@@ -49,27+58,31 @@ class ArvadosModel < ActiveRecord::Base
logger.warn "Anonymous user tried to update #{self.class.to_s} #{self.uuid_was}"
return false
end
logger.warn "Anonymous user tried to update #{self.class.to_s} #{self.uuid_was}"
return false
end
+ if !current_user.is_active
+ logger.warn "Inactive user #{current_user.uuid} tried to update #{self.class.to_s} #{self.uuid_was}"
+ return false
+ end
+ return true if current_user.is_admin
if self.uuid_changed?
logger.warn "User #{current_user.uuid} tried to change uuid of #{self.class.to_s} #{self.uuid_was} to #{self.uuid}"
return false
end
if self.uuid_changed?
logger.warn "User #{current_user.uuid} tried to change uuid of #{self.class.to_s} #{self.uuid_was} to #{self.uuid}"
return false
end
- return true if current_user.is_admin
- if self.owner_changed?
- if current_user.uuid == self.owner or
- current_user.can? write: self.owner
+ if self.owner_uuid_changed?
+ if current_user.uuid == self.owner_uuid or
+ current_user.can? write: self.owner_uuid
# current_user is, or has :write permission on, the new owner
else
# current_user is, or has :write permission on, the new owner
else
- logger.warn "User #{current_user.uuid} tried to change owner of #{self.class.to_s} #{self.uuid} to #{self.owner} but does not have permission to write to #{self.owner}"
+ logger.warn "User #{current_user.uuid} tried to change owner_uuid of #{self.class.to_s} #{self.uuid} to #{self.owner_uuid} but does not have permission to write to #{self.owner_uuid}"
return false
end
end
return false
end
end
- if current_user.uuid == self.owner_was or
+ if current_user.uuid == self.owner_uuid_was or
current_user.uuid == self.uuid or
current_user.uuid == self.uuid or
- current_user.can? write: self.owner_was
+ current_user.can? write: self.owner_uuid_was
# current user is, or has :write permission on, the previous owner
return true
else
# current user is, or has :write permission on, the previous owner
return true
else
- logger.warn "User #{current_user.uuid} tried to modify #{self.class.to_s} #{self.uuid} but does not have permission to write #{self.owner_was}"
+ logger.warn "User #{current_user.uuid} tried to modify #{self.class.to_s} #{self.uuid} but does not have permission to write #{self.owner_uuid_was}"
return false
end
end
return false
end
end
@@ -80,10+93,10 @@ class ArvadosModel < ActiveRecord::Base