show order_list when logged in as Librarian next-l/enju_leaf#925

next-l · Dec 8, 2015 · 246f7b3 · 246f7b3
1 parent adff83e
commit 246f7b3
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 3 deletions.
diff --git a/app/controllers/purchase_requests_controller.rb b/app/controllers/purchase_requests_controller.rb
@@ -23,6 +23,9 @@ def index
 
     user = @user
     unless current_user.has_role?('Librarian')
+      if @order_list
+        access_denied; return
+      end
       if user and user != current_user
         access_denied; return
       end

diff --git a/app/views/purchase_requests/_index.html.erb b/app/views/purchase_requests/_index.html.erb
@@ -27,12 +27,16 @@
         <%= purchase_request.author -%>
         <%= purchase_request.publisher -%>
         <%= purchase_request.pub_date -%>
-        <br />
-        <%= t('activerecord.models.order_list') %>: <%= link_to purchase_request.order_list.title, purchase_requests_path(order_list_id: purchase_request.order_list.id) if purchase_request.order_list -%>
+        <% if current_user.has_role?('Librarian') %>
+          <br />
+          <%= t('activerecord.models.order_list') %>: <%= link_to purchase_request.order_list.title, purchase_requests_path(order_list_id: purchase_request.order_list.id) if purchase_request.order_list -%>
+        <% end %>
       </td>
       <td><%= purchase_request.price -%></td>
       <td>
-        <%= link_to t('page.edit'), edit_purchase_request_path(purchase_request) -%>
+        <%- if can? :update, purchase_request %>
+          <%= link_to t('page.edit'), edit_purchase_request_path(purchase_request) -%>
+        <%- end -%>
         <%- if can? :delete, purchase_request %>
           <%= link_to t('page.destroy'), purchase_request, data: {confirm: t('page.are_you_sure')}, method: :delete -%>
         <%- end -%>