show order_list when logged in as Librarian next-l/enju_leaf#925

next-l · Dec 9, 2015 · f782da2 · f782da2
1 parent fe2c8cf
commit f782da2
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 4 deletions.
diff --git a/app/views/purchase_requests/_index.html.erb b/app/views/purchase_requests/_index.html.erb
@@ -27,8 +27,10 @@
         <%= purchase_request.author -%>
         <%= purchase_request.publisher -%>
         <%= purchase_request.pub_date -%>
-        <br />
-        <%= t('activerecord.models.order_list') %>: <%= link_to purchase_request.order_list.title, purchase_requests_path(order_list_id: purchase_request.order_list.id) if purchase_request.order_list -%>
+        <% if current_user.has_role?('Librarian') %>
+          <br />
+          <%= t('activerecord.models.order_list') %>: <%= link_to purchase_request.order_list.title, purchase_requests_path(order_list_id: purchase_request.order_list.id) if purchase_request.order_list -%>
+        <% end %>
       </td>
       <td><%= purchase_request.price -%></td>
       <td>

diff --git a/lib/enju_purchase_request.rb b/lib/enju_purchase_request.rb
@@ -16,11 +16,17 @@ module InstanceMethods
     private
 
     def get_order_list
-      @order_list = OrderList.find(params[:order_list_id]) if params[:order_list_id]
+      if params[:order_list_id]
+        @order_list = OrderList.find(params[:order_list_id])
+        authorize @order_list, :show?
+      end
     end
 
     def get_purchase_request
-      @purchase_request = PurchaseRequest.find(params[:purchase_request_id]) if params[:purchase_request_id]
+      if params[:purchase_request_id]
+        @purchase_request = PurchaseRequest.find(params[:purchase_request_id])
+        authorize @purchase_request,  :show?
+      end
     end
   end
 end