From 0e655ebb61a9a5a4617bee092e83c7b2b2a793a8 Mon Sep 17 00:00:00 2001
From: Harry Bomrah <harry@rulingcom.com>
Date: Wed, 17 Jan 2018 16:17:23 +0800
Subject: [PATCH] fix for property module authorization

---
 app/views/admin/property_hires/index.html.erb    | 16 +++++++++-------
 app/views/admin/property_hires/show.html.erb     | 14 ++++++++------
 .../property_hires/show_booking_details.html.erb | 12 +++++++-----
 3 files changed, 24 insertions(+), 18 deletions(-)

diff --git a/app/views/admin/property_hires/index.html.erb b/app/views/admin/property_hires/index.html.erb
index 9ec3be9..1d6b595 100644
--- a/app/views/admin/property_hires/index.html.erb
+++ b/app/views/admin/property_hires/index.html.erb
@@ -10,15 +10,17 @@
   <% @properties.each do |property| %>
     <tr>
       <td>
-      	<a href="<%= admin_property_hire_path(property) %>"><%= property.title %></a>
-        <div class="quick-edit">
-          <ul class="nav nav-pills">
-            <% if can_edit_or_delete?(property) %>
+        <% if can_edit_or_delete?(property) %>
+      	  <a href="<%= admin_property_hire_path(property) %>"><%= property.title %></a>
+          <div class="quick-edit">
+            <ul class="nav nav-pills">
               <li><a href="<%= edit_admin_property_hire_path(property, :page => params[:page]) %>"><%= t(:edit) %></a></li>
               <li><a href="<%= admin_property_hire_path(property.id, :page => params[:page]) %>" data-method="delete" data-confirm="Are you sure?"><%= t(:delete_) %></a></li>
-            <% end %>
-          </ul>
-        </div>
+            </ul>
+          </div>
+        <% else %>
+          <%= property.title %>
+        <% end %>
       </td>
       <td>
         <%= property.category.title %>
diff --git a/app/views/admin/property_hires/show.html.erb b/app/views/admin/property_hires/show.html.erb
index 1b46933..1aa72b3 100644
--- a/app/views/admin/property_hires/show.html.erb
+++ b/app/views/admin/property_hires/show.html.erb
@@ -30,13 +30,15 @@
       	<% end %>
       </td>
       <td>
-        <a href="<%= show_booking_details_admin_property_hire_path(p_hire, :page => params[:page]) %>" class="btn btn-info">View</a>
-        <% if p_hire.passed %>
-          <a href="<%= pass_booking_admin_property_hire_path(p_hire, :page => params[:page], :status => "reject", :ref => "index") %>" class="btn btn-warning">Reject</a>
-        <% else %>
-          <a href="<%= pass_booking_admin_property_hire_path(p_hire, :page => params[:page], :status => "accept", :ref => "index") %>" class="btn btn-success">Accept</a>
+        <% if can_edit_or_delete?(p_hire.property) %>
+          <a href="<%= show_booking_details_admin_property_hire_path(p_hire, :page => params[:page]) %>" class="btn btn-info">View</a>
+          <% if p_hire.passed %>
+            <a href="<%= pass_booking_admin_property_hire_path(p_hire, :page => params[:page], :status => "reject", :ref => "index") %>" class="btn btn-warning">Reject</a>
+          <% else %>
+            <a href="<%= pass_booking_admin_property_hire_path(p_hire, :page => params[:page], :status => "accept", :ref => "index") %>" class="btn btn-success">Accept</a>
+          <% end %>
+          <a href="<%= delete_booking_details_admin_property_hire_path(p_hire, :page => params[:page]) %>" class="btn btn-danger" data-method="delete" data-confirm="Are you sure?">Delete</a>
         <% end %>
-        <a href="<%= delete_booking_details_admin_property_hire_path(p_hire, :page => params[:page]) %>" class="btn btn-danger" data-method="delete" data-confirm="Are you sure?">Delete</a>
       </td>
     </tr>
   <% end %>
diff --git a/app/views/admin/property_hires/show_booking_details.html.erb b/app/views/admin/property_hires/show_booking_details.html.erb
index cef0c69..abbcabc 100644
--- a/app/views/admin/property_hires/show_booking_details.html.erb
+++ b/app/views/admin/property_hires/show_booking_details.html.erb
@@ -39,12 +39,14 @@
 	</tbody>
 </table>
 <a href="<%= admin_property_hire_path(@booking.property, :page => params[:page]) %>" class="btn btn-warning">Back</a>
-<% if @booking.passed %>
-	  <a href="<%= pass_booking_admin_property_hire_path(@booking, :status => "reject") %>" class="btn btn-warning">Reject</a>
-<% else %>
-    <a href="<%= pass_booking_admin_property_hire_path(@booking, :status => "accept") %>" class="btn btn-success">Accept</a>
+<% if can_edit_or_delete?(@booking.property) %>
+	<% if @booking.passed %>
+		  <a href="<%= pass_booking_admin_property_hire_path(@booking, :status => "reject") %>" class="btn btn-warning">Reject</a>
+	<% else %>
+	    <a href="<%= pass_booking_admin_property_hire_path(@booking, :status => "accept") %>" class="btn btn-success">Accept</a>
+	<% end %>
+	<a href="<%= delete_booking_details_admin_property_hire_path(@booking, :page => params[:page]) %>" class="btn btn-danger" data-method="delete" data-confirm="Are you sure?">Delete</a>
 <% end %>
-<a href="<%= delete_booking_details_admin_property_hire_path(@booking, :page => params[:page]) %>" class="btn btn-danger" data-method="delete" data-confirm="Are you sure?">Delete</a>