Ensure views only link to those actions allowed for current user

2018-11-30 13:29:04 +01:00
parent d3f67ab4c7
commit 2125fb1c1d
56 changed files with 128 additions and 264 deletions
--- a/app/policies/exercise_policy.rb
+++ b/app/policies/exercise_policy.rb
@ -8,7 +8,7 @@ class ExercisePolicy < AdminOrAuthorPolicy
  end

  [:clone?, :destroy?, :edit?, :statistics?, :update?, :feedback?].each do |action|
-    define_method(action) { admin? || author?}
+    define_method(action) { admin? || author? }
  end

  [:implement?, :working_times?, :intervention?, :search?, :submit?, :reload?].each do |action|