developers
/
seminar
forked from spen/seminar
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixd Category Authorization Permissions

This commit is contained in:
rulingcom 2026-06-05 05:32:25 +00:00
parent 5f3e00164b
commit 5b822a9501
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
app/controllers/admin/seminar_signups_controller.rb
View File

@ -3,18 +3,26 @@ class Admin::SeminarSignupsController < OrbitAdminController
include Admin::SeminarsHelper include Admin::SeminarsHelper
before_action ->(module_app = @app_title) { set_variables module_app } before_action ->(module_app = @app_title) { set_variables module_app }
before_action :check_manager_for_seminar before_action :check_manager_for_seminar
skip_before_action :check_for_nil_categories
def initialize def initialize
super super
@app_title = "seminar" @app_title = "seminar"
end end
def check_manager_for_seminar def check_manager_for_seminar
OrbitHelper.set_params(params,current_user) OrbitHelper.set_params(params,current_user)
OrbitHelper.set_this_module_app("seminar")
access_level = OrbitHelper.user_access_level? access_level = OrbitHelper.user_access_level?
if (access_level.nil? || access_level == "user") || access_level == "sub_manager" if access_level.nil? || access_level == "user"
@seminar = SeminarSignup.find(params[:id]).seminar_main rescue nil @seminar = SeminarSignup.find(params[:id]).seminar_main rescue nil
if (@seminar.organizer_id != current_user.member_profile_id rescue true) if (@seminar.organizer_id != current_user.member_profile_id rescue true)
render_401 render_401
end end
elsif access_level == "sub_manager"
@seminar = SeminarSignup.find(params[:id]).seminar_main rescue nil
approved_category_ids = current_user.approved_categories.collect{|c| c.id}
unless approved_category_ids.include?(@seminar.category_id) || (@seminar.organizer_id == current_user.member_profile_id rescue false)
render_401
end
end end
end end
def edit def edit

2
app/controllers/admin/seminars_controller.rb
View File

@ -624,7 +624,7 @@ class Admin::SeminarsController < OrbitAdminController
if @access_level == "user" || @access_level.nil? if @access_level == "user" || @access_level.nil?
@can_edit = false @can_edit = false
elsif @access_level == "sub_manager" elsif @access_level == "sub_manager"
@can_edit = false @can_edit = can_edit_or_delete?(@seminar)
end end
unless @can_edit unless @can_edit
@can_edit = (@seminar.organizer_id == current_user.member_profile_id rescue false) @can_edit = (@seminar.organizer_id == current_user.member_profile_id rescue false)