lino.jorzick/greenlight
1
0
Fork 0
forked from External/greenlight
Code Issues Pull Requests Projects Releases Wiki Activity

GRN2-xx: Admin actions are now dictated by the correct role permission (#1140)

Browse Source 
* Admin actions are now dictated by the correct role permission

* Rspec fix

Co-authored-by: Jesus Federico <jesus@123it.ca>
This commit is contained in:
Ahmad Farhat
2020-04-01 10:58:13 -04:00
committed by GitHub
parent c72d77dbcb
commit 348713d4df
9 changed files with 144 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/controllers/admins_controller.rb
View File

@ -309,7 +309,7 @@ class AdminsController < ApplicationController
# Verifies that admin is an administrator of the user in the action
def verify_admin_of_user
redirect_to admins_path,
flash: { alert: I18n.t("administrator.flash.unauthorized") } unless current_user.admin_of?(@user)
flash: { alert: I18n.t("administrator.flash.unauthorized") } unless current_user.admin_of?(@user, "can_manage_users")
end
# Creates the invite if it doesn't exist, or updates the updated_at time if it does

2
app/controllers/concerns/joiner.rb
View File

@ -53,7 +53,7 @@ module Joiner
if room_running?(@room.bbb_id) || @room.owned_by?(current_user) || room_settings["anyoneCanStart"]
# Determine if the user needs to join as a moderator.
opts[:user_is_moderator] = @room.owned_by?(current_user) || room_settings["joinModerator"]
opts[:user_is_moderator] = @room.owned_by?(current_user) || room_settings["joinModerator"] || @shared_room
opts[:require_moderator_approval] = room_settings["requireModeratorApproval"]
opts[:mute_on_start] = room_settings["muteOnStart"]

9
app/controllers/rooms_controller.rb
View File

@ -93,7 +93,9 @@ class RoomsController < ApplicationController
return redirect_to root_path,
flash: { alert: I18n.t("administrator.site_settings.authentication.user-info") } if auth_required
unless @room.owned_by?(current_user) || room_shared_with_user
@shared_room = room_shared_with_user
unless @room.owned_by?(current_user) || @shared_room
# Don't allow users to join unless they have a valid access code or the room doesn't have an access code
if @room.access_code && !@room.access_code.empty? && @room.access_code != session[:access_code]
return redirect_to room_path(room_uid: params[:room_uid]), flash: { alert: I18n.t("room.access_code_required") }
@ -300,12 +302,13 @@ class RoomsController < ApplicationController
def verify_room_ownership_or_admin_or_shared
return redirect_to root_path unless @room.owned_by?(current_user) ||
room_shared_with_user ||
current_user&.admin_of?(@room.owner)
current_user&.admin_of?(@room.owner, "can_manage_rooms_recordings")
end
# Ensure the user either owns the room or is an admin of the room owner
def verify_room_ownership_or_admin
return redirect_to root_path if !@room.owned_by?(current_user) && !current_user&.admin_of?(@room.owner)
return redirect_to root_path if !@room.owned_by?(current_user) &&
!current_user&.admin_of?(@room.owner, "can_manage_rooms_recordings")
end
# Ensure the user owns the room or is allowed to start it

8
app/controllers/users_controller.rb
View File

@ -89,7 +89,7 @@ class UsersController < ApplicationController
path = admins_path
end
redirect_path = current_user.admin_of?(@user) ? path : profile
redirect_path = current_user.admin_of?(@user, "can_manage_users") ? path : profile
if params[:setting] == "password"
# Update the users password.
@ -141,7 +141,7 @@ class UsersController < ApplicationController
redirect_url = self_delete ? root_path : admin_path
begin
if current_user && (self_delete || current_user.admin_of?(@user))
if current_user && (self_delete || current_user.admin_of?(@user, "can_manage_users"))
# Permanently delete if the user is deleting themself
perm_delete = self_delete || (params[:permanent].present? && params[:permanent] == "true")
@ -216,6 +216,8 @@ class UsersController < ApplicationController
# Checks that the user is allowed to edit this user
def check_admin_of
redirect_to current_user.main_room if current_user && @user != current_user && !current_user.admin_of?(@user)
redirect_to current_user.main_room if current_user &&
@user != current_user &&
!current_user.admin_of?(@user, "can_manage_users")
end
end