4509e81dd5
Prior to this commit the following situation existed: > The path /dashboard/analytics/org/:id requires user > authentication (e.g. signed in). However, it does not enforce > authorization. Anyone can see this page. The page, however, uses > javascript to populate the data. So no information, aside from the org > name associated with the :id leaks out. The javascript API end point > enforces organization membership. > > I would expect that the authorization in the HTML rendering would be > the same as the javascript API end point. This commit ensures that the dashboards#analytics end point uses the same policy logic as the API analytics end points. Further, it keeps folks who aren't org members out of the base HTML page for other orgs. Closes forem/forem/#16985
35 lines
635 B
Ruby
35 lines
635 B
Ruby
class OrganizationPolicy < ApplicationPolicy
|
|
def create?
|
|
!user.suspended?
|
|
end
|
|
|
|
def update?
|
|
user.org_admin?(record)
|
|
end
|
|
|
|
def destroy?
|
|
user.org_admin?(record) && record.destroyable?
|
|
end
|
|
|
|
def leave_org?
|
|
part_of_org?
|
|
end
|
|
|
|
def part_of_org?
|
|
return false if record.blank?
|
|
|
|
user.org_member?(record)
|
|
end
|
|
|
|
def admin_of_org?
|
|
return false if record.blank?
|
|
|
|
user.org_admin?(record)
|
|
end
|
|
|
|
alias generate_new_secret? update?
|
|
|
|
# The analytics? policy method is also on the UserPolicy. This exists specifically to allow for
|
|
# "duck-typing" on the tests.
|
|
alias analytics? part_of_org?
|
|
end
|