add authorization checks

2026-05-15 18:55:03 +03:00
parent 755decca27
commit e52830c9b4
7 changed files with 14 additions and 0 deletions
@@ -4,6 +4,8 @@ class SubmittersSendEmailController < ApplicationController
  load_and_authorize_resource :submitter

  def create
+    authorize!(:update, @submitter)
+
    if Docuseal.multitenant? && SubmissionEvent.exists?(submitter: @submitter,
                                                        event_type: 'send_email',
                                                        created_at: 10.hours.ago..Time.current)