Fix using wrong policy on status-related actions in admin UI (#19490)

local
Eugen Rochko 2 years ago committed by GitHub
parent 8ae0936ddd
commit 07cc201acc
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
  1. 4
      app/models/admin/status_batch_action.rb
  2. 4
      app/models/trends/status_batch.rb

@ -40,7 +40,7 @@ class Admin::StatusBatchAction
end
def handle_delete!
statuses.each { |status| authorize(status, :destroy?) }
statuses.each { |status| authorize([:admin, status], :destroy?) }
ApplicationRecord.transaction do
statuses.each do |status|
@ -75,7 +75,7 @@ class Admin::StatusBatchAction
statuses.includes(:media_attachments, :preview_cards).find_each do |status|
next unless status.with_media? || status.with_preview_card?
authorize(status, :update?)
authorize([:admin, status], :update?)
if target_account.local?
UpdateStatusService.new.call(status, representative_account.id, sensitive: true)

@ -30,7 +30,7 @@ class Trends::StatusBatch
end
def approve!
statuses.each { |status| authorize(status, :review?) }
statuses.each { |status| authorize([:admin, status], :review?) }
statuses.update_all(trendable: true)
end
@ -45,7 +45,7 @@ class Trends::StatusBatch
end
def reject!
statuses.each { |status| authorize(status, :review?) }
statuses.each { |status| authorize([:admin, status], :review?) }
statuses.update_all(trendable: false)
end

Loading…
Cancel
Save