Use cancancan to authorize user_preference_controller

[rails.git] / app / models / ability.rb

diff --git a/app/models/ability.rb b/app/models/ability.rb
index 59b1c5ec3e68ebda8edc6e1bddd68d13bfec82a6..6a61eeff30b75e16690133fddfad0de51e364866 100644 (file)
--- a/app/models/ability.rb
+++ b/app/models/ability.rb
@@ -14,6 +14,9 @@ class Ability
 
       can [:create, :edit, :comment, :subscribe, :unsubscribe], DiaryEntry
 
+      can [:read, :read_one], UserPreference if has_capability?(token, :allow_read_prefs)
+      can [:update, :update_one, :delete_one], UserPreference if has_capability?(token, :allow_write_prefs)
+
       if user.administrator?
         can [:hide, :hidecomment], [DiaryEntry, DiaryComment]
       end