scinote-eln/scinote-web
1
1
Fork 0
mirror of https://github.com/scinote-eln/scinote-web.git synced 2025-09-29 08:24:40 +08:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #1986 from aignatov-bio/ai-sci-3776-fix-permission-for-invitation-user-without-team

Browse source 
Fix permission check for invite users [SCI-3776]
This commit is contained in:
Luka Murn 2019-08-14 15:10:08 +02:00 • committed by GitHub
commit 0a739785d6
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
app/controllers/users/invitations_controller.rb
View file

@ -188,10 +188,10 @@ module Users
@team = Team.find_by_id(params['teamId'])
@role = params['role']
return render_403 unless @emails && @team && @role
return render_403 if @emails.empty?
return render_403 unless can_manage_team_users?(@team)
return render_403 unless UserTeam.roles.key?(@role)
return render_403 if @team && @role.nil? # if we select team, we must select role
return render_403 if @emails.blank? # We must have at least one email
return render_403 if @team && !can_manage_team_users?(@team) # if we select team, we must check permission
return render_403 if @role && !UserTeam.roles.key?(@role) # if we select role, we must check that this role exist
end
end
end