllers/admin/patents_controller.rb | 7 +++++-- app/views/admin/patents/_form.html.erb | 1 + .../plugin/personal_patent/_profile.html.erb | 17 +++++++++-------- 4 files changed, 18 insertions(+), 11 deletions(-) diff --git a/app/controllers/admin/patent_types_controller.rb b/app/controllers/admin/patent_types_controller.rb index fd5c417..c54b964 100644 --- a/app/controllers/admin/patent_types_controller.rb +++ b/app/controllers/admin/patent_types_controller.rb @@ -1,4 +1,6 @@ -class Admin::PatentTypesController < OrbitAdminController +class Admin::PatentTypesController < OrbitMemberController + before_action :allow_admin_only + def new @patent_type = PatentType.new @url = admin_patent_types_path(@patent_type) diff --git a/app/controllers/admin/patents_controller.rb b/app/controllers/admin/patents_controller.rb index aacb9ba..41dd067 100644 --- a/app/controllers/admin/patents_controller.rb +++ b/app/controllers/admin/patents_controller.rb @@ -4,6 +4,9 @@ class Admin::PatentsController < OrbitMemberController before_action :set_plugin before_action :get_settings,:only => [:new, :edit, :setting] + before_action :need_access_right + before_action :allow_admin_only, :only => [:index, :setting] + def index @patents = Patent.order_by(:year=>'desc').page(params[:page]).per(10) end @@ -17,7 +20,7 @@ class Admin::PatentsController < OrbitMemberController @member = MemberProfile.find(patent_params['member_profile_id']) rescue nil @patent = Patent.new(patent_params) @patent.save - redirect_to URI.encode('/admin/members/'+@member.to_param+'/Patent') + redirect_to params['referer_url'] end def edit @@ -30,7 +33,7 @@ class Admin::PatentsController < OrbitMemberController @patent = Patent.find(params[:id]) @patent.update_attributes(patent_params) @patent.save - redirect_to URI.encode('/admin/members/'+@member.to_param+'/Patent') + redirect_to params['referer_url'] end def destroy diff --git a/app/views/admin/patents/_form.html.erb b/app/views/admin/patents/_form.html.erb index 85ce1f0..66f12d5 100644 --- a/app/views/admin/patents/_form.html.erb +++ b/app/views/admin/patents/_form.html.erb @@ -208,6 +208,7 @@
<%= f.hidden_field :user_id, :value => params[:user_id] if !params[:user_id].blank? %> + <%= f.submit t('submit'), class: 'btn btn-primary' %> <%= link_to t('cancel'), get_go_back, :class=>"btn" %>
diff --git a/app/views/plugin/personal_patent/_profile.html.erb b/app/views/plugin/personal_patent/_profile.html.erb index d6ba3d7..f0358a3 100644 --- a/app/views/plugin/personal_patent/_profile.html.erb +++ b/app/views/plugin/personal_patent/_profile.html.erb @@ -6,15 +6,14 @@ <% end %> <% - is_autorized_user = (current_user==@member.user || current_user.is_admin?) - if is_autorized_user + if has_access? @patents = Patent.where(member_profile_id: @member.id).desc(:year).page(params[:page]).per(10) else @patents = Patent.where(is_hidden: false, member_profile_id: @member.id).desc(:year).page(params[:page]).per(10) end %> -<% if is_autorized_user %> +<% if has_access? %>
<%= link_to('Hide', '#', :class => "btn btn-mini list-active-btn disabled", "data-check-action" => "list-be-hide", :rel => toggle_hide_admin_patents_path(member_profile_id: params[:id], disable: 'true') ) %> @@ -26,7 +25,7 @@ - <% if is_autorized_user %> + <% if has_access? %> <% end -%> @@ -39,7 +38,7 @@ <% @patents.each do |patent| %> "> - <% if is_autorized_user %> + <% if has_access? %> @@ -49,8 +48,10 @@ <%= link_to patent.patent_title, OrbitHelper.url_to_plugin_show(patent.to_param,'personal_patent').to_s, target: "blank"%>
@@ -64,7 +65,7 @@
- <% if is_autorized_user %> + <% if has_access? %>
<%= link_to content_tag(:i, nil, :class => 'icon-edit') +' '+ t('setting'),'/admin/members/'+@member.to_param+'/patents/frontend_setting', :class => 'btn btn-primary' %> <%= link_to content_tag(:i, nil, :class => 'icon-plus') +' '+ t('new_'),
<%= t('personal_patent.publication_date') %>
<%= check_box_tag 'to_change[]', patent.id.to_s, false, :class => "list-check" %>