-
-
Notifications
You must be signed in to change notification settings - Fork 3.3k
Closed
Description
In the initializer, we set the ability class explicitly, which is used to authorize most of the UI
# You can customize your CanCan Ability class name here.
config.cancan_ability_class = "Ability::Admin"But when adding bulk actions, the ability is "Ability", which is wrong. And the actions don't work properly. The current_ability is Ability in both places. Therefore, neither can? nor batch_action_collection works properly (the latter adds this to the query AND (TRUE=FALSE) AND).
batch_action :publish, confirm: "Are you sure?", if: proc { |*args|
debugger
true
} do |ids, *args|
debugger
redirect_back fallback_location: collection_path(params.permit(q: {})), alert: "Published successdfully!"
endExpected behavior
Should use the ability defined in the initializer.
Actual behavior
The action runs in the wrong context, improperly authorized.
How to reproduce
Add a batch action in an application that has multiple ability classes, where the Ability one is not intended for Admin users.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels