Nemcio/Redmine
1
0
Fork 0
mirror of https://github.com/redmine/redmine.git synced 2026-03-04 11:31:31 +01:00
Code Issues Packages Projects Releases Activity

permission check in queries controller

Browse Source 
git-svn-id: http://redmine.rubyforge.org/svn/branches/work@89 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang
2006-12-16 11:54:52 +00:00
parent e31070f21c
commit de0a37e8b6
2 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
queries/trunk/app/controllers/application.rb
View File

@@ -71,9 +71,9 @@ class ApplicationController < ActionController::Base
end
# authorizes the user for the requested action.
def authorize
def authorize(ctrl = @params[:controller], action = @params[:action])
# check if action is allowed on public projects
if @project.is_public? and Permission.allowed_to_public "%s/%s" % [ @params[:controller], @params[:action] ]
if @project.is_public? and Permission.allowed_to_public "%s/%s" % [ ctrl, action ]
return true
end
# if action is not public, force login
@@ -82,7 +82,7 @@ class ApplicationController < ActionController::Base
return true if self.logged_in_user.admin?
# if not admin, check membership permission
@user_membership ||= Member.find(:first, :conditions => ["user_id=? and project_id=?", self.logged_in_user.id, @project.id])
if @user_membership and Permission.allowed_to_role( "%s/%s" % [ @params[:controller], @params[:action] ], @user_membership.role_id )
if @user_membership and Permission.allowed_to_role( "%s/%s" % [ ctrl, action ], @user_membership.role_id )
return true
end
render :nothing => true, :status => 403

2
queries/trunk/app/controllers/queries_controller.rb
View File

@@ -43,5 +43,7 @@ private
def find_query
@query = Query.find(params[:id])
@project = @query.project
# check if user is allowed to manage queries (same permission as add_query)
authorize('projects', 'add_query')
end
end