prevent non-authorized users to access medical release files

2020-06-18 14:33:49 +02:00
parent 988ef2beab
commit 88ec777299
7 changed files with 214 additions and 4 deletions
--- a/app/controllers/contracts_controller.rb
+++ b/app/controllers/contracts_controller.rb
@@ -48,8 +48,10 @@ class ContractsController < ApplicationController
    # Native release contracts must be generated on-the-fly; non-native releases have a contract attachment
    if releasable.native?
      send_file contract.to_pdf, download_attributes
-    else
+    elsif policy(contract).show?
      redirect_to releasable.contract.service_url
+    else
+      raise Pundit::NotAuthorizedError
    end
  end
 end