diff options
| author | erdgeist <erdgeist@erdgeist.org> | 2026-08-01 00:27:34 +0200 |
|---|---|---|
| committer | erdgeist <erdgeist@erdgeist.org> | 2026-08-01 00:27:34 +0200 |
| commit | 8bcacace28df52fd972c54e6850aa3b93f5c8bdf (patch) | |
| tree | 05e90dd4e8f31ebb142f66239025da15e873901f /app/views | |
| parent | 529f81b28ed77c62acaa63fad957e751798f2440 (diff) | |
Declare role requirements per controller
RoleRequired supplies require_redaktion and require_admin for surfaces that
are not nodes and so cannot be reached by Node#restricted?.
Navigation is content rather than plumbing, so menu_items requires
redaktion. User management is janitorial and requires admin: index, new,
create, reset_otp, deactivate, reactivate. verify_status now also covers
show, without which any logged-in user could read any account by walking a
small id space. Editing your own account stays open.
The dashboard hides the Users and Navigation buttons from those who cannot
use them; everything else stays visible to everyone. Both denials share one
message and land on the dashboard.
Adds redella (redaktion) and alufa (redaktion + alumni) fixtures.
Diffstat (limited to 'app/views')
| -rw-r--r-- | app/views/admin/index.html.erb | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/app/views/admin/index.html.erb b/app/views/admin/index.html.erb index 984858e5..e3591c4e 100644 --- a/app/views/admin/index.html.erb +++ b/app/views/admin/index.html.erb | |||
| @@ -71,11 +71,15 @@ | |||
| 71 | <%= link_to assets_path, class: "action_button" do %> | 71 | <%= link_to assets_path, class: "action_button" do %> |
| 72 | <%= icon("folder", library: "tabler", "aria-hidden": true) %> <%= t("assets.index.title") %> | 72 | <%= icon("folder", library: "tabler", "aria-hidden": true) %> <%= t("assets.index.title") %> |
| 73 | <% end %> | 73 | <% end %> |
| 74 | <%= link_to users_path, class: "action_button" do %> | 74 | <% if current_user.is_admin? %> |
| 75 | <%= icon("users", library: "tabler", "aria-hidden": true) %> <%= t("users.index.users") %> | 75 | <%= link_to users_path, class: "action_button" do %> |
| 76 | <%= icon("users", library: "tabler", "aria-hidden": true) %> <%= t("users.index.title") %> | ||
| 77 | <% end %> | ||
| 76 | <% end %> | 78 | <% end %> |
| 77 | <%= link_to menu_items_path, class: "action_button" do %> | 79 | <% if current_user.redaktion? %> |
| 78 | <%= icon("menu-2", library: "tabler", "aria-hidden": true) %> <%= t(".navigation") %> | 80 | <%= link_to menu_items_path, class: "action_button" do %> |
| 81 | <%= icon("menu-2", library: "tabler", "aria-hidden": true) %> <%= t(".navigation") %> | ||
| 82 | <% end %> | ||
| 79 | <% end %> | 83 | <% end %> |
| 80 | <% trash_count = Node.trash.children.count %> | 84 | <% trash_count = Node.trash.children.count %> |
| 81 | <%= link_to trashed_nodes_path, class: "action_button" do %> | 85 | <%= link_to trashed_nodes_path, class: "action_button" do %> |