mirror of
https://github.com/discourse/discourse-subscriptions.git
synced 2025-02-12 22:44:59 +00:00
227c55e6f5
As reported [on Meta](https://meta.discourse.org/t/discourse-subscriptions/140818/352?u=justin), moderators could access all of the subscriptions data (plugins/prices/subscribers) and manage them. This should not be the case, so this PR adds a route constraint to 404 moderators from these routes.
33 lines
939 B
Ruby
33 lines
939 B
Ruby
# frozen_string_literal: true
|
|
require_dependency "subscriptions_user_constraint"
|
|
|
|
DiscourseSubscriptions::Engine.routes.draw do
|
|
scope 'admin' do
|
|
get '/' => 'admin#index'
|
|
post '/refresh' => 'admin#refresh_campaign'
|
|
post '/create-campaign' => 'admin#create_campaign'
|
|
end
|
|
|
|
namespace :admin, constraints: AdminConstraint.new do
|
|
resources :plans
|
|
resources :subscriptions, only: [:index, :destroy]
|
|
resources :products
|
|
resources :coupons, only: [:index, :create]
|
|
resource :coupons, only: [:destroy, :update]
|
|
end
|
|
|
|
namespace :user do
|
|
resources :payments, only: [:index]
|
|
resources :subscriptions, only: [:index, :destroy]
|
|
end
|
|
|
|
get '/' => 'subscribe#index'
|
|
get '.json' => 'subscribe#index'
|
|
get '/contributors' => 'subscribe#contributors'
|
|
get '/:id' => 'subscribe#show'
|
|
post '/create' => 'subscribe#create'
|
|
post '/finalize' => 'subscribe#finalize'
|
|
|
|
post '/hooks' => 'hooks#create'
|
|
end
|