Locked down dashboard to admins

concerto · May 6, 2012 · df36d6a · bamnet · May 6, 2012 · df36d6a
1 parent ebc5126
commit df36d6a
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/app/controllers/dashboard_controller.rb b/app/controllers/dashboard_controller.rb
@@ -1,12 +1,14 @@
 class DashboardController < ApplicationController
-
+  
   # GET /dashboard
   def index
+    authorize! :read, @concerto_config
     @concerto_configs = ConcertoConfig.all
   end
 
   #get a hash of concerto_config keysand values and update them using the ConcertoConfig setter
   def update
+    authorize! :update, @concerto_config
     params[:concerto_config].each  do |k,v|
       ConcertoConfig.set(k,v)
     end