diff --git a/app/controllers/spree/admin/resource_controller.rb b/app/controllers/spree/admin/resource_controller.rb index 2220db7d23..86f33a0640 100644 --- a/app/controllers/spree/admin/resource_controller.rb +++ b/app/controllers/spree/admin/resource_controller.rb @@ -4,6 +4,7 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController helper_method :new_object_url, :edit_object_url, :object_url, :collection_url before_filter :load_resource, :except => [:update_positions] rescue_from ActiveRecord::RecordNotFound, :with => :resource_not_found + rescue_from CanCan::AccessDenied, :with => :unauthorized respond_to :html respond_to :js, :except => [:show, :index] @@ -142,6 +143,13 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController authorize! action, @object instance_variable_set("@#{object_name}", @object) + + # If we don't have access, clear the object + unless can? action, @object + instance_variable_set("@#{object_name}", nil) + end + + authorize! action, @object else @collection ||= collection diff --git a/app/controllers/spree/admin/resource_controller_decorator.rb b/app/controllers/spree/admin/resource_controller_decorator.rb deleted file mode 100644 index b1dbc4a383..0000000000 --- a/app/controllers/spree/admin/resource_controller_decorator.rb +++ /dev/null @@ -1,20 +0,0 @@ -module AuthorizeOnLoadResource - def load_resource - super - - if member_action? - # If we don't have access, clear the object - unless can? action, @object - instance_variable_set("@#{object_name}", nil) - end - - authorize! action, @object - end - end -end - -Spree::Admin::ResourceController.prepend(AuthorizeOnLoadResource) - -Spree::Admin::ResourceController.class_eval do - rescue_from CanCan::AccessDenied, with: :unauthorized -end