Contents

class UsersController < ApplicationController
  before_filter :authenticate_user!
  before_filter :admin_only, :except => :show

  def index
    @users = User.all
  end

  def show
    @user = User.find(params[:id])
    unless current_user.admin?
      unless @user == current_user
        redirect_to :back, :alert => "Access denied."
      end
    end
  end

  def update
    @user = User.find(params[:id])
    if @user.update_attributes(secure_params)
      redirect_to :back, :notice => "User updated."
    else
      redirect_to :back, :alert => "Unable to update user."
    end
  end

  def destroy
    user = User.find(params[:id])
    user.destroy
    redirect_to users_path, :notice => "User deleted."
  end

  private

  def admin_only
    unless current_user.admin?
      redirect_to :back, :alert => "Access denied."
    end
  end

  def secure_params
    if @user == current_user
      params.require(:user).permit(:email)
    elsif current_user.admin?
      params.require(:user).permit(:role)
    end
  end

end

Version data entries

3 entries across 3 versions & 1 rubygems

Version	Path
rails_apps_pages-0.5.15	lib/generators/pages/roles/templates/omniauth/users_controller.rb
rails_apps_pages-0.5.14	lib/generators/pages/roles/templates/omniauth/users_controller.rb
rails_apps_pages-0.5.13	lib/generators/pages/roles/templates/omniauth/users_controller.rb