Ensure views only link to those actions allowed for current user

2018-11-30 13:29:04 +01:00
parent d3f67ab4c7
commit 2125fb1c1d
56 changed files with 128 additions and 264 deletions
--- a/app/views/proxy_exercises/_form.html.slim
+++ b/app/views/proxy_exercises/_form.html.slim
@@ -18,7 +18,7 @@
      = collection_check_boxes :proxy_exercise, :exercise_ids, @exercises, :id, :title do |b|
        tr
          td = b.check_box
-          td = link_to(b.object, b.object)
+          td = link_to_if(policy(b.object).show?, b.object, b.object)
          td = l(b.object.created_at, format: :short)

  .actions = render('shared/submit_button', f: f, object: @proxy_exercise)