diff --git a/app/controllers/statistics_controller.rb b/app/controllers/statistics_controller.rb index 31afa9a07..fce44ea9a 100644 --- a/app/controllers/statistics_controller.rb +++ b/app/controllers/statistics_controller.rb @@ -3,6 +3,9 @@ class StatisticsController < ApplicationController # GET /statistics.json layout 'base_statistic' before_filter :get_date, :only => [:index, :new] + before_filter :require_login + before_filter :find_statistic, :only => [:show, :edit, :update, :destroy] + before_filter :require_manager, :only =>[:edit, :update, :destroy] def index type = (params[:type] == "reorder_popu" ? "size" : "created_at") @@ -35,7 +38,6 @@ class StatisticsController < ApplicationController # GET /statistics/1 # GET /statistics/1.json def show - @statistic = Statistic.find(params[:id]) @attachments = @statistic.attachments respond_to do |format| format.html # show.html.erb @@ -57,7 +59,6 @@ class StatisticsController < ApplicationController # GET /statistics/1/edit def edit @main_categories = MainCategory.all - @statistic = Statistic.find(params[:id]) main_category = MainCategory.find(@statistic.main_category_id) @sub_categories = main_category.sub_categories end @@ -82,8 +83,6 @@ class StatisticsController < ApplicationController # PUT /statistics/1 # PUT /statistics/1.json def update - @statistic = Statistic.find(params[:id]) - respond_to do |format| if @statistic.update_attributes(params[:statistic]) @statistic.save_attachments_containers(params[:attachments], User.current, true) @@ -99,7 +98,6 @@ class StatisticsController < ApplicationController # DELETE /statistics/1 # DELETE /statistics/1.json def destroy - @statistic = Statistic.find(params[:id]) @statistic.destroy respond_to do |format| @@ -125,4 +123,16 @@ class StatisticsController < ApplicationController @main_categories = MainCategory.all @sub_categories = params[:main_category_id].present? ? SubCategory.where(:main_category_id => params[:main_category_id]) : SubCategory.all end + + def find_statistic + if params[:id].present? + @statistic = Statistic.find(params[:id]) + else + render_403 + end + end + + def require_manager + render_403 unless (User.current.id == @statistic.user_id || User.current.admin?) + end end diff --git a/app/views/statistics/_statistics_list.html.erb b/app/views/statistics/_statistics_list.html.erb index 0b6986be0..e9a4a86d0 100644 --- a/app/views/statistics/_statistics_list.html.erb +++ b/app/views/statistics/_statistics_list.html.erb @@ -1,16 +1,18 @@ <% @statistics.each do |statistic| %>
<%= statistic.description.try(:html_safe) %>
@@ -20,7 +22,12 @@