ActionItem1034: access denied page should not use blocks of the current profile

* not show sideboxes when render access denied * fix tests for access_control plugin * remove unused helper UsesDesignBlocksHelper * profile design needs login

ActionItem1034: access denied page should not use blocks of the current profile
* not show sideboxes when render access denied * fix tests for access_control plugin * remove unused helper UsesDesignBlocksHelper * profile design needs login
Joenio Costa · Antonio Terceiro
1 parent 8a9f6087
Showing 7 changed files with 38 additions and 14 deletions Show diff stats
app/controllers/application.rb
app/controllers/box_organizer_controller.rb
app/helpers/boxes_helper.rb
test/functional/profile_design_controller_test.rb
vendor/plugins/access_control/lib/permission_check.rb
vendor/plugins/access_control/test/schema.rb
vendor/plugins/access_control/test/test_helper.rb
@@ -37,12 +37,6 @@ class ApplicationController &lt; ActionController::Base
   def uses_design_blocks?
     !@no_design_blocks && self.class.uses_design_blocks?
   end
-  module UsesDesignBlocksHelper
-    def uses_design_blocks?
-      @controller.uses_design_blocks?
-    end
-  end
-  helper UsesDesignBlocksHelper
   # Be sure to include AuthenticationSystem in Application Controller instead
   include AuthenticatedSystem
 class BoxOrganizerController < ApplicationController
+  before_filter :login_required
+
   def index
   end
 module BoxesHelper
   def insert_boxes(content)
-    if @controller.send(:boxes_editor?)
+    if @controller.send(:boxes_editor?) && @controller.send(:uses_design_blocks?)
       content + display_boxes_editor(@controller.boxes_holder)
     else
       if @controller.send(:uses_design_blocks?)
@@ -12,7 +12,7 @@ class ProfileDesignControllerTest &lt; Test::Unit::TestCase
     @request.stubs(:ssl?).returns(true)
     @response   = ActionController::TestResponse.new
-    @holder = create_user('designtestuser').person
+    @profile = @holder = create_user('designtestuser').person
     holder.save!
     @box1 = Box.new
@@ -65,6 +65,7 @@ class ProfileDesignControllerTest &lt; Test::Unit::TestCase
     @controller.stubs(:boxes_holder).returns(holder)
     login_as 'designtestuser'
   end
+  attr_reader :profile
   def test_local_files_reference
     assert_local_files_reference :get, :index, :profile => 'designtestuser'
@@ -319,4 +320,17 @@ class ProfileDesignControllerTest &lt; Test::Unit::TestCase
     assert_equal 20, @box1.blocks[-1].limit
   end
+  should 'require login' do
+    logout
+    get :index, :profile => profile.identifier
+    assert_redirected_to :controller => 'account', :action => 'login'
+  end
+
+  should 'not show sideboxes when render access denied' do
+    another_profile = create_user('bobmarley').person
+    get :index, :profile => another_profile.identifier
+    assert_tag :tag => 'div', :attributes => {:class => 'no-boxes'}
+    assert_tag :tag => 'div', :attributes => {:id => 'access-denied'}
+  end
+
 end
@@ -20,12 +20,19 @@ module PermissionCheck
           target = target_method.kind_of?(Symbol) ? c.send(target_method) : target_method
           accessor = accessor_method.kind_of?(Symbol) ? c.send(accessor_method) : accessor_method
           unless accessor && accessor.has_permission?(permission.to_s, target)
-#            c.instance_variable_set('@b', [accessor, permission, target])
-            c.send(:render, :template => access_denied_template_path, :status => 403) && false
+            render_access_denied(c) && false
           end
       end
     end
+    def render_access_denied(c)
+      if c.respond_to?(:render_access_denied)
+        c.send(:render_access_denied)
+      else
+        c.send(:render, :template => access_denied_template_path, :status => 403)
+      end
+    end
+
     def access_denied_template_path
       if File.exists?(File.join(RAILS_ROOT, 'app', 'views', 'access_control', 'access_denied.rhtml'))
         File.join(RAILS_ROOT, 'app', 'views', 'access_control', 'access_denied.rhtml')
@@ -3,10 +3,11 @@ ActiveRecord::Migration.verbose = false
 ActiveRecord::Schema.define(:version => 0) do
   create_table :access_control_test_roles, :force => true do |t|
-   t.column :name,        :string
-   t.column :permissions, :string
-   t.column :key,         :string
-   t.column :system,      :boolean, :default => false
+   t.column :name,           :string
+   t.column :permissions,    :string
+   t.column :key,            :string
+   t.column :system,         :boolean, :default => false
+   t.column :environment_id, :integer
   end
   create_table :access_control_test_role_assignments, :force => true do |t|
@@ -18,6 +18,12 @@ RoleAssignment.set_table_name &#39;access_control_test_role_assignments&#39;
 class AccessControlTestAccessor < ActiveRecord::Base
   set_table_name 'access_control_test_accessors'
   acts_as_accessor
+  def cache_keys
+    []
+  end
+  def blocks_to_expire_cache
+    []
+  end
 end
 # resource example class to be accessed by some accessor
	@@ -37,12 +37,6 @@ class ApplicationController < ActionController::Base		@@ -37,12 +37,6 @@ class ApplicationController < ActionController::Base
37	def uses_design_blocks?	37	def uses_design_blocks?
38	!@no_design_blocks && self.class.uses_design_blocks?	38	!@no_design_blocks && self.class.uses_design_blocks?
39	end	39	end
40	- module UsesDesignBlocksHelper
41	- def uses_design_blocks?
42	- @controller.uses_design_blocks?
43	- end
44	- end
45	- helper UsesDesignBlocksHelper
46		40
47	# Be sure to include AuthenticationSystem in Application Controller instead	41	# Be sure to include AuthenticationSystem in Application Controller instead
48	include AuthenticatedSystem	42	include AuthenticatedSystem
1	class BoxOrganizerController < ApplicationController	1	class BoxOrganizerController < ApplicationController
2		2
		3	+ before_filter :login_required
		4	+
3	def index	5	def index
4	end	6	end
5		7
1	module BoxesHelper	1	module BoxesHelper
2		2
3	def insert_boxes(content)	3	def insert_boxes(content)
4	- if @controller.send(:boxes_editor?)	4	+ if @controller.send(:boxes_editor?) && @controller.send(:uses_design_blocks?)
5	content + display_boxes_editor(@controller.boxes_holder)	5	content + display_boxes_editor(@controller.boxes_holder)
6	else	6	else
7	if @controller.send(:uses_design_blocks?)	7	if @controller.send(:uses_design_blocks?)
	@@ -18,6 +18,12 @@ RoleAssignment.set_table_name 'access_control_test_role_assignments'		@@ -18,6 +18,12 @@ RoleAssignment.set_table_name 'access_control_test_role_assignments'
18	class AccessControlTestAccessor < ActiveRecord::Base	18	class AccessControlTestAccessor < ActiveRecord::Base
19	set_table_name 'access_control_test_accessors'	19	set_table_name 'access_control_test_accessors'
20	acts_as_accessor	20	acts_as_accessor
		21	+ def cache_keys
		22	+ []
		23	+ end
		24	+ def blocks_to_expire_cache
		25	+ []
		26	+ end
21	end	27	end
22		28
23	# resource example class to be accessed by some accessor	29	# resource example class to be accessed by some accessor