Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Already on GitHub? Sign in to your account

Fix #494: Make sure to actually call block with nil when subject is a Class #540

wants to merge 1 commit into


None yet
3 participants

kensimon commented Jan 4, 2012

Since there seemed to be two conflicting specs for can? being called with a Class, one simply returning true and one broken spec for, calling a block, I think I resolved the conflict and fixed #494. Check the bug and see if this is a fix you agree with.



Sija pushed a commit to Sija/cancan that referenced this pull request Mar 19, 2012


jeremyf commented May 11, 2012

[Verified] The specs all pass. And it closes an issue. 👍 👍


ryanb commented May 11, 2012

This isn't a bug but by design. CanCan used to actually work this way (passing nil into the block) but I changed it to skip the block. You can see my reasoning in issue #116. Also see Checking Abilities wiki page for more information.

I realize this is one of the most confusing parts of CanCan and worst of all can cause security holes. This behavior is fixed in CanCan 2.0 but requires a significant structure change to bring that fix back to 1.

@ryanb ryanb closed this May 11, 2012

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment