[Git][noosfero/noosfero][master] profile-roles: answer not found when accessing person profile

[Rodrigo Souto]

Rodrigo Souto pushed to branch master at Noosfero / noosfero


Commits:
ea121f37 by Rodrigo Souto at 2016-02-16T10:10:42-03:00
profile-roles: answer not found when accessing person profile

- - - - -


2 changed files:

- app/controllers/my_profile/profile_roles_controller.rb
- test/functional/profile_roles_controller_test.rb


Changes:

=====================================
app/controllers/my_profile/profile_roles_controller.rb
=====================================
--- a/app/controllers/my_profile/profile_roles_controller.rb
+++ b/app/controllers/my_profile/profile_roles_controller.rb
@@ -1,6 +1,7 @@
 class ProfileRolesController < MyProfileController
 
   protect 'manage_custom_roles', :profile
+  before_filter :ensure_organization
 
   def index
     @roles = profile.custom_roles
@@ -113,4 +114,8 @@ class ProfileRolesController < MyProfileController
     end
   end
 
+  def ensure_organization
+    render_not_found unless profile.organization?
+  end
+
 end


=====================================
test/functional/profile_roles_controller_test.rb
=====================================
--- a/test/functional/profile_roles_controller_test.rb
+++ b/test/functional/profile_roles_controller_test.rb
@@ -103,4 +103,12 @@ class ProfileRolesControllerTest < ActionController::TestCase
     assert_not_includes community.members_by_role(role), moderator
     assert_not_includes community.members_by_role(moderator_role), moderator
   end
+
+  should 'avoid access with person profile' do
+    person = create_user('sample_user').person
+    login_as person.identifier
+    get :index , :profile => person.identifier
+
+    assert_response 404
+  end
 end



View it on GitLab: https://gitlab.com/noosfero/noosfero/commit/ea121f37f2ce66c963f8e005440e513bce48a86d
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listas.softwarelivre.org/pipermail/noosfero-dev/attachments/20160216/d61084d3/attachment.html>