pundit: add missing authorize calls.

2020-03-24 00:38:07 -05:00
parent 4a5bec71f6
commit 0ad5619484
5 changed files with 11 additions and 3 deletions
--- a/app/controllers/forum_topics_controller.rb
+++ b/app/controllers/forum_topics_controller.rb
@@ -20,7 +20,7 @@ class ForumTopicsController < ApplicationController
    params[:search][:order] ||= "sticky" if request.format.html?
    params[:limit] ||= 40

-    @forum_topics = ForumTopic.visible(CurrentUser.user).paginated_search(params)
+    @forum_topics = authorize ForumTopic.visible(CurrentUser.user).paginated_search(params)

    if request.format.atom?
      @forum_topics = @forum_topics.includes(:creator, :original_post)