Ensure views only link to those actions allowed for current user

2018-11-30 13:29:04 +01:00
parent d3f67ab4c7
commit 2125fb1c1d
56 changed files with 128 additions and 264 deletions
--- a/app/views/external_users/index.html.slim
+++ b/app/views/external_users/index.html.slim
@@ -10,8 +10,8 @@ h1 = ExternalUser.model_name.human(count: 2)
    tbody
      - @users.each do |user|
        tr
-          td = user.name
-          td = link_to(user.consumer, user.consumer)
-          td = link_to(t('shared.show'), user)
+          td = link_to_if(policy(user).show?, user.name)
+          td = link_to_if(policy(user.consumer).show?, user.consumer, user.consumer)
+          td = link_to(t('shared.show'), user) if policy(user).show?

 = render('shared/pagination', collection: @users)