Merge pull request #52 from anamariasosa/hotfix/edit_product_permissions

add authentication validation in edit products
anamariasosam · Jul 23, 2016 · 801083d · 801083d
2 parents 4db37f1 + bc7b32e
commit 801083d
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/app/controllers/products_controller.rb b/app/controllers/products_controller.rb
@@ -40,6 +40,10 @@ def new
 
   # GET /products/1/edit
   def edit
+    if current_user.id != @product.store_id
+      flash[:error] = t('product.edit_permissions')
+      redirect_to root_url
+    end
   end
 
   # POST /products

diff --git a/config/locales/es.yml b/config/locales/es.yml
@@ -2,6 +2,7 @@
 es:
   product:
     purchase: Actualmente puedes contactar el vendedor con su número de teléfono.
+    edit_permissions: No tienes permisos para editar este producto
   mail_form:
     attributes:
       contact: