Prevent mods from editing/deleting feedbacks given to themselves.

2016-11-28 03:48:24 -06:00
parent bba080a4c5
commit fa74c71b6d
4 changed files with 7 additions and 3 deletions
--- a/app/controllers/user_feedbacks_controller.rb
+++ b/app/controllers/user_feedbacks_controller.rb
@@ -49,6 +49,6 @@ class UserFeedbacksController < ApplicationController

 private
  def check_privilege(user_feedback)
-    raise User::PrivilegeError unless (user_feedback.creator_id == CurrentUser.id || CurrentUser.is_moderator?)
+    raise User::PrivilegeError unless user_feedback.editable_by?(CurrentUser.user)
  end
 end