Admins cannot update a user. Eventually we will want to allow admins to update some user fields.

1 files changed, 7 insertions, 1 deletions

diff --git a/users/app/controllers/users_controller.rb b/users/app/controllers/users_controller.rb
index 9325bc0..dff1ed5 100644
--- a/users/app/controllers/users_controller.rb
+++ b/users/app/controllers/users_controller.rb
@@ -1,7 +1,8 @@
 class UsersController < ApplicationController
 
-  before_filter :authorize, :only => [:show, :edit, :update, :destroy]
+  before_filter :authorize, :only => [:show, :edit, :destroy, :update]
   before_filter :fetch_user, :only => [:show, :edit, :update, :destroy]
+  before_filter :authorize_self, :only => [:update]
   before_filter :set_anchor, :only => [:edit, :update]
   before_filter :authorize_admin, :only => [:index]
 
@@ -57,6 +58,11 @@ class UsersController < ApplicationController
     access_denied unless admin? or (@user == current_user)
   end
 
+  def authorize_self
+    # have already checked that authorized
+    access_denied unless (@user == current_user)
+  end
+
   def set_anchor
     @anchor = email_settings? ? :email : :account
   end