From d7873c9e6c7c0438da785308916dda6d6b69ca65 Mon Sep 17 00:00:00 2001
From: Stella Rouzi <differentreality@gmail.com>
Date: Thu, 11 Dec 2014 13:15:37 +0200
Subject: [PATCH] do not index users unless organizer or admin

---
 app/models/ability.rb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/app/models/ability.rb b/app/models/ability.rb
index 48867723..e55b82d1 100644
--- a/app/models/ability.rb
+++ b/app/models/ability.rb
@@ -134,6 +134,7 @@ class Ability
 
     # can manage their own User
     can :manage, User, id: user.id
+    cannot :index, User
 
     # can manage their own Event
     can :manage, Event, id: user.events.pluck(:id)