app/controllers/application_controller.rb
#handles finding and authorizing an asset for all controllers that require authorization, and handling if the item cannot be found
handles finding and authorizing an asset for all controllers that require authorization, and handling if the item cannot be found
handles finding and authorizing an asset for all controllers that require authorization and handling if the item cannot be found
def find_and_authorize_requested_item
    name = self.controller_name.singularize
    action = translate_action(action_name)
    return if action.nil?
    object = self.controller_name.classify.constantize.find(params[:id])
    if is_auth?(object, action)
      eval "@#{name} = object"
      params.delete :sharing unless object.can_manage?(current_user)
    else
      respond_to do |format|
        format.html do
          case action
            when 'publish', 'manage', 'edit', 'download', 'delete'
              if current_user.nil?
                flash[:error] = "You are not authorized to #{action} this #{name.humanize}, you may need to login first."
              else
                flash[:error] = "You are not authorized to #{action} this #{name.humanize}."
              end
              redirect_to(eval("#{self.controller_name.singularize}_path(#{object.id})"))
            else
              render :template => "general/landing_page_for_hidden_item", :locals => {:item => object}, :status => :forbidden
          end
        end
        format.rdf { render :text => "You may not #{action} #{name}:#{params[:id]}", :status => :forbidden }
        format.xml { render :text => "You may not #{action} #{name}:#{params[:id]}", :status => :forbidden }
        format.json { render :text => "You may not #{action} #{name}:#{params[:id]}", :status => :forbidden }
      end
      return false
    end
  end
def find_and_authorize_requested_item name = self . controller_name . singularize action = translate_action ( action_name ) return if action . nil? object = self . controller_name . classify . constantize . find ( params [ :id ] ) if is_auth? ( object , action ) eval "@#{name} = object" params . delete :sharing unless object . can_manage? ( current_user ) else respond_to do | format | format . html do case action when 'publish' , 'manage' , 'edit' , 'download' , 'delete' if current_user . nil? flash [ :error ] = "You are not authorized to #{action} this #{name.humanize}, you may need to login first." else flash [ :error ] = "You are not authorized to #{action} this #{name.humanize}." end redirect_to ( eval ( "#{self.controller_name.singularize}_path(#{object.id})" ) ) else render :template => "general/landing_page_for_hidden_item" , :locals => { :item => object } , :status => :forbidden end end format . rdf { render :text => "You may not #{action} #{name}:#{params[:id]}" , :status => :forbidden } format . xml { render :text => "You may not #{action} #{name}:#{params[:id]}" , :status => :forbidden } format . json { render :text => "You may not #{action} #{name}:#{params[:id]}" , :status => :forbidden } end return false end end
handles finding and authorizing an asset for all controllers that require authorization, and handling if the item cannot be found
handles finding and authorizing an asset for all controllers that require authorization and handling if the item cannot be found