diff --git a/app/controllers/public_pages_controller.rb b/app/controllers/public_pages_controller.rb index b4b96a1..271e8da 100644 --- a/app/controllers/public_pages_controller.rb +++ b/app/controllers/public_pages_controller.rb @@ -22,10 +22,11 @@ @template = Template.live(params[:id]) # covers authorization for this action. # Pundit dosent support passing objects into scoped policies - unless PublicPagePolicy.new(@template).template_export? - raise Pundit::NotAuthorizedError - end skip_authorization + unless PublicPagePolicy.new(@template).template_export? + redirect_to public_templates_path, notice: "You are not authorized to export that template" and return + #raise Pundit::NotAuthorizedError + end # now with prefetching (if guidance is added, prefetch annottaions/guidance) @template = Template.includes( :org, diff --git a/app/policies/public_page_policy.rb b/app/policies/public_page_policy.rb index 1e1ec53..b7e59c0 100644 --- a/app/policies/public_page_policy.rb +++ b/app/policies/public_page_policy.rb @@ -14,7 +14,7 @@ end def template_export? - @object.is_default || @object.org.funder? + @object.present? && ( @object.is_default || @object.org.funder? ) && @object.published end def plan_export?