From 010fc3bce09d1e3f37a7efb17d99078095313858 Mon Sep 17 00:00:00 2001 From: Jeremy Friesen Date: Wed, 30 Mar 2022 16:21:58 -0400 Subject: [PATCH] Adjusting logic to match intention (#17015) Unearthed in a deep read of the code during the review of forem/forem#16997 --- app/controllers/dashboards_controller.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/dashboards_controller.rb b/app/controllers/dashboards_controller.rb index 282fd97bd..f5ef4f6f3 100644 --- a/app/controllers/dashboards_controller.rb +++ b/app/controllers/dashboards_controller.rb @@ -21,7 +21,7 @@ class DashboardsController < ApplicationController fetch_and_authorize_user target = @user # NOTE: This is a subtle policy check happening here that we are not encapsulating - not_authorized if params[:org_id] && !@user.org_admin?(params[:org_id] || @user.any_admin?) + not_authorized if params[:org_id] && !(@user.org_admin?(params[:org_id]) || @user.any_admin?) @organizations = @user.admin_organizations