htwkmooc/codeocean
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use scoped view for StudyPolicy to prevent leaking other groups

Browse Source
This commit is contained in:
Sebastian Serth
2019-05-15 17:39:12 +02:00
parent 1d842a4422
commit 652dc7001e
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/controllers/study_groups_controller.rb
View File

@ -4,7 +4,7 @@ class StudyGroupsController < ApplicationController
before_action :set_group, only: MEMBER_ACTIONS before_action :set_group, only: MEMBER_ACTIONS
def index def index
@search = StudyGroup.ransack(params[:q]) @search = policy_scope(StudyGroup).ransack(params[:q])
@study_groups = @search.result.includes(:consumer).order(:name).paginate(page: params[:page]) @study_groups = @search.result.includes(:consumer).order(:name).paginate(page: params[:page])
authorize! authorize!
end end