do not index users unless organizer or admin

This commit is contained in:
Stella Rouzi 2014-12-11 13:15:37 +02:00
parent d41988c74f
commit d7873c9e6c

View file

@ -134,6 +134,7 @@ class Ability
# can manage their own User
can :manage, User, id: user.id
cannot :index, User
# can manage their own Event
can :manage, Event, id: user.events.pluck(:id)