diff options
author | Douwe Maan <douwe@gitlab.com> | 2015-07-28 17:32:15 +0300 |
---|---|---|
committer | Douwe Maan <douwe@gitlab.com> | 2015-07-28 17:32:15 +0300 |
commit | f9bcb9632c1f7f5c5c72d50a90289baa2af762f5 (patch) | |
tree | 8f72848f4a2560f52ea99d361d1128e7a7ff2e04 /app/controllers/groups/group_members_controller.rb | |
parent | 43d118803133558209973464b1c16fd4c7ba446c (diff) |
Add specific ability for managing group members
Diffstat (limited to 'app/controllers/groups/group_members_controller.rb')
-rw-r--r-- | app/controllers/groups/group_members_controller.rb | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/app/controllers/groups/group_members_controller.rb b/app/controllers/groups/group_members_controller.rb index 040255f08e6..b9c428a964f 100644 --- a/app/controllers/groups/group_members_controller.rb +++ b/app/controllers/groups/group_members_controller.rb @@ -21,6 +21,8 @@ class Groups::GroupMembersController < Groups::ApplicationController end def create + return render_403 unless can?(current_user, :admin_group_member, @group) + @group.add_users(params[:user_ids].split(','), params[:access_level], current_user) redirect_to group_group_members_path(@group), notice: 'Users were successfully added.' @@ -28,6 +30,9 @@ class Groups::GroupMembersController < Groups::ApplicationController def update @member = @group.group_members.find(params[:id]) + + return render_403 unless can?(current_user, :update_group_member, @member) + @member.update_attributes(member_params) end @@ -46,6 +51,8 @@ class Groups::GroupMembersController < Groups::ApplicationController end def resend_invite + return render_403 unless can?(current_user, :admin_group_member, @group) + redirect_path = group_group_members_path(@group) @group_member = @group.group_members.find(params[:id]) |