From d37bc94312f066615cf91cc2b8221c170492ada0 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Thu, 6 Dec 2012 22:22:14 -0800 Subject: Users can only access their own pages --- app.coffee | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) (limited to 'app.coffee') diff --git a/app.coffee b/app.coffee index a5c1ecdf..b86336a3 100644 --- a/app.coffee +++ b/app.coffee @@ -1,16 +1,13 @@ express = require('express') path = require('path') engines = require('consolidate') -passport = require('./passport').passport +passport = require('./passport') calculator = require("./routes/calculator") sessions = require("./routes/sessions")(passport) transactions = require("./routes/transactions") users = require("./routes/users") -authorize = (req, res, next) -> - return next() if req.isAuthenticated() - res.redirect('/login') app = express() app.enable('trust proxy') @@ -46,12 +43,19 @@ for route, view of routes ) )(route, view) +authorize = (req, res, next) -> + return next() if req.isAuthenticated() and + req.params.user is req.user.username or + req.user.username is 'admin' + res.redirect('/login') + app.get('/setup', calculator.new) app.get('/calculator', calculator.show) app.get('/ticker', calculator.ticker) app.get('/login', sessions.new) app.post('/login', sessions.create) +app.get('/logout', sessions.destroy) app.get('/:user.json', authorize, users.json) app.get('/:user', authorize, users.show) -- cgit v1.2.3