From e4480115de5a65dcfb133a6bccd256c19480af86 Mon Sep 17 00:00:00 2001 From: Leah Bueing Date: Wed, 26 Oct 2016 22:19:50 -0700 Subject: [PATCH 1/2] added relationships between user and task models, only a user sees tasks that beling to them --- app/controllers/tasks_controller.rb | 8 ++++++++ app/models/task.rb | 1 + app/models/user.rb | 1 + config/routes.rb | 2 +- 4 files changed, 11 insertions(+), 1 deletion(-) diff --git a/app/controllers/tasks_controller.rb b/app/controllers/tasks_controller.rb index 9fd4f83cc..77e9dc993 100644 --- a/app/controllers/tasks_controller.rb +++ b/app/controllers/tasks_controller.rb @@ -1,5 +1,9 @@ class TasksController < ApplicationController def index + if @mytask.user_id != session[:user_id] + flash[:notice] = "You cannot view a task list that is not your own." + redirect_to homepage_path + end @tasks = Task.where(user_id: session[:user_id]) @user = User.find(session[:user_id]) end @@ -10,6 +14,10 @@ def new def show @mytask = Task.find(params[:id].to_i) + if @mytask.user_id != session[:user_id] + flash[:notice] = "You cannot view tasks that are not your own." + redirect_to homepage_path + end end def delete diff --git a/app/models/task.rb b/app/models/task.rb index 935f76e12..5c58542c4 100644 --- a/app/models/task.rb +++ b/app/models/task.rb @@ -1,2 +1,3 @@ class Task < ActiveRecord::Base + belongs_to :user end diff --git a/app/models/user.rb b/app/models/user.rb index f6c13853a..c3d95eb89 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -1,4 +1,5 @@ class User < ActiveRecord::Base + has_many :tasks validates :email, :uid, :provider, presence: true def self.build_from_github(auth_hash) diff --git a/config/routes.rb b/config/routes.rb index a9de6b90d..2fa4e024c 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -28,7 +28,7 @@ get "/auth/:provider/callback" => "sessions#create" - get 'homepages/index' + get 'homepages/index', as: 'homepage' # The priority is based upon order of creation: first created -> highest priority. # See how all your routes lay out with "rake routes". From e145c7a63645532d4891b951c64a476d29859f66 Mon Sep 17 00:00:00 2001 From: Leah Bueing Date: Wed, 26 Oct 2016 22:23:45 -0700 Subject: [PATCH 2/2] users must be logged in to create a task, users cannot edit tasks that are not their own --- app/controllers/tasks_controller.rb | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/app/controllers/tasks_controller.rb b/app/controllers/tasks_controller.rb index 77e9dc993..2ef7f0e86 100644 --- a/app/controllers/tasks_controller.rb +++ b/app/controllers/tasks_controller.rb @@ -15,7 +15,7 @@ def new def show @mytask = Task.find(params[:id].to_i) if @mytask.user_id != session[:user_id] - flash[:notice] = "You cannot view tasks that are not your own." + flash[:notice] = "You cannot view or edit tasks that are not your own." redirect_to homepage_path end end @@ -41,6 +41,10 @@ def update end def create + if session[:user_id] = nil + flash[:notice] = "You must be logged in to create a task." + redirect_to homepage_path + end @params = params @mytask = Task.new @mytask.task_name = params[:task][:task_name]