From 5317b072c0a41056fc24f29757e6b34065141ca2 Mon Sep 17 00:00:00 2001 From: Stella Rouzi Date: Sun, 10 Mar 2019 21:06:04 +0200 Subject: [PATCH] Allow track organizers to only add role track_organizer, and only for the track(s) they are organizing --- app/models/admin_ability.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/app/models/admin_ability.rb b/app/models/admin_ability.rb index 19d6c4d3..0cb92a42 100644 --- a/app/models/admin_ability.rb +++ b/app/models/admin_ability.rb @@ -292,6 +292,8 @@ class AdminAbility role.resource_type == 'Conference' || role.resource_type == 'Track' end + cannot :toggle_user, Role + can :toggle_user, Role do |role| role.resource_type == 'Track' && track_ids_for_track_organizer.include?(role.resource_id) end