diff options
Diffstat (limited to 'app/controllers/alerts_controller.rb')
-rw-r--r-- | app/controllers/alerts_controller.rb | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/app/controllers/alerts_controller.rb b/app/controllers/alerts_controller.rb index 873e9b7..ac11854 100644 --- a/app/controllers/alerts_controller.rb +++ b/app/controllers/alerts_controller.rb @@ -1,5 +1,6 @@ class AlertsController < ApplicationController before_action :set_alert, only: [:show, :edit, :update, :destroy] + before_action :check_perms, only: [:new, :create, :edit, :update, :destroy] # GET /alerts # GET /alerts.json @@ -67,6 +68,15 @@ class AlertsController < ApplicationController @alert = Alert.find(params[:id]) end + def check_perms + unless (signed_in? and (current_user.in_group?(:admin) or current_user.in_group?(:host))) + respond_to do |format| + format.html { render action: 'permission_denied', status: :forbidden } + format.json { render json: "Permission denied", status: :forbidden } + end + end + end + # Never trust parameters from the scary internet, only allow the white list through. def alert_params params.require(:alert).permit(:author_id, :message) |