Download as
Browse Code »

Commit bf8cce15ad642444772e447fb3ec516423321d23

Authored by Joenio Costa
Committed by Antonio Terceiro
1 parent 226e4e28
Exists in master and in 29 other branches add_member_task_reject_details, admin_visible_profile, article-list-template, community_notifications, contact_admin_translation, event_fixes, fix_comments_pagination, fix_rails4_organization_ratings, fix_sign_up_form, follow_step_fix, forum_topic_creation, mirror_block_improvements, multi_env_on_remote_user, new_security, noosfero_spb_ci, organization_ratings_improvements, organization_ratings_link_to_profile_stable-spb-1.3, organization_ratings_translations_fix, profile_api_improvements, ratings_minor_fixes, remote_user_fix, send_email_to_admins, stable-spb-1.3, stable-spb-1.3-fixes, stable-spb-1.4, stable-spb-1.5, suggest_rejected_value, web_steps_improvements, xss_terminate_custom_options

ActionItem890: "access denied" page is too ugly

Showing 9 changed files with 41 additions and 24 deletions   Show diff stats
app/controllers/application.rb
  Diff comments   View file @bf8cce1
... ... @@ -96,6 +96,11 @@ class ApplicationController < ActionController::Base
96 96 render :template => 'shared/not_found.rhtml', :status => 404
97 97 end
98 98  
  99 + def render_access_denied(message = nil)
  100 + @message = message
  101 + render :template => 'shared/access_denied.rhtml', :status => 403
  102 + end
  103 +
99 104 def user
100 105 current_user.person if logged_in?
101 106 end
... ...
app/controllers/my_profile_controller.rb
  Diff comments   View file @bf8cce1
... ... @@ -18,8 +18,7 @@ class MyProfileController < ApplicationController
18 18 def self.requires_profile_class(some_class)
19 19 before_filter do |controller|
20 20 unless controller.send(:profile).kind_of?(some_class)
21   - controller.instance_variable_set('@message', _("This action is not available for \"%s\".") % controller.send(:profile).name)
22   - controller.send(:render, :file => File.join(RAILS_ROOT, 'app', 'views', 'shared', 'access_denied.rhtml'), :layout => true, :status => 403)
  21 + controller.send(:render_access_denied, _("This action is not available for \"%s\".") % controller.send(:profile).name)
23 22 end
24 23 end
25 24 end
... ...
app/controllers/public/content_viewer_controller.rb
  Diff comments   View file @bf8cce1
... ... @@ -49,8 +49,7 @@ class ContentViewerController < ApplicationController
49 49 end
50 50  
51 51 if !@page.display_to?(user)
52   - # FIXME find a nice "access denied" layout
53   - render :action => 'access_denied', :status => 403, :layout => false
  52 + render_access_denied(_('You are not allowed to view this content. You can contact the owner of this profile to request access then.'))
54 53 end
55 54  
56 55 # At this point the page will be showed
... ...
app/views/content_viewer/access_denied.rhtml
View file @226e4e2
... ... @@ -1,5 +0,0 @@
1   -<h1><%= _('Access denied') %></h1>
2   -
3   -<p>
4   -<%= _('You are not allowed to view this content.') %>
5   -</p>
app/views/shared/access_denied.rhtml
  Diff comments   View file @bf8cce1
1   -<h2> <%= _('Access denied') %> </h2>
  1 +<div id='access-denied'>
2 2  
3   -<% unless @message.nil? %>
4   - <p>
5   - <%= @message %>
6   - </p>
7   -<% end %>
  3 + <h1> <%= _('Access denied') %> </h1>
  4 +
  5 + <% unless @message.nil? %>
  6 + <p><%= @message %></p>
  7 + <% else %>
  8 + <p><%= _('You are not allowed to view this page.') %></p>
  9 + <% end %>
  10 +
  11 + <ul>
  12 + <li><%= link_to _('Go to the site home page'), :controller => 'home' %></li>
  13 + <li><%= link_to _('Go back'), :back %></li>
  14 + </ul>
  15 +
  16 +</div>
... ...
public/stylesheets/common.css
  Diff comments   View file @bf8cce1
... ... @@ -419,14 +419,16 @@ div.pending-tasks {
419 419 margin: 1em;
420 420 }
421 421  
422   -#content #not-found {
  422 +#content #not-found,
  423 +#content #access-denied {
423 424 padding: 20px;
424 425 margin: 20px;
425 426 border: 1px solid #DDD;
426 427 -moz-border-radius: 6px;
427 428 }
428 429  
429   -#content #not-found h1 {
  430 +#content #not-found h1,
  431 +#content #access-denied h1 {
430 432 text-align: left;
431 433 background: url(../images/icons-app/alert-icon.png) no-repeat;
432 434 padding-left: 30px;
... ...
test/functional/content_viewer_controller_test.rb
  Diff comments   View file @bf8cce1
... ... @@ -410,7 +410,7 @@ class ContentViewerControllerTest &lt; Test::Unit::TestCase
410 410 @request.stubs(:ssl?).returns(true)
411 411 get :view_page, :profile => 'test_profile', :page => [ 'my-intranet' ]
412 412  
413   - assert_template 'access_denied'
  413 + assert_template 'access_denied.rhtml'
414 414 end
415 415  
416 416 should 'not give access to private articles if logged in but not member' do
... ... @@ -421,7 +421,7 @@ class ContentViewerControllerTest &lt; Test::Unit::TestCase
421 421 @request.stubs(:ssl?).returns(true)
422 422 get :view_page, :profile => 'test_profile', :page => [ 'my-intranet' ]
423 423  
424   - assert_template 'access_denied'
  424 + assert_template 'access_denied.rhtml'
425 425 end
426 426  
427 427 should 'give access to private articles if logged in and member' do
... ...
vendor/plugins/access_control/lib/permission_check.rb
  Diff comments   View file @bf8cce1
... ... @@ -21,16 +21,18 @@ module PermissionCheck
21 21 accessor = accessor_method.kind_of?(Symbol) ? c.send(accessor_method) : accessor_method
22 22 unless accessor && accessor.has_permission?(permission.to_s, target)
23 23 # c.instance_variable_set('@b', [accessor, permission, target])
24   - c.send(:render, :file => access_denied_template_path, :status => 403) && false
  24 + c.send(:render, :template => access_denied_template_path, :status => 403) && false
25 25 end
26 26 end
27 27 end
28 28  
29 29 def access_denied_template_path
30   - if File.exists?(File.join(RAILS_ROOT, 'app', 'views','access_control' ,'access_denied.rhtml'))
31   - file_path = File.join(RAILS_ROOT, 'app', 'views','access_control' ,'access_denied.rhtml')
  30 + if File.exists?(File.join(RAILS_ROOT, 'app', 'views', 'access_control', 'access_denied.rhtml'))
  31 + File.join(RAILS_ROOT, 'app', 'views', 'access_control', 'access_denied.rhtml')
  32 + elsif File.exists?(File.join(RAILS_ROOT, 'app','views', 'shared', 'access_denied.rhtml'))
  33 + File.join('shared', 'access_denied.rhtml')
32 34 else
33   - file_path = File.join(File.dirname(__FILE__),'..', 'views','access_denied.rhtml')
  35 + File.join(File.dirname(__FILE__), '..', 'views', 'access_denied.rhtml')
34 36 end
35 37 end
36 38 end
... ...
vendor/plugins/access_control/test/permission_check_test.rb
  Diff comments   View file @bf8cce1
... ... @@ -36,6 +36,12 @@ class PermissionCheckTest &lt; Test::Unit::TestCase
36 36 get :other_stuff, :user => user.id, :resource => resource.id
37 37 assert_response :success
38 38 assert_template nil
39   -
40 39 end
  40 +
  41 + def test_try_render_shared_access_denied_view
  42 + File.expects(:exists?).with(File.join(RAILS_ROOT, 'app', 'views', 'access_control', 'access_denied.rhtml'))
  43 + File.expects(:exists?).with(File.join(RAILS_ROOT, 'app', 'views', 'shared', 'access_denied.rhtml'))
  44 + AccessControlTestController.access_denied_template_path
  45 + end
  46 +
41 47 end
... ...