if params[:nonce] and params[:nonce] == session[:nonce]
this_user = User.find_by_display_name(params[:display_name], :conditions => {:visible => true})
if this_user and UserRole::ALL_ROLES.include? params[:role]
- this_user.roles.create(:role => params[:role])
+ this_user.roles.create(:role => params[:role], :granter_id => @user.id)
redirect_to :controller => 'user', :action => 'view', :display_name => params[:display_name]
else
flash[:notice] = t('user_role.grant.fail', :role => params[:role], :name => params[:display_name])