REST urls for user memberships.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@8146 e93f8b46-1217-0410-a6f0-8f06a7374b81

2 files changed, 7 insertions, 6 deletions

diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 4bd19af7f..4f5e30451 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -186,9 +186,10 @@ class UsersController < ApplicationController
     end
   end
 
+  verify :method => [:post, :put], :only => :edit_membership, :render => {:nothing => true, :status => :method_not_allowed }
   def edit_membership
     @membership = Member.edit_membership(params[:membership_id], params[:membership], @user)
-    @membership.save if request.post?
+    @membership.save
     respond_to do |format|
       if @membership.valid?
         format.html { redirect_to :controller => 'users', :action => 'edit', :id => @user, :tab => 'memberships' }
@@ -208,9 +209,10 @@ class UsersController < ApplicationController
     end
   end
 
+  verify :method => :delete, :only => :destroy_membership, :render => {:nothing => true, :status => :method_not_allowed }
   def destroy_membership
     @membership = Member.find(params[:membership_id])
-    if request.post? && @membership.deletable?
+    if @membership.deletable?
       @membership.destroy
     end
     respond_to do |format|
diff --git a/app/views/users/_memberships.html.erb b/app/views/users/_memberships.html.erb
index ceee2aed6..e9faffad5 100644
--- a/app/views/users/_memberships.html.erb
+++ b/app/views/users/_memberships.html.erb
@@ -19,7 +19,7 @@
   </td>
   <td class="roles">
     <span id="member-<%= membership.id %>-roles"><%=h membership.roles.sort.collect(&:to_s).join(', ') %></span>
-    <% remote_form_for(:membership, :url => { :action => 'edit_membership', :id => @user, :membership_id => membership },
+    <% remote_form_for(:membership, :url => user_membership_path(@user, membership), :method => :put,
                                     :html => { :id => "member-#{membership.id}-roles-form", :style => 'display:none;'}) do %>
         <p><% roles.each do |role| %>
         <label><%= check_box_tag 'membership[role_ids][]', role.id, membership.roles.include?(role),
@@ -32,8 +32,7 @@
   </td>
   <td class="buttons">
       <%= link_to_function l(:button_edit), "$('member-#{membership.id}-roles').hide(); $('member-#{membership.id}-roles-form').show(); return false;", :class => 'icon icon-edit' %>
-      <%= link_to_remote(l(:button_delete), { :url => { :controller => 'users', :action => 'destroy_membership', :id => @user, :membership_id => membership },
-                                              :method => :post },
+      <%= link_to_remote(l(:button_delete), { :url => user_membership_path(@user, membership), :method => :delete },
                                               :class => 'icon icon-del') if membership.deletable? %>
   </td>
       <%= call_hook(:view_users_memberships_table_row, :user => @user, :membership => membership, :roles => roles, :projects => projects )%>
@@ -49,7 +48,7 @@
 <div class="splitcontentright">
 <% if projects.any? %>
 <fieldset><legend><%=l(:label_project_new)%></legend>
-<% remote_form_for(:membership, :url => { :action => 'edit_membership', :id => @user }) do %>
+<% remote_form_for(:membership, :url => user_memberships_path(@user)) do %>
 <%= select_tag 'membership[project_id]', options_for_membership_project_select(@user, projects) %>
 <p><%= l(:label_role_plural) %>:
 <% roles.each do |role| %>