Added extra security for blog app. Deletion of tags, articles and authors removed unless signed in. Creation of new authors removed unless via invite. Visual deletion buttons removed from views index pages.

Rhelli · Rhelli · commit 6ffc79decc22 · 2020-02-10T19:00:49.000-05:00
diff --git a/app/assets/stylesheets/styles.css.scss b/app/assets/stylesheets/styles.css.scss
@@ -19,6 +19,7 @@ a {
 
 img {
   border-radius: 4px;
+  max-width: 100%;
 }
 
 .clear {
@@ -28,7 +29,7 @@ img {
 }
 
 #container {
-  width: 75%;
+  width: auto;
   margin: 0 auto;
   background: #f0f0f0;
   padding: 20px 40px;
diff --git a/app/controllers/articles_controller.rb b/app/controllers/articles_controller.rb
@@ -1,7 +1,8 @@
 class ArticlesController < ApplicationController
-  
   include ArticlesHelper
 
+  before_action :require_login, except: [:index, :show]
+
   def index
     @articles = Article.all
   end
diff --git a/app/controllers/authors_controller.rb b/app/controllers/authors_controller.rb
@@ -1,5 +1,14 @@
 class AuthorsController < ApplicationController
   before_action :set_author, only: [:show, :edit, :update, :destroy]
+  before_action :zero_authors_or_authenticated, only: [:new, :create]
+  before_action :require_login, except: [:new, :create]
+
+  def zero_authors_or_authenticated
+    unless Author.count == 0 || current_user
+      redirect_to root_path
+      return false
+    end
+  end
 
   # GET /authors
   # GET /authors.json
diff --git a/app/controllers/comments_controller.rb b/app/controllers/comments_controller.rb
@@ -1,4 +1,6 @@
 class CommentsController < ApplicationController
+  before_action :require_login, except: [:create]
+
   def create
     @comment = Comment.new(comment_params)
     @comment.article_id = params[:article_id]
diff --git a/app/controllers/tags_controller.rb b/app/controllers/tags_controller.rb
@@ -1,9 +1,18 @@
 class TagsController < ApplicationController
+  before_action :require_login, only: [:destroy]
+
   def index
     @tags = Tag.all
   end
   
   def show
     @tag = Tag.find(params[:id])
   end
+
+  def destroy
+    @tag = Tag.find(params[:id])
+    @tag.destroy
+    flash.notice = "The '#{@tag.name}' tag has been deleted."
+    redirect_to tags_path
+  end
 end
diff --git a/app/models/article.rb b/app/models/article.rb
@@ -1,7 +1,7 @@
 class Article < ApplicationRecord
   has_many :comments
   has_many :taggings
-  has_many :tags, through: :taggings, dependent: :destroy
+  has_many :tags, through: :taggings
   has_attached_file :image, styles: {large: "1280x720>", medium: "800x450>", small: "400x225>", thumb: "100x100>"}
   validates_attachment_content_type :image, :content_type => ['image/jpeg', 'image/png', 'image/gif']
 
diff --git a/app/models/tag.rb b/app/models/tag.rb
@@ -1,4 +1,4 @@
 class Tag < ApplicationRecord
-  has_many :taggings
+  has_many :taggings, dependent: :destroy
   has_many :articles, through: :taggings
 end
diff --git a/app/views/articles/index.html.erb b/app/views/articles/index.html.erb
@@ -7,5 +7,6 @@
     </li><br>
   <% end %>
 </ul>
-
-<%= link_to 'Create a new post', new_article_path, class: "new_article" %>
+<% if logged_in? %>
+  <%= link_to 'Create a new post', new_article_path, class: "new_article" %>
+<% end %>
diff --git a/app/views/articles/show.html.erb b/app/views/articles/show.html.erb
@@ -12,7 +12,10 @@
 </p>
 <p><%= @article.body %></p><br>
 
-<%= link_to 'Edit Article', edit_article_path(@article) %> | <%= link_to "Delete Article", article_path(@article), method: :delete, data: { confirm: 'Are you sure?' } %><br><br>
+<% if logged_in? %>
+  <%= link_to 'Edit Article', edit_article_path(@article) %> | <%= link_to "Delete Article", article_path(@article), method: :delete, data: { confirm: 'Are you sure?' } %><br><br>
+<% end %>
+
 <h3>Comments</h3>
 <%= render partial: 'articles/comment', collection: @article.comments %>
 <%= render partial: 'comments/form' %>
diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb
@@ -10,9 +10,7 @@
   </head>
 
   <body>
-    <p class = 'flash'>
-      <%= flash.notice %>
-    </p>
+    <p class = 'flash'><%= flash.notice %></p>
     <div id = "container">
       <div id = "content">
         <%= yield %>
diff --git a/app/views/tags/index.html.erb b/app/views/tags/index.html.erb
@@ -4,6 +4,9 @@
   <% @tags.each do |tag| %>
     <li>
       <h3><%= link_to tag.name, tag_path(tag) %></h3>
+          <% if logged_in? %>
+            <%= link_to "Delete Tag", tag_path(tag), method: :delete, data: { confirm: 'Are you sure?' } %><br><br>
+          <% end %>
     </li><br>
   <% end %>
 </ul>

Original file line number	Diff line number	Diff line change
`@@ -19,6 +19,7 @@ a {`
`19`	`19`
`20`	`20`	`img {`
`21`	`21`	`border-radius: 4px;`
	`22`	`+ max-width: 100%;`
`22`	`23`	`}`
`23`	`24`
`24`	`25`	`.clear {`
`@@ -28,7 +29,7 @@ img {`
`28`	`29`	`}`
`29`	`30`
`30`	`31`	`#container {`
`31`		`- width: 75%;`
	`32`	`+ width: auto;`
`32`	`33`	`margin: 0 auto;`
`33`	`34`	`background: #f0f0f0;`
`34`	`35`	`padding: 20px 40px;`