Prevent downloading a bulk upload as a non-support user

2 years ago · 9f1de0fdaf
2 changed files with 4 additions and 0 deletions
--- a/app/controllers/lettings_logs_controller.rb
+++ b/app/controllers/lettings_logs_controller.rb
@ -135,6 +135,8 @@ class LettingsLogsController < LogsController
  end

  def download_bulk_upload
+    return render_not_authorized unless current_user.support?
+
    bulk_upload = BulkUpload.find(params[:id])
    downloader = BulkUpload::Downloader.new(bulk_upload:)

--- a/app/controllers/sales_logs_controller.rb
+++ b/app/controllers/sales_logs_controller.rb
@ -105,6 +105,8 @@ class SalesLogsController < LogsController
  end

  def download_bulk_upload
+    return render_not_authorized unless current_user.support?
+
    bulk_upload = BulkUpload.find(params[:id])
    downloader = BulkUpload::Downloader.new(bulk_upload:)