diff --git a/app/controllers/spree/admin/resource_controller_decorator.rb b/app/controllers/spree/admin/resource_controller_decorator.rb new file mode 100644 index 0000000000..cb789d7330 --- /dev/null +++ b/app/controllers/spree/admin/resource_controller_decorator.rb @@ -0,0 +1,16 @@ +module AuthorizeOnLoadResource + def load_resource + super + + if member_action? + # If we don't have access, clear the object + unless can? action, @object + instance_variable_set("@#{object_name}", nil) + end + + authorize! action, @object + end + end +end + +Spree::Admin::ResourceController.send(:prepend, AuthorizeOnLoadResource)