From edf62d4fe376d91ce194907b13599305846d4e42 Mon Sep 17 00:00:00 2001 From: Matt Jankowski Date: Tue, 7 Jan 2025 02:50:19 -0500 Subject: [PATCH] Add `self_editing?` method to user role policy (#33476) --- app/policies/user_role_policy.rb | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/app/policies/user_role_policy.rb b/app/policies/user_role_policy.rb index 6144a0ec4a..44b5589581 100644 --- a/app/policies/user_role_policy.rb +++ b/app/policies/user_role_policy.rb @@ -10,10 +10,16 @@ class UserRolePolicy < ApplicationPolicy end def update? - role.can?(:manage_roles) && (role.overrides?(record) || role.id == record.id) + role.can?(:manage_roles) && (role.overrides?(record) || self_editing?) end def destroy? - !record.everyone? && role.can?(:manage_roles) && role.overrides?(record) && role.id != record.id + !record.everyone? && role.can?(:manage_roles) && role.overrides?(record) && !self_editing? + end + + private + + def self_editing? + role.id == record.id end end