diff --git a/app/controllers/admin/poll/questions/answers/images_controller.rb b/app/controllers/admin/poll/questions/answers/images_controller.rb index a209b058f..9b60f3f4c 100644 --- a/app/controllers/admin/poll/questions/answers/images_controller.rb +++ b/app/controllers/admin/poll/questions/answers/images_controller.rb @@ -2,6 +2,7 @@ class Admin::Poll::Questions::Answers::ImagesController < Admin::Poll::BaseContr include ImageAttributes load_and_authorize_resource :answer, class: "::Poll::Question::Answer" + load_and_authorize_resource only: [:destroy] def index end @@ -11,6 +12,7 @@ class Admin::Poll::Questions::Answers::ImagesController < Admin::Poll::BaseContr def create @answer.attributes = images_params + authorize! :update, @answer if @answer.save redirect_to admin_answer_images_path(@answer), @@ -21,7 +23,6 @@ class Admin::Poll::Questions::Answers::ImagesController < Admin::Poll::BaseContr end def destroy - @image = ::Image.find(params[:id]) @image.destroy! respond_to do |format| diff --git a/app/models/abilities/administrator.rb b/app/models/abilities/administrator.rb index ee323ef80..3c94e802e 100644 --- a/app/models/abilities/administrator.rb +++ b/app/models/abilities/administrator.rb @@ -103,8 +103,8 @@ module Abilities can [:create, :update, :destroy], Poll::Question::Answer::Video do |video| can?(:update, video.answer) end - can [:create, :destroy], Image do |image| - image.imageable_type == "Poll::Question::Answer" + can [:destroy], Image do |image| + image.imageable_type == "Poll::Question::Answer" && can?(:update, image.imageable) end can :manage, SiteCustomization::Page diff --git a/app/models/abilities/common.rb b/app/models/abilities/common.rb index 049a2c8b5..264b98521 100644 --- a/app/models/abilities/common.rb +++ b/app/models/abilities/common.rb @@ -74,7 +74,9 @@ module Abilities document.documentable&.author_id == user.id end - can [:destroy], Image, imageable: { author_id: user.id } + can [:destroy], Image do |image| + image.imageable_type != "Poll::Question::Answer" && image.imageable&.author_id == user.id + end can [:create, :destroy], DirectUpload diff --git a/app/views/admin/poll/questions/answers/images/index.html.erb b/app/views/admin/poll/questions/answers/images/index.html.erb index f031f2b1f..e3f2b3e92 100644 --- a/app/views/admin/poll/questions/answers/images/index.html.erb +++ b/app/views/admin/poll/questions/answers/images/index.html.erb @@ -1,8 +1,20 @@ <%= back_link_to admin_question_path(@answer.question) %> -<%= link_to t("admin.questions.answers.images.add_image"), - new_admin_answer_image_path(@answer), - class: "button hollow float-right" %> +
+ +

+ <%= t("admin.answers.images.index.title") %> +

+ +<% if can?(:update, @answer) %> + <%= link_to t("admin.questions.answers.images.add_image"), + new_admin_answer_image_path(@answer), + class: "button hollow float-right" %> +<% else %> +
+ <%= t("admin.questions.no_edit") %> +
+<% end %>