Fix using wrong policy on status-related actions in admin UI (#19490)

2022-10-28 00:48:30 +02:00
parent 8ae0936ddd
commit 07cc201acc
2 changed files with 4 additions and 4 deletions
--- a/app/models/trends/status_batch.rb
+++ b/app/models/trends/status_batch.rb
@@ -30,7 +30,7 @@ class Trends::StatusBatch
  end

  def approve!
-    statuses.each { |status| authorize(status, :review?) }
+    statuses.each { |status| authorize([:admin, status], :review?) }
    statuses.update_all(trendable: true)
  end

@@ -45,7 +45,7 @@ class Trends::StatusBatch
  end

  def reject!
-    statuses.each { |status| authorize(status, :review?) }
+    statuses.each { |status| authorize([:admin, status], :review?) }
    statuses.update_all(trendable: false)
  end