From 33f669a5f851b4095fb6189147ae0fe6f8343d44 Mon Sep 17 00:00:00 2001 From: Jack Jennings Date: Tue, 30 May 2017 13:56:31 -0700 Subject: Add status destroy authorization to policy (#3453) * Add status destroy authorization to policy * Create explicit unreblog status authorization --- app/controllers/api/v1/statuses_controller.rb | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'app/controllers/api/v1') diff --git a/app/controllers/api/v1/statuses_controller.rb b/app/controllers/api/v1/statuses_controller.rb index 592540f45..7386d7158 100644 --- a/app/controllers/api/v1/statuses_controller.rb +++ b/app/controllers/api/v1/statuses_controller.rb @@ -79,7 +79,10 @@ class Api::V1::StatusesController < ApiController def destroy @status = Status.where(account_id: current_user.account).find(params[:id]) + authorize @status, :destroy? + RemovalWorker.perform_async(@status.id) + render_empty end @@ -93,6 +96,8 @@ class Api::V1::StatusesController < ApiController @status = reblog.reblog @reblogs_map = { @status.id => false } + authorize reblog, :unreblog? + RemovalWorker.perform_async(reblog.id) render :show -- cgit