Skip to content

Commit 92f1caa

Browse files
committed
Authenticate User before action
Previously we would fall back on authorization to determine if a user should be able to access a certain endpoint. We should be authenticating the user first prior to checking if the specific user is authorized to access a certain endpoint
1 parent 188a73b commit 92f1caa

3 files changed

Lines changed: 20 additions & 0 deletions

File tree

lib/decorators/backend/controllers/spree/admin/base_controller_decorator.rb

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,12 @@
33
module Spree
44
module Admin
55
module BaseControllerDecorator
6+
def self.prepended(base)
7+
base.class_eval do
8+
before_action :authenticate_spree_user!
9+
end
10+
end
11+
612
protected
713

814
def model_class

lib/decorators/frontend/controllers/spree/checkout_controller_decorator.rb

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ def check_authorization
4545
def check_registration
4646
return unless registration_required?
4747

48+
store_spree_user_location!
4849
redirect_to spree.checkout_registration_path
4950
end
5051

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# frozen_string_literal: true
2+
3+
module Spree
4+
module UsersControllerDecorator
5+
def self.prepended(base)
6+
base.class_eval do
7+
before_action :authenticate_spree_user!, except: [:new, :create]
8+
end
9+
end
10+
11+
::Spree::UsersController.prepend self
12+
end
13+
end

0 commit comments

Comments
 (0)