Ensure views only link to those actions allowed for current user

app/views/exercises/feedback.html.slim

@@ -1,4 +1,4 @@
-h1 = link_to(@exercise, exercise_path(@exercise))
+h1 = link_to_if(policy(@exercise).show?, @exercise, exercise_path(@exercise))
 
 .feedback-page
   .header = t('activerecord.attributes.exercise.description')

app/views/exercises/index.html.slim

@@ -27,7 +27,7 @@ h1 = Exercise.model_name.human(count: 2)
     tbody
       - @exercises.each do |exercise|
         tr data-id=exercise.id
-          td.p-1.pt-2 = link_to(exercise.title, exercise, 'data-turbolinks' => "false") if policy(exercise).show?
+          td.p-1.pt-2 = link_to_if(policy(exercise).show?, exercise.title, exercise, 'data-turbolinks' => "false")
           td.p-1.pt-2 = link_to_if(exercise.execution_environment && policy(exercise.execution_environment).show?, exercise.execution_environment, exercise.execution_environment)
           td.p-1.pt-2 = exercise.files.teacher_defined_tests.count
           td.p-1.pt-2 = exercise.maximum_score

app/views/exercises/show.html.slim

@@ -7,8 +7,7 @@
 
 h1
   = @exercise
-  - if policy(@exercise).edit?
-    = render('shared/edit_button', object: @exercise)
+  = render('shared/edit_button', object: @exercise)
 
 = row(label: 'exercise.title', value: @exercise.title)
 = row(label: 'exercise.user', value: link_to_if(policy(@exercise.author).show?, @exercise.author, @exercise.author))

app/views/exercises/statistics.html.slim

@@ -49,7 +49,7 @@ h1 = @exercise
           - if user_statistics[user.id] then us = user_statistics[user.id] else us = {"maximum_score" => nil, "runs" => nil}
           - label = "#{user.displayname}"
           tr
-            td = link_to_if symbol==:external_users, label, {controller: "exercises", action: "statistics", external_user_id: user.id, id: @exercise.id}
+            td = link_to_if symbol==:external_users && policy(user).statistics?, label, {controller: "exercises", action: "statistics", external_user_id: user.id, id: @exercise.id}
             td = us['maximum_score'] or 0
             td = us['runs']
             td = @exercise.average_working_time_for(user.id) or 0