fix: Search for non-admin users

ClarifiedSecurity · Oct 6, 2023 · 31194a9 · 31194a9
1 parent dbd9b6e
commit 31194a9
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/app/policies/application_policy.rb b/app/policies/application_policy.rb
@@ -63,10 +63,11 @@ def resolve
 
       private
         def accessible_actors_for_user(ex_id = exercise.id)
+          ex = Exercise.find(ex_id)
           if (user.accessible_exercises[ex_id.to_s] & %w(rt local_admin)).any?
-            exercise.actors.pluck(:id)
+            ex.actors.pluck(:id)
           else
-            exercise.actors.where.not(abbreviation: 'rt').pluck(:id)
+            ex.actors.where.not(abbreviation: 'rt').pluck(:id)
           end
         end