From 48ca75cb646c45354bc36b52920fdc03a18fab1f Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Fri, 4 Mar 2016 12:32:41 +0100 Subject: [PATCH] Secured deletion/moderation of screenshots Only logged in users can do that. --- app/controllers/packages_controller.rb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/app/controllers/packages_controller.rb b/app/controllers/packages_controller.rb index f8eebd4..7227323 100644 --- a/app/controllers/packages_controller.rb +++ b/app/controllers/packages_controller.rb @@ -1,4 +1,6 @@ class PackagesController < ApplicationController + before_action :authenticate_user!, only: [:delete_screenshot, :moderate] + def list @packages = query_packages @packages = @packages.paginate(page: params[:page], per_page: 6) @@ -55,9 +57,8 @@ class PackagesController < ApplicationController end def delete_screenshot - @screenshot = Screenshot.find_by(id: params[:id]) + @screenshot = Screenshot.find(params[:id]) @screenshot.destroy - redirect_to package_path end