Disable access to profile list, set up Pundit policy to enforce who can edit what profile.

joatuapp / joatu-v2

The JoatU application, version 2. Written in Ruby on Rails.

https://alpha.joatu.org

GNU General Public License v3.0

27 stars 5 forks source link

Disable access to profile list, set up Pundit policy to enforce who can edit what profile. #181

Open rsmithlal opened 5 years ago

rsmithlal commented 5 years ago

After updating your profile (or clicking that "back" button for your profile form, actually), you are redirected to https://alpha.joatu.org/en/profiles where you can see and edit all the profiles in the system.

We need to remove this application route (no point to list profiles to regular users), and enforce authorization checks for who can view the list of profiles.

joatu commented 5 years ago

I think you can edit them because you're admin. Otherwise, it's just a list, no? And sure, it's fine to disable for now, but later on, it would make sense to be able to see the members of the group (if chosen to be enabled) via better together.