scinote-eln/scinote-web
1
1
Fork 0
mirror of https://github.com/scinote-eln/scinote-web.git synced 2024-12-28 11:14:24 +08:00
Code Issues Projects Releases Packages Wiki Activity

Added additional permission checks for moving tasks. Added forgotten enclosing tag in a view.

Browse source
This commit is contained in:
Matej Zrimšek 2018-02-09 18:02:04 +01:00
parent d7108f5a35
commit d55734e501
3 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
app/controllers/canvas_controller.rb
View file

@ -129,7 +129,10 @@ class CanvasController < ApplicationController
id.is_a?(String) &&
can_manage_module?(MyModule.find_by_id(id))
end &&
to_move.values.all? { |k| k.is_a? String }
to_move.values.all? do |exp_id|
exp_id.is_a?(String) &&
can_manage_experiment?(Experiment.find_by_id(exp_id))
end
return render_403
end
rescue

1
app/views/canvas/edit/_my_module.html.erb
View file

@ -33,6 +33,7 @@
<li>
<a class="move-module" href="" data-module-id="<%= my_module.id %>"><%=t "experiments.canvas.edit.move_module" %></a>
</li>
<% end %>
<% if my_module.my_module_group && my_module.my_module_group.my_modules.all? { |my_module| can_manage_module?(my_module) } %>
<li>
<a class="move-module-group" href="" data-module-id="<%= my_module.id %>"><%=t "experiments.canvas.edit.move_module_group" %></a>

2
app/views/canvas/edit/modal/_move_module.html.erb
View file

@ -10,7 +10,7 @@
<% if experiments.count > 1 %>
<%= bootstrap_form_tag do |f| %>
<%= f.select :experiment_id, experiments
.select { |e| e != @experiment }
.select { |e| e != @experiment && can_manage_experiment?(e) }
.collect { |e| [ e.name, e.id ] }, {},
{class: "form-control selectpicker", "data-role" => "clear"} %>
<% end %>