scinote-eln/scinote-web
1
1
Fork 0
mirror of https://github.com/scinote-eln/scinote-web.git synced 2025-03-04 19:53:19 +08:00
Code Issues Projects Releases Packages Wiki Activity

Fixed experiment level permission checks in the controllers.

Browse source
This commit is contained in:
Matej Zrimšek 2018-02-05 18:55:37 +01:00
parent 7938c2e036
commit 1182ce5da1
2 changed files with 3 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
app/controllers/canvas_controller.rb
View file

@ -218,9 +218,7 @@ class CanvasController < ApplicationController
end
def check_edit_canvas
unless can_edit_canvas(@experiment)
render_403 and return
end
render_403 and return unless can_manage_experiment?(@experiment)
end
def check_view_canvas

4
app/controllers/protocols_controller.rb
View file

@ -1122,8 +1122,8 @@ class ProtocolsController < ApplicationController
@my_module = @protocol.my_module
render_403 unless @my_module.present? &&
(can_read_protocol_in_module?(protocol) ||
can_create_protocols_in_repository?(protocol.team))
(can_read_protocol_in_module?(@protocol) ||
can_create_protocols_in_repository?(@protocol.team))
end
def check_make_private_permissions