Merge branch 'master' into AO3-6211-draft-tags-in-bins

app/controllers/application_controller.rb

@@ -269,13 +269,17 @@ def access_denied(options ={})
   def admin_only_access_denied
     respond_to do |format|
       format.html do
-        flash[:error] = ts("Sorry, only an authorized admin can access the page you were trying to reach.")
+        flash[:error] = t("admin.access.page_access_denied") 
         redirect_to root_path
       end
       format.json do
-        errors = [ts("Sorry, only an authorized admin can do that.")]
+        errors = [t("admin.access.action_access_denied")]
         render json: { errors: errors }, status: :forbidden
       end
+      format.js do
+        flash[:error] = t("admin.access.page_access_denied") 
+        render js: "window.location.href = '#{root_path}';" 
+      end
     end
   end
 

app/controllers/archive_faqs_controller.rb

@@ -1,14 +1,14 @@
 class ArchiveFaqsController < ApplicationController
-
   before_action :admin_only, except: [:index, :show]
   before_action :set_locale
   before_action :validate_locale, if: :logged_in_as_admin?
   before_action :require_language_id
+  before_action :default_locale_only, only: [:new, :create, :manage, :update_positions, :confirm_delete, :destroy]
   around_action :with_locale
 
   # GET /archive_faqs
   def index
-    @archive_faqs = ArchiveFaq.order('position ASC')
+    @archive_faqs = ArchiveFaq.order("position ASC")
     unless logged_in_as_admin?
       @archive_faqs = @archive_faqs.with_translations(I18n.locale)
     end
@@ -40,6 +40,7 @@ def show
   end
 
   protected
+
   def build_questions
     notice = ""
     num_to_build = params["num_questions"] ? params["num_questions"].to_i : @archive_faq.questions.count
@@ -59,9 +60,10 @@ def build_questions
   end
 
   public
+
   # GET /archive_faqs/new
   def new
-    @archive_faq = ArchiveFaq.new
+    @archive_faq = authorize ArchiveFaq.new
     1.times { @archive_faq.questions.build(attributes: { question: "This is a temporary question", content: "This is temporary content", anchor: "ThisIsATemporaryAnchor"})}
     respond_to do |format|
       format.html # new.html.erb
@@ -70,32 +72,34 @@ def new
 
   # GET /archive_faqs/1/edit
   def edit
-    @archive_faq = ArchiveFaq.find_by(slug: params[:id])
+    @archive_faq = authorize ArchiveFaq.find_by(slug: params[:id])
+    authorize :archive_faq, :full_access? if default_locale?
     build_questions
   end
 
   # GET /archive_faqs/manage
   def manage
-    @archive_faqs = ArchiveFaq.order('position ASC')
+    @archive_faqs = authorize ArchiveFaq.order("position ASC")
   end
 
   # POST /archive_faqs
   def create
-    @archive_faq = ArchiveFaq.new(archive_faq_params)
-      if @archive_faq.save
-        flash[:notice] = 'ArchiveFaq was successfully created.'
-        redirect_to(@archive_faq)
-      else
-        render action: "new"
-      end
+    @archive_faq = authorize ArchiveFaq.new(archive_faq_params)
+    if @archive_faq.save
+      flash[:notice] = t(".success")
+      redirect_to(@archive_faq)
+    else
+      render action: "new"
+    end
   end
 
   # PUT /archive_faqs/1
   def update
-    @archive_faq = ArchiveFaq.find_by(slug: params[:id])
+    @archive_faq = authorize ArchiveFaq.find_by(slug: params[:id])
+    authorize :archive_faq, :full_access? if default_locale?
 
     if @archive_faq.update(archive_faq_params)
-      flash[:notice] = 'ArchiveFaq was successfully updated.'
+      flash[:notice] = t(".success")
       redirect_to(@archive_faq)
     else
       render action: "edit"
@@ -104,9 +108,10 @@ def update
 
   # reorder FAQs
   def update_positions
+    authorize :archive_faq
     if params[:archive_faqs]
       @archive_faqs = ArchiveFaq.reorder_list(params[:archive_faqs])
-      flash[:notice] = ts("Archive FAQs order was successfully updated.")
+      flash[:notice] = t(".success")
     elsif params[:archive_faq]
       params[:archive_faq].each_with_index do |id, position|
         ArchiveFaq.update(id, position: position + 1)
@@ -149,25 +154,36 @@ def require_language_id
     redirect_to url_for(request.query_parameters.merge(language_id: @i18n_locale.to_s))
   end
 
+  def default_locale_only
+    return if default_locale?
+
+    flash[:error] = t("archive_faqs.default_locale_only")
+    redirect_to archive_faqs_path
+  end
+
   # Setting I18n.locale directly is not thread safe
   def with_locale
     I18n.with_locale(@i18n_locale) { yield }
   end
 
   # GET /archive_faqs/1/confirm_delete
   def confirm_delete
-    @archive_faq = ArchiveFaq.find_by(slug: params[:id])
+    @archive_faq = authorize ArchiveFaq.find_by(slug: params[:id])
   end
 
   # DELETE /archive_faqs/1
   def destroy
-    @archive_faq = ArchiveFaq.find_by(slug: params[:id])
+    @archive_faq = authorize ArchiveFaq.find_by(slug: params[:id])
     @archive_faq.destroy
     redirect_to(archive_faqs_path)
   end
 
   private
 
+  def default_locale?
+    @i18n_locale.to_s == I18n.default_locale.to_s
+  end
+
   def archive_faq_params
     params.require(:archive_faq).permit(
       :title,

app/controllers/inbox_controller.rb

@@ -2,7 +2,7 @@ class InboxController < ApplicationController
   include BlockHelper
 
   before_action :load_user
-  before_action :check_ownership
+  before_action :check_ownership_or_admin
 
   before_action :load_commentable, only: :reply
   before_action :check_blocked, only: :reply
@@ -13,6 +13,7 @@ def load_user
   end
 
   def show
+    authorize InboxComment if logged_in_as_admin?
     @inbox_total = @user.inbox_comments.with_bad_comments_removed.count
     @unread = @user.inbox_comments.with_bad_comments_removed.count_unread
     @filters = filter_params[:filters] || {}
@@ -30,6 +31,7 @@ def reply
   end
 
   def update
+    authorize InboxComment if logged_in_as_admin?
     begin
       @inbox_comments = InboxComment.find(params[:inbox_comments])
       if params[:read]

app/controllers/known_issues_controller.rb

@@ -1,5 +1,4 @@
 class KnownIssuesController < ApplicationController
-
   before_action :admin_only, except: [:index]
 
   # GET /known_issues
@@ -9,25 +8,24 @@ def index
 
   # GET /known_issues/1
   def show
-    @known_issue = KnownIssue.find(params[:id])
+    @known_issue = authorize KnownIssue.find(params[:id])
   end
 
   # GET /known_issues/new
   def new
-    @known_issue = KnownIssue.new
+    @known_issue = authorize KnownIssue.new
   end
 
   # GET /known_issues/1/edit
   def edit
-    @known_issue = KnownIssue.find(params[:id])
+    @known_issue = authorize KnownIssue.find(params[:id])
   end
 
   # POST /known_issues
   def create
-    @known_issue = KnownIssue.new(known_issue_params)
-
+    @known_issue = authorize KnownIssue.new(known_issue_params)
     if @known_issue.save
-      flash[:notice] = 'Known issue was successfully created.'
+      flash[:notice] = "Known issue was successfully created."
       redirect_to(@known_issue)
     else
       render action: "new"
@@ -36,10 +34,9 @@ def create
 
   # PUT /known_issues/1
   def update
-    @known_issue = KnownIssue.find(params[:id])
-
+    @known_issue = authorize KnownIssue.find(params[:id])
     if @known_issue.update(known_issue_params)
-      flash[:notice] = 'Known issue was successfully updated.'
+      flash[:notice] = "Known issue was successfully updated."
       redirect_to(@known_issue)
     else
       render action: "edit"
@@ -48,7 +45,7 @@ def update
 
   # DELETE /known_issues/1
   def destroy
-    @known_issue = KnownIssue.find(params[:id])
+    @known_issue = authorize KnownIssue.find(params[:id])
     @known_issue.destroy
     redirect_to(known_issues_path)
   end

app/controllers/questions_controller.rb

@@ -1,33 +1,34 @@
 class QuestionsController < ApplicationController
-  before_action :load_archive_faq, except: [:index, :update_positions]
+  before_action :load_archive_faq, except: :update_positions
 
   # GET /archive_faq/:archive_faq_id/questions/manage
   def manage
-    @questions = @archive_faq.questions.order('position')
+    authorize :archive_faq, :full_access?
+    @questions = @archive_faq.questions.order("position")
   end
 
   # fetch archive_faq these questions belong to from db
   def load_archive_faq
-    @archive_faq = ArchiveFaq.find_by_slug(params[:archive_faq_id])
+    @archive_faq = ArchiveFaq.find_by(slug: params[:archive_faq_id])
     unless @archive_faq.present?
-      flash[:error] = ts("Sorry, we couldn't find the FAQ you were looking for."
-                        )
+      flash[:error] = t("questions.not_found")
       redirect_to root_path and return
     end
   end
 
   # Update the position number of questions within a archive_faq
   def update_positions
+    authorize :archive_faq, :full_access?
     if params[:questions]
-      @archive_faq = ArchiveFaq.find_by_slug(params[:archive_faq_id])
+      @archive_faq = ArchiveFaq.find_by(slug: params[:archive_faq_id])
       @archive_faq.reorder_list(params[:questions])
-      flash[:notice] = ts("Question order has been successfully updated.")
+      flash[:notice] = t(".success")
     elsif params[:question]
       params[:question].each_with_index do |id, position|
         Question.update(id, position: position + 1)
         (@questions ||= []) << Question.find(id)
       end
-      flash[:notice] = ts("Question order has been successfully updated.")
+      flash[:notice] = t(".success")
     end
     respond_to do |format|
       format.html { redirect_to(@archive_faq) and return }

app/controllers/tag_wranglings_controller.rb

@@ -8,33 +8,36 @@ class TagWranglingsController < ApplicationController
 
   def index
     @counts = tag_counts_per_category
-    unless params[:show].blank?
-      raise "Redshirt: Attempted to constantize invalid class initialize tag_wranglings_controller_index #{params[:show].classify}" unless Tag::USER_DEFINED.include?(params[:show].classify)
+    authorize :wrangling, :read_access? if logged_in_as_admin?
+    return if params[:show].blank?
 
-      params[:sort_column] = 'created_at' if !valid_sort_column(params[:sort_column], 'tag')
-      params[:sort_direction] = 'ASC' if !valid_sort_direction(params[:sort_direction])
+    raise "Redshirt: Attempted to constantize invalid class initialize tag_wranglings_controller_index #{params[:show].classify}" unless Tag::USER_DEFINED.include?(params[:show].classify)
 
-      if params[:show] == "fandoms"
-        @media_names = Media.by_name.pluck(:name)
-        @page_subtitle = ts("fandoms")
-      end
+    params[:sort_column] = "created_at" unless valid_sort_column(params[:sort_column], "tag")
+    params[:sort_direction] = "ASC" unless valid_sort_direction(params[:sort_direction])
 
-      type = params[:show].singularize.capitalize
-      @tags = TagQuery.new({
-                             type: type,
-                             in_use: true,
-                             unwrangleable: false,
-                             unwrangled: true,
-                             has_posted_works: true,
-                             sort_column: params[:sort_column],
-                             sort_direction: params[:sort_direction],
-                             page: params[:page],
-                             per_page: ArchiveConfig.ITEMS_PER_PAGE
-                           }).search_results
+    if params[:show] == "fandoms"
+      @media_names = Media.by_name.pluck(:name)
+      @page_subtitle = t(".page_subtitle")
     end
+
+    type = params[:show].singularize.capitalize
+    @tags = TagQuery.new({
+                           type: type,
+                           in_use: true,
+                           unwrangleable: false,
+                           unwrangled: true,
+                           has_posted_works: true,
+                           sort_column: params[:sort_column],
+                           sort_direction: params[:sort_direction],
+                           page: params[:page],
+                           per_page: ArchiveConfig.ITEMS_PER_PAGE
+                         }).search_results
   end
 
   def wrangle
+    authorize :wrangling, :full_access? if logged_in_as_admin?
+
     params[:page] = '1' if params[:page].blank?
     params[:sort_column] = 'name' if !valid_sort_column(params[:sort_column], 'tag')
     params[:sort_direction] = 'ASC' if !valid_sort_direction(params[:sort_direction])

app/controllers/tags_controller.rb

@@ -56,12 +56,14 @@ def search
     flash_search_warnings(@tags)
   end
 
-  # if user is Admin or Tag Wrangler, show them details about the tag
+  # if user is admin with view access or Tag Wrangler, show them details about the tag
   # if user is not logged in or a regular user, show them
   #   1. the works, if the tag had been wrangled and we can redirect them to works using it or its canonical merger
   #   2. the tag, the works and the bookmarks using it, if the tag is unwrangled (because we can't redirect them
   #       to the works controller)
   def show
+    authorize :wrangling, :read_access? if logged_in_as_admin?
+
     @page_subtitle = @tag.name
     if @tag.is_a?(Banned) && !logged_in_as_admin?
       flash[:error] = ts('Please log in as admin')
@@ -166,6 +168,8 @@ def show_hidden
 
   # GET /tags/new
   def new
+    authorize :wrangling if logged_in_as_admin?
+
     @tag = Tag.new
 
     respond_to do |format|
@@ -209,6 +213,8 @@ def create
   end
 
   def edit
+    authorize :wrangling, :read_access? if logged_in_as_admin?
+
     @page_subtitle = ts('%{tag_name} - Edit', tag_name: @tag.name)
 
     if @tag.is_a?(Banned) && !logged_in_as_admin?
@@ -241,6 +247,8 @@ def edit
   end
 
   def update
+    authorize :wrangling if logged_in_as_admin?
+
     # update everything except for the synonym,
     # so that the associations are there to move when the synonym is created
     syn_string = params[:tag].delete(:syn_string)
@@ -272,6 +280,8 @@ def update
   end
 
   def wrangle
+    authorize :wrangling, :read_access? if logged_in_as_admin?
+
     @page_subtitle = ts('%{tag_name} - Wrangle', tag_name: @tag.name)
     @counts = {}
     @tag.child_types.map { |t| t.underscore.pluralize.to_sym }.each do |tag_type|
@@ -303,6 +313,8 @@ def wrangle
   end
 
   def mass_update
+    authorize :wrangling if logged_in_as_admin?
+
     params[:page] = '1' if params[:page].blank?
     params[:sort_column] = 'name' unless valid_sort_column(params[:sort_column], 'tag')
     params[:sort_direction] = 'ASC' unless valid_sort_direction(params[:sort_direction])