234afb3f42
Since these pages are not accessed by normal users, except for url fiddling, it's fine to respond with a generic access denied.
31 lines
743 B
Ruby
31 lines
743 B
Ruby
class IssueCommentsController < ApplicationController
|
|
layout "site"
|
|
|
|
before_action :authorize_web
|
|
before_action :set_locale
|
|
|
|
authorize_resource
|
|
|
|
def create
|
|
@issue = Issue.find(params[:issue_id])
|
|
comment = @issue.comments.build(issue_comment_params)
|
|
comment.user = current_user
|
|
comment.save!
|
|
notice = t(".comment_created")
|
|
reassign_issue(@issue) if params[:reassign]
|
|
redirect_to @issue, :notice => notice
|
|
end
|
|
|
|
private
|
|
|
|
def issue_comment_params
|
|
params.require(:issue_comment).permit(:body)
|
|
end
|
|
|
|
# This sort of assumes there are only two roles
|
|
def reassign_issue(issue)
|
|
role = (Issue::ASSIGNED_ROLES - [issue.assigned_role]).first
|
|
issue.assigned_role = role
|
|
issue.save!
|
|
end
|
|
end
|