before_action :authorize_web
before_action :set_locale
- before_action :require_user, :only => [:new, :edit, :comment, :hide, :hidecomment, :subscribe, :unsubscribe]
+
+ authorize_resource
+
before_action :lookup_user, :only => [:view, :comments]
before_action :check_database_readable
before_action :check_database_writable, :only => [:new, :edit, :comment, :hide, :hidecomment, :subscribe, :unsubscribe]
- before_action :require_administrator, :only => [:hide, :hidecomment]
before_action :allow_thirdparty_images, :only => [:new, :edit, :list, :view, :comments]
+
def new
@title = t "diary_entry.new.title"
if user
@entries = user.diary_entries
- @title = I18n.t("diary_entry.feed.user.title", :user => user.display_name)
- @description = I18n.t("diary_entry.feed.user.description", :user => user.display_name)
- @link = "#{SERVER_PROTOCOL}://#{SERVER_URL}/user/#{user.display_name}/diary"
+ @title = t("diary_entry.feed.user.title", :user => user.display_name)
+ @description = t("diary_entry.feed.user.description", :user => user.display_name)
+ @link = url_for :controller => "diary_entry", :action => "list", :display_name => user.display_name, :host => SERVER_URL, :protocol => SERVER_PROTOCOL
else
head :not_found
return
if params[:language]
@entries = @entries.where(:language_code => params[:language])
- @title = I18n.t("diary_entry.feed.language.title", :language_name => Language.find(params[:language]).english_name)
- @description = I18n.t("diary_entry.feed.language.description", :language_name => Language.find(params[:language]).english_name)
- @link = "#{SERVER_PROTOCOL}://#{SERVER_URL}/diary/#{params[:language]}"
+ @title = t("diary_entry.feed.language.title", :language_name => Language.find(params[:language]).english_name)
+ @description = t("diary_entry.feed.language.description", :language_name => Language.find(params[:language]).english_name)
+ @link = url_for :controller => "diary_entry", :action => "list", :language => params[:language], :host => SERVER_URL, :protocol => SERVER_PROTOCOL
else
- @title = I18n.t("diary_entry.feed.all.title")
- @description = I18n.t("diary_entry.feed.all.description")
- @link = "#{SERVER_PROTOCOL}://#{SERVER_URL}/diary"
+ @title = t("diary_entry.feed.all.title")
+ @description = t("diary_entry.feed.all.description")
+ @link = url_for :controller => "diary_entry", :action => "list", :host => SERVER_URL, :protocol => SERVER_PROTOCOL
end
end
private
+ # This is required because, being a default-deny system, cancancan
+ # _cannot_ tell you the reason you were denied access; and so
+ # the "nice" feedback presenting next steps can't be gleaned from
+ # the exception
+ ##
+ # for the hide actions, require that the user is a administrator, or fill out
+ # a helpful error message and return them to the user page.
+ def deny_access(exception)
+ if current_user && exception.action.in?([:hide, :hidecomment])
+ flash[:error] = t("user.filter.not_an_administrator")
+ redirect_to :action => "view"
+ else
+ super
+ end
+ end
+
##
# return permitted diary entry parameters
def entry_params
params.require(:diary_comment).permit(:body)
end
- ##
- # require that the user is a administrator, or fill out a helpful error message
- # and return them to the user page.
- def require_administrator
- unless current_user.administrator?
- flash[:error] = t("user.filter.not_an_administrator")
- redirect_to :action => "view"
- end
- end
##
# decide on a location for the diary entry map