Ensure views only link to those actions allowed for current user

2018-11-30 13:29:04 +01:00
parent d3f67ab4c7
commit 2125fb1c1d
56 changed files with 128 additions and 264 deletions
--- a/app/views/submissions/statistics.html.slim
+++ b/app/views/submissions/statistics.html.slim
@@ -23,4 +23,4 @@ h2.mt-4 = t('.history')
            td = l(submission.created_at, format: :short)
            td = submission.score
            td = progress_bar(submission.percentage)
-            td = link_to(t('shared.show'), submission)
+            td = link_to(t('shared.show'), submission) if policy(submission).show?