User Admin Security - Githubissues

voidlily / timeboard

Georgia Tech CoC TA timesheets

4 stars 1 forks source link

User Admin Security #27

Closed jking31cs closed 13 years ago

jking31cs commented 13 years ago

Right now, anyone can access the user admin pages by straight up typing it in the address bar. DO VALIDATION DAMNIT, add a before filter on the users controller and courses controller that ensure that the logged in user is a user admin

apmonroe commented 13 years ago

put a require_admin method in admin user and course controller. called in a before_filter. added individual checking for the show action in users controller. show action for courses is globally visible to logged in users