refs frab#124: fix missing access to nested conference resources

MetaMeute · Mar 20, 2014 · 649c19f · 649c19f
1 parent 06a330c
commit 649c19f
Showing 1 changed file with 7 additions and 3 deletions.
diff --git a/app/models/ability.rb b/app/models/ability.rb
@@ -32,6 +32,10 @@ def initialize(user, conference)
 
     alias_action :create, :read, :update, :destroy, to: :crud
 
+    # nested conference resources alias, these actions only show the form, the
+    # actual update is handled by :update
+    alias_action :edit_rooms, :edit_tracks, :edit_days, to: :read_nested_conference
+
     setup_user_abilities
 
     if user.is_crew?
@@ -72,7 +76,7 @@ def setup_crew_user_abilities
     when /orga/
       can :manage, CallForPapers
 
-      can [:read, :update], Conference, id: @conference.id
+      can [:read, :read_nested_conference, :edit_ticket_server, :update], Conference, id: @conference.id
 
       can :crud, Event, conference_id: @conference.id
       can :manage, EventRating
@@ -96,7 +100,7 @@ def setup_crew_user_abilities
       # coordinates speakers and their events
       # everything from reviewer
       can [:create, :read, :update], CallForPapers
-      can :read, Conference
+      can [:read, :read_nested_conference], Conference
 
       can :crud, Event, conference_id: @conference.id
       can :manage, EventRating
@@ -107,7 +111,7 @@ def setup_crew_user_abilities
       # everything from submitter
       # edit own event rating
       can :read, CallForPapers
-      can :read, Conference
+      can [:read, :read_nested_conference], Conference
 
       can :read, Event, conference_id: @conference.id
       can :crud, EventRating, person_id: @user.person.id