From 8618b55ed381d2a1c820bd7b8eb6e44e47ecef56 Mon Sep 17 00:00:00 2001 From: Charles Massry Date: Tue, 15 Oct 2013 17:49:19 -0400 Subject: [PATCH] fixed bug that let users change other users statuses --- README.rdoc | 2 +- app/controllers/statuses_controller.rb | 8 +++--- app/helpers/application_helper.rb | 2 +- app/views/layouts/application.html.erb | 17 ++++++++++--- app/views/statuses/_form.html.erb | 2 +- test/functional/statuses_controller_test.rb | 27 +++++++++++++++++++++ 6 files changed, 48 insertions(+), 10 deletions(-) diff --git a/README.rdoc b/README.rdoc index c8eb01e..a3fa2a5 100644 --- a/README.rdoc +++ b/README.rdoc @@ -2,6 +2,6 @@ A social network for bounty hunters to help find and catch criminals and fugitives. -Ruby version - ruby 1.9.3p194 (2012-04-20 revision 35410) [i686-linux] +Ruby version - ruby 2.0.0p247 (2013-06-27 revision 41674) [i686-linux] Rails version - 3.2.6 diff --git a/app/controllers/statuses_controller.rb b/app/controllers/statuses_controller.rb index f0e4f92..546356f 100644 --- a/app/controllers/statuses_controller.rb +++ b/app/controllers/statuses_controller.rb @@ -41,7 +41,7 @@ def edit # POST /statuses # POST /statuses.json def create - @status = Status.new(params[:status]) + @status = current_user.statuses.new(params[:status]) respond_to do |format| if @status.save @@ -57,8 +57,10 @@ def create # PUT /statuses/1 # PUT /statuses/1.json def update - @status = Status.find(params[:id]) - + @status = current_user.statuses.find(params[:id]) + if params[:status] && params[:status].has_key?(:user_id) + params[:status].delete(:user_id) + end respond_to do |format| if @status.update_attributes(params[:status]) format.html { redirect_to @status, notice: 'Status was successfully updated.' } diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb index 4b153b8..73d2848 100644 --- a/app/helpers/application_helper.rb +++ b/app/helpers/application_helper.rb @@ -2,7 +2,7 @@ module ApplicationHelper def flash_class(type) case type when :alert - "alert-error" + "alert-danger" when :notice "alert-success" else diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb index 523123c..6f38a1b 100644 --- a/app/views/layouts/application.html.erb +++ b/app/views/layouts/application.html.erb @@ -4,14 +4,12 @@ BountyHunterNetwork <%= stylesheet_link_tag "application", "bootstrap.min", "statuses", "profiles" %> - <%= javascript_include_tag "application", "jquery.min", "bootstrap.min", "statuses", "profiles" %> <%= favicon_link_tag 'favicon.ico' %> <%= favicon_link_tag 'touch-icon-iphone-114.png', :rel => 'apple-touch-icon', :type => 'image/png' %> <%= favicon_link_tag 'touch-icon-ipad-144.png', :rel => 'apple-touch-icon', :type => 'image/png' %> <%= csrf_meta_tags %> -