cancan 1.6.0 → 1.6.10

data/CHANGELOG.rdoc

@@ -1,3 +1,124 @@
+1.6.10 (May 7, 2013)
+
+* fix matches_conditons_hash for string values on 1.8 (thanks rrosen)
+
+* work around SQL injection vulnerability in older Rails versions (thanks steerio) - issue #800
+
+* add support for nested join conditions (thanks yuszuv) - issue #806
+
+* fix load_resource "find_by" in mongoid resources (thanks albertobajo) - issue #705
+
+* fix namespace split behavior (thanks xinuc) - issue #668
+
+1.6.9 (February 4, 2013)
+
+* fix inserting AND (NULL) to end of SQL queries (thanks jonsgreen) - issue #687
+
+* fix merge_joins for nested association hashes (thanks DavidMikeSimon) - issues #655, #560
+
+* raise error on recursive alias_action (thanks fl00r) - issue #660
+
+* fix namespace controllers not loading params (thanks andhapp) - issues #670, #664
+
+
+1.6.8 (June 25, 2012)
+
+* improved support for namespaced controllers and models
+
+* pass :if and :unless options for load and authorize resource (thanks mauriciozaffari)
+
+* Travis CI badge (thanks plentz)
+
+* adding Ability#merge for combining multiple abilities (thanks rogercampos)
+
+* support for multiple MetaWhere rules (thanks andhapp)
+
+* various fixes for DataMapper, Mongoid, and Inherited Resource integration
+
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.6.7...1.6.8]
+
+
+1.6.7 (October 4, 2011)
+
+* fixing nested resource problem caused by namespace addition - issue #482
+
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.6.6...1.6.7]
+
+
+1.6.6 (September 28, 2011)
+
+* correct "return cant jump across threads" error when using check_authorization (thanks codeprimate) - issues #463, #469
+
+* fixing tests in development by specifying with_model version  (thanks kirkconnell) - issue #476
+
+* added travis.yml file for TravisCI support (thanks bai) - issue #427
+
+* better support for namespaced models (thanks whilefalse) - issues #424
+
+* adding :id_param option to load_and_authorize_resource (thanks skhisma) - issue #425
+
+* make default unauthorized message translatable text (thanks nhocki) - issue #409
+
+* improving DataMapper behavior (thanks psanford, maxsum-corin) - issue #410, #373
+
+* allow :find_by option to be full find method name - issue #335
+
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.6.5...1.6.6]
+
+
+1.6.5 (May 18, 2011)
+
+* pass action and subject through AccessDenied exception when :through isn't found - issue #366
+
+* many Mongoid adapter improvements (thanks rahearn, cardagin) - issues #363, #352, #343
+
+* allow :through option to work with private controller methods - issue #360
+
+* ensure Mongoid::Document is defined before loading Mongoid adapter - issue #359
+
+* many DataMapper adapter improvements (thanks emmanuel) - issue #355
+
+* handle checking nil attributes through associations (thanks thatothermitch) - issue #330
+
+* improve scope merging - issue #328
+
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.6.4...1.6.5]
+
+
+1.6.4 (March 29, 2011)
+
+* Fixed mongoid 'or' error - see issue #322
+
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.6.3...1.6.4]
+
+
+1.6.3 (March 25, 2011)
+
+* Make sure ActiveRecord::Relation is defined before checking conditions against it so Rails 2 is supported again - see issue #312
+
+* Return subject passed to authorize! - see issue #314
+
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.6.2...1.6.3]
+
+
+1.6.2 (March 18, 2011)
+
+* Fixed instance loading when :singleton option is used - see issue #310
+
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.6.1...1.6.2]
+
+
+1.6.1 (March 15, 2011)
+
+* Use Item.new instead of build_item for singleton resource so it doesn't effect database - see issue #304
+
+* Made accessible_by action default to :index and parent action default to :show instead of :read - see issue #302
+
+* Reverted Inherited Resources "collection" override since it doesn't seem to be working - see issue #305
+
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.6.0...1.6.1]
+
+
 1.6.0 (March 11, 2011)
 
 * Added MetaWhere support - see issue #194 and #261
@@ -18,6 +139,8 @@
 
 * Raise an exception when trying to make a Ability condition with both a hash of conditions and a block - see issue #269
 
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.5.1...1.6.0]
+
 
 1.5.1 (January 20, 2011)
 
@@ -25,6 +148,8 @@
 
 * Improving Mongoid support for multiple can and cannot definitions (thanks stellard) - see issue #239
 
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.5.0...1.5.1]
+
 
 1.5.0 (January 11, 2011)
 
@@ -46,6 +171,8 @@
 
 * Internal: added .rvmrc to auto-switch to 1.8.7 with gemset - see issue #231
 
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.4.1...1.5.0]
+
 
 1.4.1 (November 12, 2010)
 
@@ -59,6 +186,8 @@
 
 * Fix odd behavior when "cache_classes = false" (thanks mphalliday) - see issue #174
 
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.4.0...1.4.1]
+
 
 1.4.0 (October 5, 2010)
 
@@ -98,11 +227,15 @@
 
 * No longer calling block in +can+ definition when checking on class - see issue #116
 
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.3.4...1.4.0]
+
 
 1.3.4 (August 31, 2010)
 
 * Don't stop at +cannot+ with hash conditions when checking class (thanks tamoya) - see issue #131
 
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.3.3...1.3.4]
+
 
 1.3.3 (August 20, 2010)
 
@@ -110,16 +243,22 @@
 
 * Pluralize nested associations for conditions in accessible_by (thanks mlooney) - see issue #123
 
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.3.2...1.3.3]
+
 
 1.3.2 (August 7, 2010)
 
 * Fixing slice error when passing in custom resource name - see issue #112
 
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.3.1...1.3.2]
+
 
 1.3.1 (August 6, 2010)
 
 * Fixing protected sanitize_sql error - see issue #111
 
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.3.0...1.3.1]
+
 
 1.3.0 (August 6, 2010)
 
@@ -147,6 +286,8 @@
 
 * Supporting deeply nested aliases - see issue #98
 
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.2.0...1.3.0]
+
 
 1.2.0 (July 16, 2010)
 
@@ -162,11 +303,15 @@
 
 * Adding joins clause to accessible_by when conditions are across associations
 
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.1.1...1.2.0]
+
 
 1.1.1 (April 17, 2010)
 
 * Fixing behavior in Rails 3 by properly initializing ResourceAuthorization
 
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.1...1.1.1]
+
 
 1.1.0 (April 17, 2010)
 
@@ -190,6 +335,8 @@
 
 * Support additional arguments to can? which get passed to the block - see issue #48
 
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.0.2...1.1]
+
 
 1.0.2 (Dec 30, 2009)
 
@@ -199,6 +346,8 @@
 
 * Adding custom message argument to unauthorized! method (thanks tjwallace) - see issue #18
 
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.0.1...1.0.2]
+
 
 1.0.1 (Dec 14, 2009)
 
@@ -206,6 +355,8 @@
 
 * Don't fetch parent of nested resource if *_id parameter is missing so it works with shallow nested routes - see issue #14
 
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/1.0.0...1.0.1]
+
 
 1.0.0 (Dec 13, 2009)
 
@@ -221,6 +372,8 @@
 
 * BACKWARDS INCOMPATIBLE: turning load and authorize resource methods into class methods which set up the before filter so they can accept additional arguments.
 
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/0.2.1...1.0.0]
+
 
 0.2.1 (Nov 26, 2009)
 
@@ -230,6 +383,8 @@
 
 * support custom objects (usually symbols) in can definition - see issue #8
 
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/0.2.0...0.2.1]
+
 
 0.2.0 (Nov 17, 2009)
 
@@ -241,6 +396,8 @@
 
 * BACKWARDS INCOMPATIBLE: use Ability#initialize instead of 'prepare' to set up abilities - see issue #4
 
+* {see the full list of changes}[https://github.com/ryanb/cancan/compare/0.1.0...0.2.0]
+
 
 0.1.0 (Nov 16, 2009)
 

data/CONTRIBUTING.md

@@ -0,0 +1,11 @@
+### Please read before contributing
+
+1) If you have any questions about CanCan, search the [Wiki](https://github.com/ryanb/cancan/wiki) or use [Stack Overflow](http://stackoverflow.com/questions/tagged/cancan). Do not post questions here.
+
+2) If you find a security bug, **DO NOT** submit an issue here. Please send an e-mail to [ryan@railscasts.com](mailto:ryan@railscasts.com) instead.
+
+3) Do a small search on the issues tracker before submitting your issue to see if it was already reported / fixed. In case it was not, create your report including Rails and CanCan versions. If you are getting exceptions, please include the full backtrace.
+
+That's it! The more information you give, the more easy it becomes for us to track it down and fix it. Ideal scenario would be adding the issue to CanCan test suite or to a sample application.
+
+Thanks!

data/Gemfile

@@ -3,8 +3,8 @@ source "http://rubygems.org"
 case ENV["MODEL_ADAPTER"]
 when nil, "active_record"
   gem "sqlite3"
-  gem "activerecord", :require => "active_record"
-  gem "with_model"
+  gem "activerecord", '~> 3.0.9', :require => "active_record"
+  gem "with_model", "~> 0.2.5"
   gem "meta_where"
 when "data_mapper"
   gem "dm-core", "~> 1.0.2"

data/README.rdoc

@@ -1,4 +1,4 @@
-= CanCan
+= CanCan {<img src="https://fury-badge.herokuapp.com/rb/cancan.png" alt="Gem Version" />}[http://badge.fury.io/rb/cancan] {<img src="https://secure.travis-ci.org/ryanb/cancan.png?branch=master" />}[http://travis-ci.org/ryanb/cancan] {<img src="https://codeclimate.com/badge.png" />}[https://codeclimate.com/github/ryanb/cancan]
 
 Wiki[https://github.com/ryanb/cancan/wiki] | RDocs[http://rdoc.info/projects/ryanb/cancan] | Screencast[http://railscasts.com/episodes/192-authorization-with-cancan]
 
@@ -31,6 +31,15 @@ User permissions are defined in an +Ability+ class. CanCan 1.5 includes a Rails
 
   rails g cancan:ability
 
+In Rails 2.3, just add a new class in `app/models/ability.rb` with the folowing contents:
+
+  class Ability
+    include CanCan::Ability
+
+    def initialize(user)
+    end
+  end
+
 See {Defining Abilities}[https://github.com/ryanb/cancan/wiki/defining-abilities] for details.
 
 

data/lib/cancan/ability.rb

@@ -172,10 +172,16 @@ module CanCan
     # This way one can use params[:action] in the controller to determine the permission.
     def alias_action(*args)
       target = args.pop[:to]
+      validate_target(target)
       aliased_actions[target] ||= []
       aliased_actions[target] += args
     end
 
+    # User shouldn't specify targets with names of real actions or it will cause Seg fault
+    def validate_target(target)
+      raise Error, "You can't specify target (#{target}) as alias because it is real action name" if aliased_actions.values.flatten.include? target
+    end
+
     # Returns a hash of aliased actions. The key is the target and the value is an array of actions aliasing the key.
     def aliased_actions
       @aliased_actions ||= default_alias_actions
@@ -201,6 +207,7 @@ module CanCan
         message ||= unauthorized_message(action, subject)
         raise AccessDenied.new(message, action, subject)
       end
+      subject
     end
 
     def unauthorized_message(action, subject)
@@ -227,6 +234,13 @@ module CanCan
       relevant_rules(action, subject).any?(&:only_raw_sql?)
     end
 
+    def merge(ability)
+      ability.send(:rules).each do |rule|
+        rules << rule.dup
+      end
+      self
+    end
+
     private
 
     def unauthorized_message_keys(action, subject)

data/lib/cancan/controller_additions.rb

@@ -94,7 +94,12 @@ module CanCan
       # [:+find_by+]
       #   Find using a different attribute other than id. For example.
       #
-      #     load_resource :find_by => :permalink # will use find_by_permlink!(params[:id])
+      #     load_resource :find_by => :permalink # will use find_by_permalink!(params[:id])
+      #
+      # [:+id_param+]
+      #   Find using a param key other than :id. For example:
+      #
+      #     load_resource :id_key => :url # will use find(params[:url])
       #
       # [:+collection+]
       #   Specify which actions are resource collection actions in addition to :+index+. This
@@ -151,6 +156,9 @@ module CanCan
       # [:+except+]
       #   Does not apply before filter to given actions.
       #
+      # [:+singleton+]
+      #   Pass +true+ if this is a singleton resource through a +has_one+ association.
+      #
       # [:+parent+]
       #   True or false depending on if the resource is considered a parent resource. This defaults to +true+ if a resource
       #   name is given which does not match the controller.
@@ -186,7 +194,7 @@ module CanCan
         skip_authorize_resource(*args)
       end
 
-      # Skip both the loading behavior of CanCan. This is useful when using +load_and_authorize_resource+ but want to
+      # Skip the loading behavior of CanCan. This is useful when using +load_and_authorize_resource+ but want to
       # only do authorization on certain actions. You can pass :only and :except options to specify which actions to
       # skip the effects on. It will apply to all actions by default.
       #
@@ -202,7 +210,7 @@ module CanCan
         cancan_skipper[:load][name] = options
       end
 
-      # Skip both the authorization behavior of CanCan. This is useful when using +load_and_authorize_resource+ but want to
+      # Skip the authorization behavior of CanCan. This is useful when using +load_and_authorize_resource+ but want to
       # only do loading on certain actions. You can pass :only and :except options to specify which actions to
       # skip the effects on. It will apply to all actions by default.
       #
@@ -247,9 +255,9 @@ module CanCan
       #
       def check_authorization(options = {})
         self.after_filter(options.slice(:only, :except)) do |controller|
-          return if controller.instance_variable_defined?(:@_authorized)
-          return if options[:if] && !controller.send(options[:if])
-          return if options[:unless] && controller.send(options[:unless])
+          next if controller.instance_variable_defined?(:@_authorized)
+          next if options[:if] && !controller.send(options[:if])
+          next if options[:unless] && controller.send(options[:unless])
           raise AuthorizationNotPerformed, "This action failed the check_authorization because it does not authorize_resource. Add skip_authorization_check to bypass this check."
         end
       end
@@ -286,7 +294,7 @@ module CanCan
 
     def self.included(base)
       base.extend ClassMethods
-      base.helper_method :can?, :cannot?
+      base.helper_method :can?, :cannot?, :current_ability
     end
 
     # Raises a CanCan::AccessDenied exception if the current_ability cannot
@@ -382,7 +390,7 @@ module CanCan
   end
 end
 
-if defined? ActionController
+if defined? ActionController::Base
   ActionController::Base.class_eval do
     include CanCan::ControllerAdditions
   end

data/lib/cancan/controller_resource.rb

@@ -6,8 +6,8 @@ module CanCan
       options = args.extract_options!
       resource_name = args.first
       before_filter_method = options.delete(:prepend) ? :prepend_before_filter : :before_filter
-      controller_class.send(before_filter_method, options.slice(:only, :except)) do |controller|
-        controller.class.cancan_resource_class.new(controller, resource_name, options.except(:only, :except)).send(method)
+      controller_class.send(before_filter_method, options.slice(:only, :except, :if, :unless)) do |controller|
+        controller.class.cancan_resource_class.new(controller, resource_name, options.except(:only, :except, :if, :unless)).send(method)
       end
     end
 
@@ -82,38 +82,60 @@ module CanCan
     end
 
     def build_resource
-      method_name = @options[:singleton] && resource_base.respond_to?("build_#{name}") ? "build_#{name}" : "new"
-      resource = resource_base.send(method_name, @params[name] || {})
-      initial_attributes.each do |name, value|
-        resource.send("#{name}=", value)
+      resource = resource_base.new(resource_params || {})
+      assign_attributes(resource)
+    end
+
+    def assign_attributes(resource)
+      resource.send("#{parent_name}=", parent_resource) if @options[:singleton] && parent_resource
+      initial_attributes.each do |attr_name, value|
+        resource.send("#{attr_name}=", value)
       end
       resource
     end
 
     def initial_attributes
       current_ability.attributes_for(@params[:action].to_sym, resource_class).delete_if do |key, value|
-        @params[name] && @params[name].include?(key)
+        resource_params && resource_params.include?(key)
       end
     end
 
     def find_resource
-      if @options[:singleton] && resource_base.respond_to?(name)
-        resource_base.send(name)
+      if @options[:singleton] && parent_resource.respond_to?(name)
+        parent_resource.send(name)
       else
-        @options[:find_by] ? resource_base.send("find_by_#{@options[:find_by]}!", id_param) : resource_base.find(id_param)
+        if @options[:find_by]
+          if resource_base.respond_to? "find_by_#{@options[:find_by]}!"
+            resource_base.send("find_by_#{@options[:find_by]}!", id_param)
+          elsif resource_base.respond_to? "find_by"
+            resource_base.send("find_by", { @options[:find_by].to_sym => id_param })
+          else
+            resource_base.send(@options[:find_by], id_param)
+          end
+        else
+          adapter.find(resource_base, id_param)
+        end
       end
     end
 
+    def adapter
+      ModelAdapters::AbstractAdapter.adapter_class(resource_class)
+    end
+
     def authorization_action
-      parent? ? :read : @params[:action].to_sym
+      parent? ? :show : @params[:action].to_sym
     end
 
     def id_param
-      @params[parent? ? :"#{name}_id" : :id]
+      if @options[:id_param]
+        @params[@options[:id_param]]
+      else
+        @params[parent? ? :"#{name}_id" : :id]
+      end.to_s
     end
 
     def member_action?
-      new_actions.include?(@params[:action].to_sym) || (@params[:id] && !collection_actions.include?(@params[:action].to_sym))
+      new_actions.include?(@params[:action].to_sym) || @options[:singleton] || ( (@params[:id] || @params[@options[:id_param]]) && !collection_actions.include?(@params[:action].to_sym))
     end
 
     # Returns the class used for this resource. This can be overriden by the :class option.
@@ -122,7 +144,7 @@ module CanCan
     def resource_class
       case @options[:class]
       when false  then name.to_sym
-      when nil    then name.to_s.camelize.constantize
+      when nil    then namespaced_name.to_s.camelize.constantize
       when String then @options[:class].constantize
       else @options[:class]
       end
@@ -155,26 +177,30 @@ module CanCan
     def resource_base
       if @options[:through]
         if parent_resource
-          @options[:singleton] ? parent_resource : parent_resource.send(@options[:through_association] || name.to_s.pluralize)
+          @options[:singleton] ? resource_class : parent_resource.send(@options[:through_association] || name.to_s.pluralize)
         elsif @options[:shallow]
           resource_class
         else
-          raise AccessDenied # maybe this should be a record not found error instead?
+          raise AccessDenied.new(nil, authorization_action, resource_class) # maybe this should be a record not found error instead?
         end
       else
         resource_class
       end
     end
 
+    def parent_name
+      @options[:through] && [@options[:through]].flatten.detect { |i| fetch_parent(i) }
+    end
+
     # The object to load this resource through.
     def parent_resource
-      @options[:through] && [@options[:through]].flatten.map { |i| fetch_parent(i) }.compact.first
+      parent_name && fetch_parent(parent_name)
     end
 
     def fetch_parent(name)
       if @controller.instance_variable_defined? "@#{name}"
         @controller.instance_variable_get("@#{name}")
-      elsif @controller.respond_to? name
+      elsif @controller.respond_to?(name, true)
         @controller.send(name)
       end
     end
@@ -187,6 +213,29 @@ module CanCan
       @name || name_from_controller
     end
 
+    def resource_params
+      if @options[:class]
+        params_key = extract_key(@options[:class])
+        return @params[params_key] if @params[params_key]
+      end
+
+      resource_params_by_namespaced_name
+    end
+
+    def resource_params_by_namespaced_name
+      @params[extract_key(namespaced_name)]
+    end
+
+    def namespace
+      @params[:controller].split(/::|\//)[0..-2]
+    end
+
+    def namespaced_name
+      [namespace, name.camelize].join('::').singularize.camelize.constantize
+    rescue NameError
+      name
+    end
+
     def name_from_controller
       @params[:controller].sub("Controller", "").underscore.split('/').last.singularize
     end
@@ -202,5 +251,11 @@ module CanCan
     def new_actions
       [:new, :create] + [@options[:new]].flatten
     end
+
+    private
+
+    def extract_key(value)
+       value.to_s.underscore.gsub('/', '_')
+    end
   end
 end

data/lib/cancan/exceptions.rb

@@ -40,7 +40,7 @@ module CanCan
       @message = message
       @action = action
       @subject = subject
-      @default_message = "You are not authorized to access this page."
+      @default_message = I18n.t(:"unauthorized.default", :default => "You are not authorized to access this page.")
     end
 
     def to_s

data/lib/cancan/inherited_resource.rb

@@ -6,14 +6,15 @@ module CanCan
         @controller.send :association_chain
         @controller.instance_variable_get("@#{instance_name}")
       elsif new_actions.include? @params[:action].to_sym
-        @controller.send :build_resource
+        resource = @controller.send :build_resource
+        assign_attributes(resource)
       else
         @controller.send :resource
       end
     end
 
     def resource_base
-      @controller.send :collection
+      @controller.send :end_of_association_chain
     end
   end
 end

data/lib/cancan/matchers.rb

@@ -1,5 +1,5 @@
-RSpec = Spec unless defined? RSpec # for RSpec 1 compatability
-RSpec::Matchers.define :be_able_to do |*args|
+rspec_module = defined?(RSpec::Core) ? 'RSpec' : 'Spec'  # for RSpec 1 compatability
+Kernel.const_get(rspec_module)::Matchers.define :be_able_to do |*args|
   match do |ability|
     ability.can?(*args)
   end

data/lib/cancan/model_adapters/abstract_adapter.rb

@@ -15,6 +15,11 @@ module CanCan
         false # override in subclass
       end
 
+      # Override if you need custom find behavior
+      def self.find(model_class, id)
+        model_class.find(id)
+      end
+
       # Used to determine if this model adapter will override the matching behavior for a hash of conditions.
       # If this returns true then matches_conditions_hash? will be called. See Rule#matches_conditions_hash
       def self.override_conditions_hash_matching?(subject, conditions)