fix security bug

2015-08-06 11:53:31 -07:00
parent 535a233de1
commit 5e70083a6a
1 changed files with 6 additions and 1 deletions
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -159,6 +159,11 @@ protected
  end

  def post_approvers_only
-    CurrentUser.can_approve_posts?
+    if CurrentUser.can_approve_posts?
+      true
+    else
+      access_denied()
+      false
+    end
  end
 end