diff --git a/app/controllers/sources_controller.rb b/app/controllers/sources_controller.rb
index 4ac2739..c53dd97 100644
--- a/app/controllers/sources_controller.rb
+++ b/app/controllers/sources_controller.rb
@@ -9,8 +9,39 @@ class SourcesController < ApplicationController
   end
 
   def create
+    @source = @project.sources.new(source_params)
+    if @source.save
+      flash[:notice] = 'Created new source'
+      redirect_to project_sources_url(@project)
+    else
+      @sources = @project.sources
+      render :index
+    end
   end
 
   def destroy
+    # FIXME: do not destroy if anything depends on it
+    if @source.destroy
+      flash[:notice] = 'Deleted source'
+    end
+    redirect_to project_sources_url(@project)
+  end
+
+  private
+
+  def source_params
+    params.require(:source).permit(
+      :name,
+      :description
+    )
+  end
+
+  # :find_* methods are called before :authorize,
+  # @project is required for :authorize to succeed
+  def find_source
+    @unit = Source.find(params[:id])
+    @project = @source.project
+  rescue ActiveRecord::RecordNotFound
+    render_404
   end
 end
diff --git a/app/controllers/units_controller.rb b/app/controllers/units_controller.rb
index 31d3b32..c660e74 100644
--- a/app/controllers/units_controller.rb
+++ b/app/controllers/units_controller.rb
@@ -20,6 +20,7 @@ class UnitsController < ApplicationController
   end
 
   def destroy
+    # FIXME: do not destroy if anything depends on it
     if @unit.destroy
       flash[:notice] = 'Deleted unit'
     end