From 317e583b97f728fb276a4959aea0f15663ad7190 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Thu, 17 Aug 2017 19:00:35 +0200 Subject: [PATCH] Fixed ACL check for deleting screenshots --- app/controllers/packages_controller.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/packages_controller.rb b/app/controllers/packages_controller.rb index 0b4bd38..a37681c 100644 --- a/app/controllers/packages_controller.rb +++ b/app/controllers/packages_controller.rb @@ -104,7 +104,7 @@ class PackagesController < ApplicationController # Check if the user is allowed to change this screenshot # - Is this the user's own screenshot? (anonymous) - if self.user = current_user or current_user.is_admin? + if @screenshot.user == current_user or current_user.is_admin? logger.debug "User #{current_user} deletes screenshot #{@screenshot}" @screenshot.destroy flash['notice'] = "Screenshot deleted."