prevent non-authorized users to access medical release files

2020-06-18 14:33:49 +02:00
parent 988ef2beab
commit 88ec777299
7 changed files with 214 additions and 4 deletions
--- a/app/policies/medical_release_policy.rb
+++ b/app/policies/medical_release_policy.rb
@@ -31,7 +31,11 @@ class MedicalReleasePolicy < ReleasePolicy
    true
  end

+  def download_single?
+    user.account_manager?
+  end
+
  def download_multiple?
-    true
+    download_single?
  end
 end