AutoCommit Don Sep 3 11:03:01 CEST 2015

app/controllers/users_controller.rb

@@ -1,8 +1,20 @@
 class UsersController < ApplicationController
   def index 
+    authorize!(:index,User)
     @users = User.all
   end
+  def show
+    @user=User.find(params[:id])
+    authorize!(:show, @user)    
+
+  end
+  def set_preferred_theme
+    @user=User.find(params[:id])
+    authorize!(:set_preferred_theme, @user)    
+    redirect_to user_url
+  end
   def add_role
+    authorize!(:add_role, User)
     @user= User.find(params[:id])
     if (params[:role]=="fetuser" && can?(:addfetuser,User))
       @user.add_role(params[:role])
@@ -13,6 +25,8 @@ class UsersController < ApplicationController
     redirect_to users_url
   end
   def fb_set_default_publish_page
+    authorize!(:doadmin, User)
+
     if Fetsite::Application.config.facebookconfig_enabled
       if params["page"].nil? || !(current_user.provider=="facebook")
         redirect_to intern_home_index_path
@@ -27,6 +41,7 @@ class UsersController < ApplicationController
   end
   
   def all_update
+    authorize! :doadmin,User
     params[:users].each do |id,u| 
       user=User.find(id) 
       user.fetprofile = Fetprofile.find(u[:fetprofile_id].to_i) if u[:fetprofile_id].to_i>0