Merge pull request #3204 from evazion/fix-3203

Fix #3203: Overly restrictive permissions
2017-07-07 18:59:13 -07:00
parent df33901938 24b2f2bf52
commit 1cc9abc2db
20 changed files with 72 additions and 49 deletions
--- a/app/controllers/bulk_update_requests_controller.rb
+++ b/app/controllers/bulk_update_requests_controller.rb
@@ -1,6 +1,6 @@
 class BulkUpdateRequestsController < ApplicationController
  respond_to :html, :xml, :json, :js
-  before_filter :member_only
+  before_filter :member_only, :except => [:index, :show]
  before_filter :admin_only, :only => [:approve]
  before_filter :load_bulk_update_request, :except => [:new, :create, :index]