updates permissions for direct messages

2016-06-09 17:35:19 +02:00
parent 900d997000
commit fea3aef5bb
4 changed files with 26 additions and 1 deletions
--- a/app/controllers/direct_messages_controller.rb
+++ b/app/controllers/direct_messages_controller.rb
@@ -1,5 +1,5 @@
 class DirectMessagesController < ApplicationController
-  skip_authorization_check
+  load_and_authorize_resource

  def new
    @receiver = User.find(params[:user_id])
--- a/app/models/abilities/common.rb
+++ b/app/models/abilities/common.rb
@@ -46,6 +46,8 @@ module Abilities
        can :vote_featured, Proposal
        can :vote, SpendingProposal
        can :create, SpendingProposal
+        can :create, DirectMessage
+        can :show, DirectMessage, sender_id: user.id
      end

      can [:new, :create, :show], ProposalNotification do |notification|