search

mysociety / belgium-theme

The Alaveteli theme for Belgian site Transparencia
https://transparencia.be/
MIT License
1 stars 2 forks source link

Show CADA appeal doc link to admins and requester only #116

Closed laurentS closed 10 months ago

laurentS commented 10 months ago

This PR modifies the template to make the appeal document link visible to admins and request owners only, and moves the link to before the "regular" document, as requested by Transparencia.

laurentS commented 9 months ago

You should look into adding a before action hook to the controller and an ability using the requester_or_admin? helper to limit access.

Hi @gbp thanks for merging this. In the controller, there is this which I believe prevents unauthorised access. At least it does on madada.fr (for instance here). The code is probably not optimal, but it seems to work. Did I miss anything?