From f4d4889a0786c8c6d68f7a7bc0369cbe67e86c29 Mon Sep 17 00:00:00 2001 From: Jeremy Friesen Date: Wed, 11 May 2022 08:17:51 -0400 Subject: [PATCH] Replacing a potentially expensive query (#17605) Prior to this commit, if we didn't have an instance of `Article` we likely had the class `Article`; we would then run a potentially VERY expensive query (`SELECT user_id FROM articles;`) to provide an answer; namely if all of the articles are written by the same user then yes this user is the author. With this commit, when you're authorizing the `Article` class, let's just say "Nope, this user isn't the author". Closes forem/forem#17604 --- app/policies/article_policy.rb | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/app/policies/article_policy.rb b/app/policies/article_policy.rb index 76c8fb00f..6d0bedd7b 100644 --- a/app/policies/article_policy.rb +++ b/app/policies/article_policy.rb @@ -200,11 +200,10 @@ class ArticlePolicy < ApplicationPolicy private def user_author? - if record.instance_of?(Article) - record.user_id == user.id - else - record.pluck(:user_id).uniq == [user.id] - end + # We might have the Article class (instead of the Article instance), so let's short circuit + return false unless record.respond_to?(:user_id) + + record.user_id == user.id end def user_org_admin?