diff --git a/app/controllers/issues_controller.rb b/app/controllers/issues_controller.rb index 3fb04c9..40a3185 100644 --- a/app/controllers/issues_controller.rb +++ b/app/controllers/issues_controller.rb @@ -2,7 +2,7 @@ class IssuesController < ApplicationController before_filter :get_issue, only: [:show, :edit, :update, :destroy] def index - raise AccessError unless cuser and cuser.admin? + raise AccessError unless cuser and (cuser.admin? or cuser.moderator?) sort = case params['sort'] when "title" then "title" @@ -12,9 +12,11 @@ class IssuesController < ApplicationController else "created_at DESC" end - @open = Issue.with_status(Issue::STATUS_OPEN).all order: sort - @solved = Issue.with_status(Issue::STATUS_SOLVED).all order: sort - @rejected = Issue.with_status(Issue::STATUS_REJECTED).all order: sort + allowed = Issue::allowed_categories cuser + + @open = Issue.where(category_id: allowed).with_status(Issue::STATUS_OPEN).all order: sort + @solved = Issue.where(category_id: allowed).with_status(Issue::STATUS_SOLVED).all order: sort + @rejected = Issue.where(category_id: allowed).with_status(Issue::STATUS_REJECTED).all order: sort end def show @@ -49,7 +51,7 @@ class IssuesController < ApplicationController end def update - raise AccessError unless @issue.can_update? cuser + raise AccessError unless @issue.can_update?(cuser, params[:issue]) if @issue.update_attributes(params[:issue]) flash[:notice] = t(:issues_update) redirect_to(@issue) diff --git a/app/models/issue.rb b/app/models/issue.rb index 594ddb0..49af7f9 100644 --- a/app/models/issue.rb +++ b/app/models/issue.rb @@ -96,18 +96,36 @@ class Issue < ActiveRecord::Base end def can_show? cuser - cuser and !cuser.nil? and ((author == cuser) or cuser.admin?) + cuser and ((author == cuser) or (Issue::allowed_categories(cuser).include?(self.category_id))) end def can_create? cuser true end - def can_update? cuser - cuser and cuser.admin? + def can_update?(cuser, params = {}) + ret = cuser && Issue::allowed_categories(cuser).include?(self.category_id) + if ret && !cuser.admin? && params.member?(:category_id) + ret = (self.category_id.to_s == params[:category_id]) + end + + ret end def can_destroy? cuser cuser and cuser.admin? end + + # STATIC METHODS + + def self.allowed_categories cuser + allowed = [] + allowed << 54 if cuser.admin? || cuser.gather_moderator? # gather + allowed << 17 if cuser.admin? # website + allowed << 22 if cuser.admin? # league + allowed << 20 if cuser.admin? # ensl plugin + allowed + end + + end diff --git a/app/models/user.rb b/app/models/user.rb index db83fea..9cefd2b 100755 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -190,19 +190,24 @@ class User < ActiveRecord::Base end def admin? - groups.exists? :id => Group::ADMINS + groups.exists? id: Group::ADMINS end def ref? - groups.exists? :id => Group::REFEREES + groups.exists? id: Group::REFEREES end def staff? - groups.exists? :id => Group::STAFF + groups.exists? id: Group::STAFF end def caster? - groups.exists? :id => Group::CASTERS + groups.exists? id: Group::CASTERS + end + + # might seem redundant but allows for later extensions like forum moderators + def moderator? + groups.exists? id: Group::GATHER_MODERATORS end def gather_moderator? @@ -210,7 +215,7 @@ class User < ActiveRecord::Base end def allowed_to_ban? - admin? or gather_moderator? + admin? or moderator? end def verified? diff --git a/app/views/issues/_form.html.erb b/app/views/issues/_form.html.erb index c39a114..5521c47 100644 --- a/app/views/issues/_form.html.erb +++ b/app/views/issues/_form.html.erb @@ -4,7 +4,7 @@ <%= f.label :title %> <%= f.text_field :title %> - <% if cuser and cuser.admin? %> + <% if cuser and Issue::allowed_categories(cuser).include?(@issue.category_id) %>