Don't allow destroy if owner is not current user

2022-02-23 16:34:36 -08:00 · 2022-02-23 16:34:36 -08:00 · 29c3415df2
commit 29c3415df2
parent 53e6e8bd39
1 changed files with 5 additions and 1 deletions
--- a/app/controllers/api/v1/parties_controller.rb
+++ b/app/controllers/api/v1/parties_controller.rb
@ -31,7 +31,11 @@ class Api::V1::PartiesController < Api::V1::ApiController
    end

    def destroy
-        render :destroyed, status: :ok if @party.destroy
+        if @party.user != current_user
+            render_unauthorized_response
+        else
+            render :destroyed, status: :ok if @party.destroy
+        end
    end

    def weapons