Admin::VoucherController check enterprise permission

openfoodfoundation · May 5, 2023 · 08927e6 · 08927e6
1 parent 8f04e0d
commit 08927e6
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/app/controllers/admin/vouchers_controller.rb b/app/controllers/admin/vouchers_controller.rb
@@ -26,7 +26,10 @@ def create
     private
 
     def load_enterprise
-      @enterprise = Enterprise.find_by(permalink: params[:enterprise_id])
+      @enterprise = OpenFoodNetwork::Permissions
+        .new(spree_current_user)
+        .editable_enterprises
+        .find_by(permalink: params[:enterprise_id])
     end
 
     def permitted_resource_params