diff options
author | rhenium <rhenium@rhe.jp> | 2015-04-05 15:58:03 +0900 |
---|---|---|
committer | rhenium <rhenium@rhe.jp> | 2015-04-05 15:58:03 +0900 |
commit | a1812b253efdc1b06dba4ef59b6c3dcc8ef22c54 (patch) | |
tree | 558bb10f0bdf4b0b7b50916a5c3aa5c5e80db21c /app/controllers/application_controller.rb | |
parent | e3d1ef82877f8bbeb6c2e9d6499fdd5ecbc40c94 (diff) | |
download | aclog-a1812b253efdc1b06dba4ef59b6c3dcc8ef22c54.tar.gz |
web: reorganize views
Diffstat (limited to 'app/controllers/application_controller.rb')
-rw-r--r-- | app/controllers/application_controller.rb | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 4bd1112..1718bfa 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -1,6 +1,6 @@ class ApplicationController < ActionController::Base #include SecurityHeaders - include ControllerErrorHandling if Rails.env.production? + include ControllerErrorHandling protect_from_forgery with: :exception @@ -32,8 +32,15 @@ class ApplicationController < ActionController::Base (logged_in? && current_user.permitted_to_see?(user)) end - def authorize_to_show_user!(user) - authorized_to_show_user?(user) || raise(Aclog::Exceptions::UserProtected, user) + def authorize!(object) + if object.is_a? User + authorized_to_show_user?(object) || raise(Aclog::Exceptions::UserProtected, object) + elsif object.is_a? Tweet + authorize! object.user + else + raise ArgumentError, "parameter `object` must be a User or a Tweet" + end + object end private |