app/controllers/application_controller.rb
#handles finding and authorizing an asset for all controllers that require authorization, and handling if the item cannot be found
handles finding and authorizing an asset for all controllers that require authorization, and handling if the item cannot be found
handles finding and authorizing an asset for all controllers that require authorization and handling if the item cannot be found
def find_and_authorize_requested_item
    begin
      name = self.controller_name.singularize
      action = translate_action(action_name)
      return if action.nil?
      object = name.camelize.constantize.find(params[:id])
      if is_auth?(object, action)
        eval "@#{name} = object"
        params.delete :sharing unless object.can_manage?(current_user)
      else
        respond_to do |format|
          if User.current_user.nil?
            flash[:error] = "You are not authorized to #{action} this #{name.humanize}, you may need to login first."
          else
            flash[:error] = "You are not authorized to #{action} this #{name.humanize}."
          end
          format.html do
            case action
              when 'publish'   then redirect_to object
              when 'manage'   then redirect_to object
              when 'edit'     then redirect_to object
              when 'download' then redirect_to object
              when 'delete' then redirect_to object
              else                 redirect_to eval "#{self.controller_name}_path"
            end
          end
          format.rdf { render :text => "You may not #{action} #{name}:#{params[:id]}", :status => :forbidden }
          format.xml { render :text => "You may not #{action} #{name}:#{params[:id]}", :status => :forbidden }
          format.json { render :text => "You may not #{action} #{name}:#{params[:id]}", :status => :forbidden }
        end
        return false
      end
    rescue ActiveRecord::RecordNotFound
      respond_to do |format|
        if eval("@#{name}").nil?
          flash[:error] = "The #{name.humanize.downcase} does not exist!"
        else
          flash[:error] = "You are not authorized to view #{name.humanize}"
        end
        format.rdf { render  :text=>"Not found",:status => :not_found }
        format.xml { render  :text=>"<error>404 Not found</error>",:status => :not_found }
        format.json { render :text=>"Not found", :status => :not_found }
        format.html { redirect_to eval "#{self.controller_name}_path" }
      end
      return false
    end
  end
def find_and_authorize_requested_item begin name = self . controller_name . singularize action = translate_action ( action_name ) return if action . nil? object = name . camelize . constantize . find ( params [ :id ] ) if is_auth? ( object , action ) eval "@#{name} = object" params . delete :sharing unless object . can_manage? ( current_user ) else respond_to do | format | if User . current_user . nil? flash [ :error ] = "You are not authorized to #{action} this #{name.humanize}, you may need to login first." else flash [ :error ] = "You are not authorized to #{action} this #{name.humanize}." end format . html do case action when 'publish' then redirect_to object when 'manage' then redirect_to object when 'edit' then redirect_to object when 'download' then redirect_to object when 'delete' then redirect_to object else redirect_to eval "#{self.controller_name}_path" end end format . rdf { render :text => "You may not #{action} #{name}:#{params[:id]}" , :status => :forbidden } format . xml { render :text => "You may not #{action} #{name}:#{params[:id]}" , :status => :forbidden } format . json { render :text => "You may not #{action} #{name}:#{params[:id]}" , :status => :forbidden } end return false end rescue ActiveRecord :: RecordNotFound respond_to do | format | if eval ( "@#{name}" ) . nil? flash [ :error ] = "The #{name.humanize.downcase} does not exist!" else flash [ :error ] = "You are not authorized to view #{name.humanize}" end format . rdf { render :text => "Not found" , :status => :not_found } format . xml { render :text => "<error>404 Not found</error>" , :status => :not_found } format . json { render :text => "Not found" , :status => :not_found } format . html { redirect_to eval "#{self.controller_name}_path" } end return false end end
handles finding and authorizing an asset for all controllers that require authorization, and handling if the item cannot be found
handles finding and authorizing an asset for all controllers that require authorization and handling if the item cannot be found
#TODO: can_*? methods should report _why_ you can't do what you want. Perhaps something similar to how active_record_object.save stores 'why' in active_record_object.errors