Merge dev into 46_1.7_Additional_Information

app/controllers/application_controller.rb

@@ -4,6 +4,13 @@ class ApplicationController < ActionController::Base
   protect_from_forgery with: :exception
   before_action :configure_permitted_parameters, if: :devise_controller?
 
+  rescue_from CanCan::AccessDenied do |exception|
+    respond_to do |format|
+      format.json { head :forbidden }
+      format.html { redirect_to main_app.root_url, :alert => exception.message }
+    end
+  end
+
   def index
 
   end

config/locales/de.yml

@@ -21,6 +21,9 @@
 
 de:
   hello: "Willkommen beim Workshop-Portal"
+  unauthorized:
+      manage:
+        all: "Du bist nicht authorisiert diese Aktion auszuführen."
   navbar:
     home: "Start"
     events: "Veranstaltungen"

config/locales/en.yml

@@ -21,6 +21,9 @@
 
 en:
   hello: "Welcome to the Workshop-Portal"
+  unauthorized:
+      manage:
+        all: "You are not authorized to take this action."
   navbar:
     home: "Home"
     events: "Events"

db/seeds.rb

@@ -95,6 +95,15 @@
 # Applicant's application letter
 ApplicationLetter.find_or_create_by!(
     motivation: "Ich würde sehr gerne an eurer Veranstaltung teilnehmen",
+    grade: 10,
+    experience: "Internet",
+    coding_skills: "HTML",
+    emergency_number: "01234567891",
+    vegeterian: false,
+    vegan: false,
+    allergic: false,
+    allergies: "",
+    status: nil,
     user: applicant,
     event: event
 )

spec/features/application_letters_spec.rb

@@ -68,15 +68,25 @@
     expect(ApplicationLetter.where(grade:"11")).to exist
   end
 
-
-
   it "displays help text for motivation textarea" do
     login(:pupil)
     visit new_application_letter_path(:event_id => @event.id, :locale => :de)
 
     expect(page).to have_text(I18n.t 'application_letters.form.help_text_coding_skills')
   end
 
+  %i[pupil tutor].each do |role|
+    it "shows an error if the site of another application letter is accessed by url" do
+      user = FactoryGirl.create(:user, role: role)
+      another_user = FactoryGirl.create(:user)
+      another_application = FactoryGirl.create(:application_letter, user: another_user)
+
+      visit application_letter_path(id: another_application.id)
+
+      expect(page).to have_text(I18n.t('unauthorized.manage.all'))
+    end
+  end
+
   def login(role)
 
     @event = FactoryGirl.create(:event)