dallasrb / dallasrb-web

The Dallas Ruby Brigade Website
10 stars 14 forks source link

User authentication not done for profile edit and update actions in Profile controller #19

Closed manusajith closed 11 years ago

manusajith commented 11 years ago

Since user authentication is not checked for edit and update actions in profile controller, current_user cant be called. Code breaks and gives error.

def verify_user!
    unless @profile.email == current_user.email
      redirect_to root_url, :alert => "Access denied."
    end
  end
hkarthik commented 11 years ago

Fixed by PR.