From 6182078cddada65b1413cb87e0ec1dedea38dbf8 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Fri, 10 Aug 2018 16:20:53 +0200 Subject: [PATCH] Restrict admin controller to admins --- app/controllers/admin_controller.rb | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/app/controllers/admin_controller.rb b/app/controllers/admin_controller.rb index dc0674e..c7cbd62 100644 --- a/app/controllers/admin_controller.rb +++ b/app/controllers/admin_controller.rb @@ -1,5 +1,6 @@ class AdminController < ApplicationController before_action :authenticate_user! + before_action :admin_only def status end @@ -20,4 +21,15 @@ class AdminController < ApplicationController @logs = logs.paginate(page: params[:page], per_page: 20) end + + + private + + def admin_only + unless current_user.is_admin? + head :forbidden + # redirect_to :back, :alert => "Access denied." + end + end + end