diff --git a/app/controllers/projects_controller.rb b/app/controllers/projects_controller.rb index 33a9d2ef5..e04f74f7c 100644 --- a/app/controllers/projects_controller.rb +++ b/app/controllers/projects_controller.rb @@ -12,7 +12,7 @@ class ProjectsController < ApplicationController samples experiment_archive samples_index) before_action :check_create_permissions, only: [ :new, :create ] - before_action :check_edit_permissions, only: [ :edit ] + before_action :check_manage_permissions, only: %i(edit update) @filter_by_archived = false @@ -116,7 +116,7 @@ class ProjectsController < ApplicationController # Check archive permissions if archiving/restoring if project_params.include? :archive - if (project_params[:archive] && !can_update_project?(@project)) || + if (project_params[:archive] && !can_manage_project?(@project)) || (!project_params[:archive] && !can_restore_project?(@project)) return_error = true is_archive = URI(request.referer).path == projects_archive_path ? "restore" : "archive" @@ -322,8 +322,8 @@ class ProjectsController < ApplicationController render_403 unless can_create_projects?(current_team) end - def check_edit_permissions - render_403 unless can_update_project?(@project) + def check_manage_permissions + render_403 unless can_manage_project?(@project) end def choose_layout diff --git a/app/controllers/user_projects_controller.rb b/app/controllers/user_projects_controller.rb index 508d38884..507c98da2 100644 --- a/app/controllers/user_projects_controller.rb +++ b/app/controllers/user_projects_controller.rb @@ -6,7 +6,7 @@ class UserProjectsController < ApplicationController before_action :check_view_permissions, only: :index before_action :check_manage_users_permissions, only: :index_edit before_action :check_create_permissions, only: :create - before_action :check_update_permisisons, only: %i(update destroy) + before_action :check_manage_permisisons, only: %i(update destroy) def index @users = @project.user_projects @@ -183,16 +183,16 @@ class UserProjectsController < ApplicationController end def check_manage_users_permissions - render_403 unless can_update_project?(@project) + render_403 unless can_manage_project?(@project) end def check_create_permissions render_403 unless can_create_projects?(current_team) end - def check_update_permisisons - render_403 unless can_update_project?(@project) || - params[:id] != current_user.id + def check_manage_permisisons + render_403 unless can_manage_project?(@project) && + params[:id] == current_user.id end def init_gui diff --git a/app/permissions/project.rb b/app/permissions/project.rb index 84b463e4e..8fb5d3e20 100644 --- a/app/permissions/project.rb +++ b/app/permissions/project.rb @@ -5,12 +5,12 @@ Canaid::Permissions.register_for(Project) do (project.visible? && user.is_member_of_team?(project.team)) end - can :update_project do |user, project| + can :manage_project do |user, project| user.is_owner_of_project?(project) end can :restore_project do |user, project| - can_update_project?(user, project) && project.archived? + can_manage_project?(user, project) && project.archived? end can :create_experiment do |user, project| @@ -31,12 +31,12 @@ Canaid::Permissions.register_for(Project) do user.is_technician_or_higher_of_project?(project) end - %(read_project - update_project - create_experiment - add_comment_to_project - manage_tags - manage_reports) + %i(read_project + update_project + create_experiment + add_comment_to_project + manage_tags + manage_reports) .each do |perm| can perm do |_, project| project.active? @@ -50,10 +50,10 @@ Canaid::Permissions.register_for(Comment) do user.is_owner_of_project?(project)) end - %(update_or_delete_project_comment) + %i(update_or_delete_project_comment) .each do |perm| - can perm do |_, project| - project.active? + can perm do |_, comment| + comment.project.active? end end end diff --git a/app/views/projects/index.html.erb b/app/views/projects/index.html.erb index b8c82eec7..c9d02378a 100644 --- a/app/views/projects/index.html.erb +++ b/app/views/projects/index.html.erb @@ -23,7 +23,7 @@ <% end %> -<% if can_update_project?(@project) %> +<% if can_manage_project?(@project) %>