diff --git a/app/controllers/public_pages_controller.rb b/app/controllers/public_pages_controller.rb index 271e8da..c97db6b 100644 --- a/app/controllers/public_pages_controller.rb +++ b/app/controllers/public_pages_controller.rb @@ -2,8 +2,6 @@ class PublicPagesController < ApplicationController - after_action :verify_authorized, except: [:template_index, :plan_index] - # GET template_index # ----------------------------------------------------- def template_index @@ -22,7 +20,6 @@ @template = Template.live(params[:id]) # covers authorization for this action. # Pundit dosent support passing objects into scoped policies - skip_authorization unless PublicPagePolicy.new(@template).template_export? redirect_to public_templates_path, notice: "You are not authorized to export that template" and return #raise Pundit::NotAuthorizedError diff --git a/app/policies/public_page_policy.rb b/app/policies/public_page_policy.rb index b7e59c0..0e5e291 100644 --- a/app/policies/public_page_policy.rb +++ b/app/policies/public_page_policy.rb @@ -14,7 +14,7 @@ end def template_export? - @object.present? && ( @object.is_default || @object.org.funder? ) && @object.published + @object.present? && ( @object.is_default? || @object.org.funder? ) && @object.published? end def plan_export?