scinote-eln/scinote-web
1
1
Fork 0
mirror of https://github.com/scinote-eln/scinote-web.git synced 2025-01-30 19:48:18 +08:00
Code Issues Projects Releases Packages Wiki Activity

Check permissions in wopi_controller

Browse source
This commit is contained in:
Jure Grabnar 2016-09-26 19:23:27 +02:00
parent 5aea0fbb19
commit 25c9ec67b3
1 changed files with 14 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
app/controllers/wopi_controller.rb
View file

@ -1,5 +1,6 @@
class WopiController < ActionController::Base class WopiController < ActionController::Base
include WopiUtil include WopiUtil
include PermissionHelper
before_action :load_vars, :authenticate_user_from_token! before_action :load_vars, :authenticate_user_from_token!
before_action :verify_proof! before_action :verify_proof!
@ -62,10 +63,8 @@ class WopiController < ActionController::Base
# which should NOT be business # which should NOT be business
LicenseCheckForEditIsEnabled: true, LicenseCheckForEditIsEnabled: true,
UserFriendlyName: @user.name, UserFriendlyName: @user.name,
# TODO: Check user permisisons UserCanWrite: @can_write,
ReadOnly: false,
UserCanNotWriteRelative: true, UserCanNotWriteRelative: true,
UserCanWrite: true,
# TODO: decide what to put here # TODO: decide what to put here
CloseUrl: 'https://scinote-preview.herokuapp.com', CloseUrl: 'https://scinote-preview.herokuapp.com',
DownloadUrl: url_for(controller: 'assets', action: 'download', DownloadUrl: url_for(controller: 'assets', action: 'download',
@ -252,7 +251,18 @@ class WopiController < ActionController::Base
end end
logger.warn 'WOPI: user found by token' logger.warn 'WOPI: user found by token'
# TODO: check if the user can do anything with the file # This is what we get for settings permission methods with
# current_user
@current_user = @user
if @assoc.class == Step
@can_read = can_view_steps_in_protocol(@protocol)
@can_write = can_edit_step_in_protocol(@protocol)
else
@can_read = can_view_or_download_result_assets(@module)
@can_write = can_edit_result_asset_in_module(@module)
end
render nothing: :true, status: 404 and return unless @can_read
end end
def verify_proof! def verify_proof!