Sha256: eeb81c94eb5202e72244c65bb9fcf576ad9f9d82ecc340bed2e7ff48e2a39093
Contents?: true
Size: 1.13 KB
Versions: 7
Compression:
Stored size: 1.13 KB
Contents
module Pageflow
# @api private
#
# ActiveAdmin passes class objects to CanCan when authorizing access
# to the "index" and "new resource" pages. CanCan does not evaluate
# `can` blocks when classes are passed as subjects. Since the above
# code relies on block evaluation for all but the `admin` case, this
# causes "new" buttons and menu items to be displayed even though
# access should not be permitted.
#
# see also https://github.com/activeadmin/activeadmin/issues/5144
#
# Detect these cases and pass the collection name as subject
# instead. To prevent collision with existing cases, rename actions:
#
# :read, User -> :index, :users
# :create, User -> :create_any, :users
module ActiveAdminCanCanFix
def can?(action, subject)
if [:read, :new, :create].include?(action) &&
[Entry, Account, User].include?(subject)
collection_name = subject.name.demodulize.underscore.pluralize.to_sym
if action == :read
super(:index, collection_name)
else
super(:create_any, collection_name)
end
else
super
end
end
end
end
Version data entries
7 entries across 7 versions & 1 rubygems