BURs: don't allow builders to edit or reject BURs by other users.

Only admins can edit or reject BURs by other users now. The BUR creator can still edit or reject their own BURs.
2021-09-22 00:32:39 -05:00
parent 5af21f03de
commit 28d2753c53
2 changed files with 11 additions and 5 deletions
--- a/app/policies/bulk_update_request_policy.rb
+++ b/app/policies/bulk_update_request_policy.rb
@@ -4,7 +4,7 @@ class BulkUpdateRequestPolicy < ApplicationPolicy
  end

  def update?
-    unbanned? && (user.is_builder? || record.user_id == user.id)
+    unbanned? && (user.is_admin? || record.user_id == user.id)
  end

  def approve?