diff --git a/Gemfile.lock b/Gemfile.lock index a330277..2c2ea35 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -100,7 +100,7 @@ activesupport (>= 4.2.0) hashdiff (0.3.7) hashie (3.5.7) - htmltoword (0.7.0) + htmltoword (1.0.0) actionpack nokogiri rubyzip (>= 1.0) diff --git a/app/controllers/org_admin/phases_controller.rb b/app/controllers/org_admin/phases_controller.rb index 827f4f3..ed47690 100644 --- a/app/controllers/org_admin/phases_controller.rb +++ b/app/controllers/org_admin/phases_controller.rb @@ -26,12 +26,9 @@ def edit phase = Phase.includes(:template).find(params[:id]) authorize phase - if !phase.template.latest? - flash[:notice] = _('You are viewing a historical version of this template. You will not be able to make changes.') - end section = params.fetch(:section, nil) # User cannot edit a phase if its a customization so redirect to show - if phase.template.customization_of.present? + if phase.template.customization_of.present? || !phase.template.latest? redirect_to org_admin_template_phase_path(template_id: phase.template, id: phase.id, section: section) else render('container', diff --git a/app/controllers/org_admin/sections_controller.rb b/app/controllers/org_admin/sections_controller.rb index 27e1b14..38bfd62 100644 --- a/app/controllers/org_admin/sections_controller.rb +++ b/app/controllers/org_admin/sections_controller.rb @@ -36,7 +36,8 @@ def edit section = Section.includes({phase: :template}, questions: [:question_options, { annotations: :org }]).find(params[:id]) authorize section - render partial: 'edit', + # User cannot edit a section if its not modifiable or the template is not the latest redirect to show + render partial: (section.modifiable? && section.phase.template.latest? ? 'edit' : 'show'), locals: { template: section.phase.template, phase: section.phase, diff --git a/app/controllers/org_admin/templates_controller.rb b/app/controllers/org_admin/templates_controller.rb index bea37d6..826dcd1 100644 --- a/app/controllers/org_admin/templates_controller.rb +++ b/app/controllers/org_admin/templates_controller.rb @@ -96,13 +96,14 @@ order('phases.number', 'sections.number', 'questions.number', 'question_options.number'). select('phases.title', 'phases.description', 'sections.title', 'questions.text', 'question_options.text') if !template.latest? - flash[:notice] = _("You are viewing a historical version of this #{template_type(template)}. You will not be able to make changes.") + redirect_to org_admin_template_path(id: template.id) + else + render 'container', locals: { + partial_path: 'edit', + template: template, + phases: phases, + referrer: get_referrer(template, request.referrer) } end - render 'container', locals: { - partial_path: 'edit', - template: template, - phases: phases, - referrer: get_referrer(template, request.referrer) } end # GET /org_admin/templates/new diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index c759af8..5482157 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -91,7 +91,7 @@ def update_email_preferences prefs = params[:prefs] - authorize current_user, :update? + authorize User pref = current_user.pref # does user not have prefs? if pref.blank? diff --git a/app/policies/user_policy.rb b/app/policies/user_policy.rb index e55a870..4a3bc31 100644 --- a/app/policies/user_policy.rb +++ b/app/policies/user_policy.rb @@ -1,43 +1,52 @@ class UserPolicy < ApplicationPolicy + attr_reader :signed_in_user attr_reader :user - def initialize(user, users) - raise Pundit::NotAuthorizedError, "must be logged in" unless user + def initialize(signed_in_user, user) + raise Pundit::NotAuthorizedError, "must be logged in" unless signed_in_user + @signed_in_user = signed_in_user @user = user - @users = users - end - - def admin_index? - @user.can_grant_permissions? end def index? admin_index? end + def admin_index? + signed_in_user.can_grant_permissions? + end + def admin_grant_permissions? - @user.can_grant_permissions? && ((@users.org_id == @user.org_id) || @user.can_super_admin?) + (signed_in_user.can_grant_permissions? && user.org_id == signed_in_user.org_id) || signed_in_user.can_super_admin? end def admin_update_permissions? - @user.can_grant_permissions? && ((@users.org_id == @user.org_id) || @user.can_super_admin?) + (signed_in_user.can_grant_permissions? && user.org_id == signed_in_user.org_id) || signed_in_user.can_super_admin? end # Allows the user to swap their org affiliation on the fly def org_swap? - user.can_super_admin? + signed_in_user.can_super_admin? end def activate? - user.can_super_admin? + signed_in_user.can_super_admin? end def edit? - user.can_super_admin? + signed_in_user.can_super_admin? end def update? - user.can_super_admin? + signed_in_user.can_super_admin? + end + + def update_email_preferences? + true + end + + def acknowledge_notification? + true end class Scope < Scope @@ -45,8 +54,4 @@ scope.where(org_id: user.org_id) end end - - def acknowledge_notification? - true - end end diff --git a/app/views/plans/_overview_details.html.erb b/app/views/plans/_overview_details.html.erb index 6949ebf..cd3fe05 100644 --- a/app/views/plans/_overview_details.html.erb +++ b/app/views/plans/_overview_details.html.erb @@ -20,6 +20,7 @@ <% else %>
<% plan.template.phases.each do |p| %> + <% questions_size = p.sections.map{|s| s.questions.size }.reduce(0){|sum,x| sum + x } %>
<%= _("%{phase_title} (%{sections_size} %{sections}, %{questions_size} %{questions})") % { :phase_title => p.title, :sections_size => p.sections.size, :sections => n_('section', 'sections', p.sections.size), - :questions_size => p.questions.size, :questions => n_('question', 'questions', p.questions.size) } %> + :questions_size => questions_size, + :questions => n_('question', 'questions', questions_size) } %>
diff --git a/app/views/shared/export/_plan_coversheet.erb b/app/views/shared/export/_plan_coversheet.erb index 324909e..2b09113 100644 --- a/app/views/shared/export/_plan_coversheet.erb +++ b/app/views/shared/export/_plan_coversheet.erb @@ -30,7 +30,9 @@

<%= _("Last modified: ") + l(@plan.updated_at.to_date, formats: :short) %>


-

<%= _("Copyright information:") %>

-

<%= _(" The above plan creator(s) have agreed that others may use as much of the text of this plan as they would like in their own plans, and customise it as necessary. You do not need to credit the creator(s) as the source of the language used, but using any of the plan's text does not imply that the creator(s) endorse, or have any relationship to, your project or proposal") %>

+ <% if @public_plan %> +

<%= _("Copyright information:") %>

+

<%= _(" The above plan creator(s) have agreed that others may use as much of the text of this plan as they would like in their own plans, and customise it as necessary. You do not need to credit the creator(s) as the source of the language used, but using any of the plan's text does not imply that the creator(s) endorse, or have any relationship to, your project or proposal") %>

+ <% end %>
\ No newline at end of file diff --git a/test/functional/org_admin/phases_controller_test.rb b/test/functional/org_admin/phases_controller_test.rb index b7d4263..211959d 100644 --- a/test/functional/org_admin/phases_controller_test.rb +++ b/test/functional/org_admin/phases_controller_test.rb @@ -32,6 +32,14 @@ assert_nil flash[:alert] end + test 'get phases#edit redirects to #show when template is not latest' do + new_version = @template.generate_version! + sign_in @org_admin + get(edit_org_admin_template_phase_path(@template.id, @template.phases.first.id)) + assert_response :redirect + assert_redirected_to org_admin_template_phase_path(@template.id, @template.phases.first.id) + end + test "unauthorized user cannot access the preview phase page" do get preview_org_admin_template_phase_path(@template, @phase) assert_unauthorized_redirect_to_root_path diff --git a/test/functional/org_admin/templates_controller_test.rb b/test/functional/org_admin/templates_controller_test.rb index d09ff86..d778889 100644 --- a/test/functional/org_admin/templates_controller_test.rb +++ b/test/functional/org_admin/templates_controller_test.rb @@ -104,12 +104,12 @@ assert_nil flash[:notice], 'expected no warning messages' end - test 'get templates#edit returns ok with flash notice when template is not latest' do + test 'get templates#edit redirects to #show when template is not latest' do new_version = @org_template.generate_version! sign_in @org_admin get(edit_org_admin_template_path(@org_template.id)) - assert_response :success - assert_not_nil flash[:notice], 'expected a warning message' + assert_response :redirect + assert_redirected_to org_admin_template_path(@org_template.id) end test "unauthorized user cannot access the template#new page" do