Add authorization to generic user list API

MaMpf-HD · Apr 28, 2023 · f7f79b1 · f7f79b1
1 parent e4c2498
commit f7f79b1
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
@@ -54,6 +54,7 @@ def list
   end
 
   def list_generic_users
+    authorize! :list_generic_user, @user
     result = User.where.not(id: @elevated_users.pluck(:id))
                  .values_for_select
     render json: result