The Error is You are not authorized to access this page. in former collagues code.
When a user clicked Click me (table below, in person index page) the user should be led to the new page (participant) in order to create a new participant. But if it's clicked, the error rises. Btw the index page for participants is accessible?! I am too new to ROR to code in the ability model (if even necessary). I would first like to have a clue what's going on with the code and why I cannot access the new page to create a new participant.
cancan and devise is used. I guess it has something to to with those but I am too confused right now and I don't know where to start =/.
User Story
If you want to create a new participant of a course you can use a search function which I coded. With this you can search for persons that are already in the system (this works so far). When you've found the desired person, you can click on Click meand you should be led to a page where you can use the persons information to create a new participant of a course.
+-------+---------+---------+----------+
| Title | Prename | Surname | Use |
+-------+---------+---------+----------+
| Dr. | John | Doe | Click me |
+-------+---------+---------+----------+
Here is the ParticipantsController
class ParticipantsController < ApplicationController
before_filter :authenticate_user!, :except => [:index, :show]
before_filter :my_authenticate_user, :only => [:show]
load_and_authorize_resource :course
load_and_authorize_resource :participant, :through => :course, :only => [:new, :create, :destroy]
def index
@participants = Participant.all
respond_to do |format|
format.html # show.html.erb
format.json { render json: @participant }
end
end
def new
@course = Course.find(params[:course_id])
@participant = @course.participants.build
respond_to do |format|
format.html # new.html.erb
format.json { render json: @participant }
end
end
def edit
@participant = Participant.find(params[:id])
authorize! :edit, @participant
end
def create
@course = Course.find(params[:course_id])
@participant = @course.participants.new(params[:participant])
@course.updated_by = current_user.cn
@course.send(:create_version)
@course.tag_version(t(:participant_added))
@course.save!
respond_to do |format|
if @participant.save
format.html { redirect_to course_path(@participant.course), notice: 'Participant was successfully created.' }
format.json { render json: @participant, status: :created, location: @participant }
else
format.html { render action: "new" }
format.json { render json: @participant.errors, status: :unprocessable_entity }
end
end
end
def update
@participant = Participant.find(params[:id])
authorize! :update, @participant
respond_to do |format|
if @participant.update_attributes(params[:participant])
format.html { redirect_to @participant, notice: 'Participant was successfully updated.' }
format.json { head :no_content }
else
format.html { render action: "edit" }
format.json { render json: @participant.errors, status: :unprocessable_entity }
end
end
end
def destroy
@course = Course.find(params[:course_id])
@participant = @course.participants.find(params[:id])
@participant.destroy
redirect_to course_path(@course)
end
private
def my_authenticate_user
myreturn = false
@public_function_ids = Function.select("id").where(:english => ["Sponsor","Principal Investigator","Responsible contact"])
@participant = Participant.find(params[:id])
@public_function_ids.each do |p|
if p.id == @participant.function_id
myreturn = true
end
end
if myreturn == false
authenticate_user!
else
return myreturn
end
end
end
Here is the PersonsController
class PersonsController < ApplicationController
before_filter :authenticate_user!, :except => [:new, :index, :show]
load_and_authorize_resource :course
load_and_authorize_resource :person, :through => :participant, :only => [:create, :destroy]
helper_method :sort_column, :sort_direction
autocomplete :person, :prename, :display_value => :display_autocomplete, :extra_data => [:title, :prename, :surname]
autocomplete :person, :surname, :display_value => :display_autocomplete, :extra_data => [:title, :prename, :surname]
autocomplete :organization, :description, :full => true, :limit => Rails.configuration.autocomplete_limit
def index
unless params[:search_me]
@search_me = ''
else
@search_me = params[:search_me]
end
if params[:search_me]
@persons = Person.search_me(params[:search_me]).order(sort_column +' ' + sort_direction).paginate(:per_page => 5, :page => params[:page])
else
@persons = Person.select('persons.*, count(participants.person_id)
AS participant_count').joins(:participants).group('participants.person_id').order('participant_count desc').limit(3)
end
respond_to do |format|
format.html # index.html.erb
format.json { render json: @persons }
end
end
def show
@person = Person.find(params[:id])
authorize! :show, @person
respond_to do |format|
format.html # show.html.erb
format.json { render json: @person }
end
end
def new
@person = Person.new
respond_to do |format|
format.html # new.html.erb
format.json { render json: @person}
end
end
def edit
@person = Person.find(params[:id])
authorize! :edit, @person #
end
def create
@person = Person.new(params[:person])
@person.courses << @course
respond_to do |format|
if @person.save
format.html { redirect_to @person, notice: 'Person was successfully created.' }
format.json { render json: @person, status: :created, location: @person }
else
format.html { render action: "new" }
format.json { render json: @person.errors, status: :unprocessable_entity }
end
end
end
def update
@person = Person.find(params[:id])
authorize! :update, @person
respond_to do |format|
if @person.update_attributes(params[:person])
format.html { redirect_to @person, notice: 'Person was successfully updated.' }
format.json { head :no_content }
else
format.html { render action: "edit" }
format.json { render json: @person.errors, status: :unprocessable_entity }
end
end
end
def destroy
@person = Person.find(params[:id])
@person.destroy
respond_to do |format|
format.html { redirect_to person_url }
format.json { head :no_content }
end
end
private
def sort_column
Person.column_names.include?(params[:sort]) ? params[:sort] : "prename"
end
def sort_direction
%w[asc desc].include?(params[:direction]) ? params[:direction] : "asc"
end
def my_authenticate_user
…
end
end
Here is the Participant model
class Participant < ActiveRecord::Base
belongs_to :trial
belongs_to :function
belongs_to :person
attr_accessible :trial_id, :function_id, :person_id, :person_prename
Here is the Person model
class Person < ActiveRecord::Base
belongs_to :organization
attr_accessible :organization_id,:title,:prename,:surname,:street,
:street_number,:zip_code,:city,:phone,:fax,:email,:organization_description has_many :participants has_many :courses, through: :participants
Here is the app/views/persons/_index_tail.html.erb
<fieldset>
<legend class="bold"><% if params[:search_me]%><%="Results%><%else%><%="Top 3 used participants"%><%end%></legend>
<table class="person center">
<tr>
<th><%= t(:title) %></th>
<th><%= t(:prename)%></th>
<th><%= t(:surname) %></th>
<th><%= t(:street) %></th>
<th><%= t(:city) %></th>
<th>Verwenden</th>
</tr>
<%# @personcount = 0 %>
<% @persons.each do |person| %>
<tr>
<td><%=person.title %></td>
<td><%=person.prename %></td>
<td><%=person.surname %></td>
<td><%=person.street %></td>
<td><%=person.city %></td>
<%if user_signed_in?%>
<td><%= link_to image_tag("user_silhouette.png",
{ :title => t(:show) }), new_participant_path(@participant) %></td>
<%end%>
</tr>
<% end %>
</table>
</fieldset>
