Skip to content
Snippets Groups Projects
Unverified Commit 07cc201a authored by Eugen Rochko's avatar Eugen Rochko Committed by GitHub
Browse files

Fix using wrong policy on status-related actions in admin UI (#19490)

parent 8ae0936d
No related branches found
No related tags found
No related merge requests found
......@@ -40,7 +40,7 @@ class Admin::StatusBatchAction
end
def handle_delete!
statuses.each { |status| authorize(status, :destroy?) }
statuses.each { |status| authorize([:admin, status], :destroy?) }
ApplicationRecord.transaction do
statuses.each do |status|
......@@ -75,7 +75,7 @@ class Admin::StatusBatchAction
statuses.includes(:media_attachments, :preview_cards).find_each do |status|
next unless status.with_media? || status.with_preview_card?
authorize(status, :update?)
authorize([:admin, status], :update?)
if target_account.local?
UpdateStatusService.new.call(status, representative_account.id, sensitive: true)
......
......@@ -30,7 +30,7 @@ class Trends::StatusBatch
end
def approve!
statuses.each { |status| authorize(status, :review?) }
statuses.each { |status| authorize([:admin, status], :review?) }
statuses.update_all(trendable: true)
end
......@@ -45,7 +45,7 @@ class Trends::StatusBatch
end
def reject!
statuses.each { |status| authorize(status, :review?) }
statuses.each { |status| authorize([:admin, status], :review?) }
statuses.update_all(trendable: false)
end
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment