Merge remote-tracking branch 'upstream/pull/2051'

diff --git a/app/abilities/ability.rb b/app/abilities/ability.rb
index f55f19e4ea7e2d918e81ee4a95f66990dea9b530..d7a10005764ba78011b2e68df59089575fc180fe 100644 (file)
--- a/app/abilities/ability.rb
+++ b/app/abilities/ability.rb
@@ -8,6 +8,8 @@ class Ability
     can [:index, :rss, :show, :comments], DiaryEntry
     can [:search, :search_latlon, :search_ca_postcode, :search_osm_nominatim,
          :search_geonames, :search_osm_nominatim_reverse, :search_geonames_reverse], :geocoder
+    can [:index, :show], Redaction
+    can [:index, :show, :blocks_on, :blocks_by], UserBlock
 
     if user
       can :welcome, :site
@@ -18,6 +20,8 @@ class Ability
       if user.moderator?
         can [:index, :show, :resolve, :ignore, :reopen], Issue
         can :create, IssueComment
+        can [:new, :create, :edit, :update, :destroy], Redaction
+        can [:new, :edit, :create, :update, :revoke], UserBlock
       end
 
       if user.administrator?

diff --git a/app/controllers/redactions_controller.rb b/app/controllers/redactions_controller.rb
index b8ecce9e250fca521d3ae346f8b958a30026973e..45a41058c04f77cc785775060e30a4663777a9d4 100644 (file)
--- a/app/controllers/redactions_controller.rb
+++ b/app/controllers/redactions_controller.rb
@@ -3,8 +3,9 @@ class RedactionsController < ApplicationController
 
   before_action :authorize_web
   before_action :set_locale
-  before_action :require_user, :only => [:new, :create, :edit, :update, :destroy]
-  before_action :require_moderator, :only => [:new, :create, :edit, :update, :destroy]
+
+  authorize_resource
+
   before_action :lookup_redaction, :only => [:show, :edit, :update, :destroy]
   before_action :check_database_readable
   before_action :check_database_writable, :only => [:create, :update, :destroy]

diff --git a/app/controllers/user_blocks_controller.rb b/app/controllers/user_blocks_controller.rb
index 2b7bf3f58f7e190a5346abcaf45d3fa2c1a0e3a4..70dfddf83385cf40a7dd7f6994321c0f4d217f8d 100644 (file)
--- a/app/controllers/user_blocks_controller.rb
+++ b/app/controllers/user_blocks_controller.rb
@@ -3,8 +3,9 @@ class UserBlocksController < ApplicationController
 
   before_action :authorize_web
   before_action :set_locale
-  before_action :require_user, :only => [:new, :create, :edit, :update, :revoke]
-  before_action :require_moderator, :only => [:new, :create, :edit, :update, :revoke]
+
+  authorize_resource
+
   before_action :lookup_user, :only => [:new, :create, :blocks_on, :blocks_by]
   before_action :lookup_user_block, :only => [:show, :edit, :update, :revoke]
   before_action :require_valid_params, :only => [:create, :update]

diff --git a/test/controllers/redactions_controller_test.rb b/test/controllers/redactions_controller_test.rb
index 0bf57c3102c7b9f982fc1d4dbf3cce4243516416..fa56814b27e8403c6d90c9071bbde90de105490d 100644 (file)
--- a/test/controllers/redactions_controller_test.rb
+++ b/test/controllers/redactions_controller_test.rb
@@ -63,8 +63,7 @@ class RedactionsControllerTest < ActionController::TestCase
     session[:user] = create(:user).id
 
     get :new
-    assert_response :redirect
-    assert_redirected_to redactions_path
+    assert_response :forbidden
   end
 
   def test_create_moderator
@@ -140,8 +139,7 @@ class RedactionsControllerTest < ActionController::TestCase
     session[:user] = create(:user).id
 
     get :edit, :params => { :id => create(:redaction).id }
-    assert_response :redirect
-    assert_redirected_to(redactions_path)
+    assert_response :forbidden
   end
 
   def test_update_moderator

diff --git a/test/controllers/user_blocks_controller_test.rb b/test/controllers/user_blocks_controller_test.rb
index 77b17519ea184ea946e02b97d67fa055230e350f..4371e3f82bb857b09482fda1361a774c24941123 100644 (file)
--- a/test/controllers/user_blocks_controller_test.rb
+++ b/test/controllers/user_blocks_controller_test.rb
@@ -145,8 +145,7 @@ class UserBlocksControllerTest < ActionController::TestCase
 
     # Check that normal users can't load the block creation page
     get :new, :params => { :display_name => target_user.display_name }
-    assert_redirected_to user_blocks_path
-    assert_equal "You need to be a moderator to perform that action.", flash[:error]
+    assert_response :forbidden
 
     # Login as a moderator
     session[:user] = create(:moderator_user).id
@@ -189,8 +188,7 @@ class UserBlocksControllerTest < ActionController::TestCase
 
     # Check that normal users can't load the block edit page
     get :edit, :params => { :id => active_block.id }
-    assert_redirected_to user_blocks_path
-    assert_equal "You need to be a moderator to perform that action.", flash[:error]
+    assert_response :forbidden
 
     # Login as a moderator
     session[:user] = create(:moderator_user).id
@@ -361,8 +359,7 @@ class UserBlocksControllerTest < ActionController::TestCase
 
     # Check that normal users can't load the block revoke page
     get :revoke, :params => { :id => active_block.id }
-    assert_redirected_to user_blocks_path
-    assert_equal "You need to be a moderator to perform that action.", flash[:error]
+    assert_response :forbidden
 
     # Login as a moderator
     session[:user] = create(:moderator_user).id