Check diary entry edit/update ability using CanCanCan

diff --git a/app/abilities/ability.rb b/app/abilities/ability.rb
index a0eea302f5a95cd39a2f53b2c6addd77864b582a..907712328b77c4de1d3421ab96525d895d53ff00 100644 (file)
--- a/app/abilities/ability.rb
+++ b/app/abilities/ability.rb
@@ -42,7 +42,8 @@ class Ability
         can [:new, :show, :create, :destroy], :oauth2_authorization
         can [:edit, :update, :destroy], :account
         can [:show], :dashboard
-        can [:new, :create, :edit, :update, :subscribe, :unsubscribe], DiaryEntry
+        can [:new, :create, :subscribe, :unsubscribe], DiaryEntry
+        can :update, DiaryEntry, :user => user
         can [:create], DiaryComment
         can [:make_friend, :remove_friend], Friendship
         can [:new, :create, :reply, :show, :inbox, :outbox, :muted, :mark, :unmute, :destroy], Message

diff --git a/app/controllers/diary_entries_controller.rb b/app/controllers/diary_entries_controller.rb
index 1a888547db42b53a92de7451072b0cc9c14b6294..eaf6ddf9c519021e5d9a0809585fb94edf0f85ce 100644 (file)
--- a/app/controllers/diary_entries_controller.rb
+++ b/app/controllers/diary_entries_controller.rb
@@ -125,7 +125,7 @@ class DiaryEntriesController < ApplicationController
     @title = t "diary_entries.edit.title"
     @diary_entry = DiaryEntry.find(params[:id])
 
-    if current_user != @diary_entry.user ||
+    if cannot?(:update, @diary_entry) ||
        (params[:diary_entry] && @diary_entry.update(entry_params))
       redirect_to diary_entry_path(@diary_entry.user, @diary_entry)
     else

diff --git a/app/views/diary_entries/_diary_entry.html.erb b/app/views/diary_entries/_diary_entry.html.erb
index d4ee530d7f9d80b7787ccdf52b20fd37b261a2cd..62e701d1444f8fb6bbf55d488c7e08caf27e07e0 100644 (file)
--- a/app/views/diary_entries/_diary_entry.html.erb
+++ b/app/views/diary_entries/_diary_entry.html.erb
@@ -23,7 +23,7 @@
         </li>
       <% end %>
 
-      <% if current_user && current_user == diary_entry.user %>
+      <% if can?(:edit, diary_entry) %>
         <li><%= link_to t(".edit_link"), edit_diary_entry_path(diary_entry.user, diary_entry) %></li>
       <% end %>
 

diff --git a/test/controllers/diary_entries_controller_test.rb b/test/controllers/diary_entries_controller_test.rb
index 9acd72c67b630d1eb41a91813b8dfa31ee2280bc..bb6c25781fc5bd6aa6a31de5976bd31e74c4c0ef 100644 (file)
--- a/test/controllers/diary_entries_controller_test.rb
+++ b/test/controllers/diary_entries_controller_test.rb
@@ -336,6 +336,29 @@ class DiaryEntriesControllerTest < ActionDispatch::IntegrationTest
     assert_select "span[class=translation_missing]", false, "Missing translation in edit diary entry"
   end
 
+  def test_update
+    user = create(:user)
+    other_user = create(:user)
+    diary_entry = create(:diary_entry, :language_code => "en", :user => user, :title => "Original Title")
+
+    put diary_entry_path(user, diary_entry, :diary_entry => { :title => "Updated Title" })
+    assert_response :forbidden
+    diary_entry.reload
+    assert_equal "Original Title", diary_entry.title
+
+    session_for(other_user)
+    put diary_entry_path(user, diary_entry, :diary_entry => { :title => "Updated Title" })
+    assert_redirected_to diary_entry_path(user, diary_entry)
+    diary_entry.reload
+    assert_equal "Original Title", diary_entry.title
+
+    session_for(user)
+    put diary_entry_path(user, diary_entry, :diary_entry => { :title => "Updated Title" })
+    assert_redirected_to diary_entry_path(user, diary_entry)
+    diary_entry.reload
+    assert_equal "Updated Title", diary_entry.title
+  end
+
   def test_index_all
     diary_entry = create(:diary_entry)
     geo_entry = create(:diary_entry, :latitude => 51.50763, :longitude => -0.10781)