uploads: only let users see their own uploads on /uploads listing.

2020-04-06 14:12:57 -05:00
parent b2ee1f0766
commit 1e0f6f730a
4 changed files with 17 additions and 3 deletions
--- a/app/policies/upload_policy.rb
+++ b/app/policies/upload_policy.rb
@@ -1,4 +1,8 @@
 class UploadPolicy < ApplicationPolicy
+  def show?
+    user.is_admin? || record.uploader_id == user.id
+  end
+
  def batch?
    unbanned?
  end