scinote-eln/scinote-web
1
1
Fork 0
mirror of https://github.com/scinote-eln/scinote-web.git synced 2025-09-18 19:14:45 +08:00
Code Issues Projects Releases Packages Wiki Activity

Add permission check for experiment and task list [SCI-10450] (#7296)

Browse source
This commit is contained in:
ajugo 2024-03-18 10:52:37 +01:00 • committed by GitHub
parent c5eda21f9b
commit 0419609a1a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/controllers/experiments_controller.rb
View file

@ -450,7 +450,9 @@ class ExperimentsController < ApplicationController
def load_project
@project = Project.find_by(id: params[:project_id])
render_404 unless @project
render_403 unless can_read_project?(@project)
end
def experiment_params

2
app/controllers/my_modules_controller.rb
View file

@ -463,7 +463,9 @@ class MyModulesController < ApplicationController
def load_experiment
@experiment = Experiment.preload(user_assignments: %i(user user_role))
.find_by(id: params[:id] || params[:experiment_id])
render_404 unless @experiment
render_403 unless can_read_experiment?(@experiment)
end
def load_experiment_my_modules

2
app/controllers/navigator/projects_controller.rb
View file

@ -27,6 +27,8 @@ module Navigator
def load_project
@project = current_team.projects.find_by(id: params[:id])
render_404 unless @project
end
def check_read_permissions