diff --git a/app/controllers/phases_controller.rb b/app/controllers/phases_controller.rb index 391120b..eead0ca 100644 --- a/app/controllers/phases_controller.rb +++ b/app/controllers/phases_controller.rb @@ -8,10 +8,12 @@ def edit @plan = Plan.eager_load2(params[:plan_id]) + # authorization done on plan so found in plan_policy authorize @plan phase_id = params[:id].to_i @phase = @plan.template.phases.select {|p| p.id == phase_id}.first + @readonly = !@plan.editable_by?(current_user.id) # the eager_load pulls in ALL answers # need to restrict to just ones for this plan diff --git a/app/controllers/plans_controller.rb b/app/controllers/plans_controller.rb index 526f76a..e554b93 100644 --- a/app/controllers/plans_controller.rb +++ b/app/controllers/plans_controller.rb @@ -140,7 +140,7 @@ authorize @plan # If there was no phase specified use the template's 1st phase @phase = (params[:phase].nil? ? @plan.template.phases.first : Phase.find(params[:phase])) - @readonly = @plan.editable_by?(current_user.id) + @readonly = !@plan.editable_by?(current_user.id) respond_to :html end diff --git a/app/models/user.rb b/app/models/user.rb index 352b564..14f1af2 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -107,14 +107,13 @@ # # @param new_organisation_id [Integer] the id for an organisation # @return [String] the empty string as a causality of setting api_token -=begin - def organisation_id=(new_organisation_id) - unless self.can_change_org? || new_organisation_id.nil? || self.organisation.nil? + def org_id=(new_org_id) + unless self.can_change_org? || new_org_id.nil? || self.org.nil? # rip all permissions from the user self.perms.delete_all end # set the user's new organisation - super(new_organisation_id) + super(new_org_id) self.save! # rip api permissions from the user self.remove_token! @@ -124,10 +123,9 @@ # sets a new organisation for the user # # @param new_organisation [Organisation] the new organisation for the user - def organisation=(new_organisation) - organisation_id = new_organisation.id unless new_organisation.nil? + def organisation=(new_org) + org_id = new_org.id unless new_org.nil? end -=end ## # checks if the user is a super admin diff --git a/app/policies/phase_policy.rb b/app/policies/phase_policy.rb index 5d43a7e..caa0e3c 100644 --- a/app/policies/phase_policy.rb +++ b/app/policies/phase_policy.rb @@ -8,10 +8,10 @@ end ## + # Org-admin side # Users can modify phases if: # - They can modify templates # - The template which they are modifying belongs to their org - ## def admin_show? user.can_modify_templates? && (phase.template.org_id == user.org_id) diff --git a/app/policies/plan_policy.rb b/app/policies/plan_policy.rb index d6c8703..aa99a2b 100644 --- a/app/policies/plan_policy.rb +++ b/app/policies/plan_policy.rb @@ -7,13 +7,13 @@ @user = user @plan = plan end - + def show? @plan.readable_by?(@user.id) end def edit? - @plan.editable_by?(@user.id) + @plan.readable_by?(@user.id) end def update_guidance_choices? diff --git a/app/views/phases/_answer_form_ro.html.erb b/app/views/phases/_answer_form_ro.html.erb index fcf175d..915db2a 100644 --- a/app/views/phases/_answer_form_ro.html.erb +++ b/app/views/phases/_answer_form_ro.html.erb @@ -1,4 +1,4 @@ - <% q_format = question.question_format%> + <% if readonly != "always" then %>