diff --git a/app/controllers/project_activities_controller.rb b/app/controllers/project_activities_controller.rb index 639f71209..350c8f598 100644 --- a/app/controllers/project_activities_controller.rb +++ b/app/controllers/project_activities_controller.rb @@ -26,9 +26,7 @@ class ProjectActivitiesController < ApplicationController end def check_view_permissions - unless can_read_project?(@project) - render_403 - end + render_403 unless can_read_project?(@project) end end diff --git a/app/controllers/project_comments_controller.rb b/app/controllers/project_comments_controller.rb index 90f19159a..10addd62c 100644 --- a/app/controllers/project_comments_controller.rb +++ b/app/controllers/project_comments_controller.rb @@ -171,25 +171,23 @@ class ProjectCommentsController < ApplicationController end def check_view_permissions - unless can_read_project?(@project) - render_403 - end + render_403 unless can_read_project?(@project) end def check_add_permissions - unless can_add_comment_to_project?(@project) - render_403 - end + render_403 unless can_add_comment_to_project?(@project) end def check_edit_permissions @comment = ProjectComment.find_by_id(params[:id]) - render_403 unless @comment.present? && can_update_or_delete_project_comment?(@comment) + render_403 unless @comment.present? && + can_update_or_delete_project_comment?(@comment) end def check_destroy_permissions @comment = ProjectComment.find_by_id(params[:id]) - render_403 unless @comment.present? && can_update_or_delete_project_comment?(@comment) + render_403 unless @comment.present? && + can_update_or_delete_project_comment?(@comment) end def comment_params diff --git a/app/controllers/projects_controller.rb b/app/controllers/projects_controller.rb index 0fea7561f..3a0d60ccf 100644 --- a/app/controllers/projects_controller.rb +++ b/app/controllers/projects_controller.rb @@ -119,8 +119,8 @@ class ProjectsController < ApplicationController # Check archive permissions if archiving/restoring if project_params.include? :archive - if (project_params[:archive] and !can_update_project?(@project)) or - (!project_params[:archive] and !can_restore_project?(@project)) + if (project_params[:archive] && !can_update_project?(@project)) || + (!project_params[:archive] && !can_restore_project?(@project)) return_error = true is_archive = URI(request.referer).path == projects_archive_path ? "restore" : "archive" flash_error = t("projects.#{is_archive}.error_flash", name: @project.name) @@ -318,9 +318,7 @@ class ProjectsController < ApplicationController end def check_view_permissions - unless can_read_project?(@project) - render_403 - end + render_403 unless can_read_project?(@project) end def check_create_permissions @@ -328,15 +326,11 @@ class ProjectsController < ApplicationController end def check_view_notifications_permissions - unless can_read_project?(@project) - render_403 - end + render_403 unless can_read_project?(@project) end def check_edit_permissions - unless can_update_project?(@project) - render_403 - end + render_403 unless can_update_project?(@project) end def check_experiment_archive_permissions diff --git a/app/controllers/user_projects_controller.rb b/app/controllers/user_projects_controller.rb index 83d70cd7a..17b189a34 100644 --- a/app/controllers/user_projects_controller.rb +++ b/app/controllers/user_projects_controller.rb @@ -181,38 +181,26 @@ class UserProjectsController < ApplicationController end def check_view_tab_permissions - unless can_read_project?(@project) - render_403 - end + render_403 unless can_read_project?(@project) end def check_view_permissions - unless can_update_project?(@project) - render_403 - end + render_403 unless can_update_project?(@project) end def check_create_permissions - unless can_update_project?(@project) - render_403 - end + render_403 unless can_update_project?(@project) end def check_update_permisisons - # TODO improve permissions for changing your role on project - unless params[:id] != current_user.id - render_403 - end + # TODO: improve permissions for changing your role on project + render_403 unless params[:id] != current_user.id end def check_delete_permisisons - # TODO improve permissions for remove yourself from project - unless params[:id] != current_user.id - render_403 - end - unless can_update_project?(@project) - render_403 - end + # TODO: improve permissions for remove yourself from project + render_403 unless params[:id] != current_user.id + render_403 unless can_update_project?(@project) end def init_gui