All protected routes are tested

2026-03-25 01:14:43 +00:00 · 2015-10-30 13:37:18 -04:00
parent 4b78be8214
commit 2dda49cd12
2 changed files with 68 additions and 4 deletions
--- a/app/controllers/static_pages_controller.rb
+++ b/app/controllers/static_pages_controller.rb
@@ -123,7 +123,10 @@ class StaticPagesController < ApplicationController
 	private
 	def check_access
 	  if params[:tournament]
-	     @tournament = params[:tournament]	
+	     @tournament = Tournament.find(params[:tournament])
+	     if current_user != @tournament.user
+		redirect_to '/static_pages/not_allowed'
+	     end	
 	  end
 	end
 end