Fix using wrong policy on status-related actions in admin UI (mastodo…

…n#19490)
nametoolong · Nov 1, 2022 · 6c8905c · 6c8905c
1 parent 62dba64
commit 6c8905c
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/app/models/admin/status_batch_action.rb b/app/models/admin/status_batch_action.rb
@@ -40,7 +40,7 @@ def process_action!
   end
 
   def handle_delete!
-    statuses.each { |status| authorize(status, :destroy?) }
+    statuses.each { |status| authorize([:admin, status], :destroy?) }
 
     ApplicationRecord.transaction do
       statuses.each do |status|
@@ -75,7 +75,7 @@ def handle_mark_as_sensitive!
     statuses.includes(:media_attachments, :preview_cards).find_each do |status|
       next unless status.with_media? || status.with_preview_card?
 
-      authorize(status, :update?)
+      authorize([:admin, status], :update?)
 
       if target_account.local?
         UpdateStatusService.new.call(status, representative_account.id, sensitive: true)

diff --git a/app/models/trends/status_batch.rb b/app/models/trends/status_batch.rb
@@ -30,7 +30,7 @@ def status_accounts
   end
 
   def approve!
-    statuses.each { |status| authorize(status, :review?) }
+    statuses.each { |status| authorize([:admin, status], :review?) }
     statuses.update_all(trendable: true)
   end
 
@@ -45,7 +45,7 @@ def approve_accounts!
   end
 
   def reject!
-    statuses.each { |status| authorize(status, :review?) }
+    statuses.each { |status| authorize([:admin, status], :review?) }
     statuses.update_all(trendable: false)
   end