Allowing users to see member activity

app/models/ability.rb

@@ -14,8 +14,8 @@ class Ability
       can [:update], Mac, :user_id => nil
       can [:create,:update], Mac, :user_id => user.id
       can :read, Payment, :user_id => user.id
-      can [:read,:new_member_report], User, :id => user.id #TODO: why can users update themselves? Maybe because Devise doesn't check users/edit?
       can :read, UserCertification, :user_id => user.id
+      can :read, User, :id => user.id #TODO: why can users update themselves? Maybe because Devise doesn't check users/edit?
       can :compose_email, User
       can :send_email, User
 
@@ -32,7 +32,7 @@ class Ability
       end
       # Users can see others' stuff if they've been oriented
       unless user.orientation.blank?
-        can :read, User, :hidden => [nil,false]
+        can [:read,:new_member_report,:activity], User, :hidden => [nil,false]
         can :read, UserCertification
       end 
 

app/views/users/index.html.erb

@@ -8,9 +8,13 @@
 <% end %>
 <% if current_user.admin? %>
   <%= link_to 'Inactive Users', users_inactive_path %> |
+<% end %>
+<% if can? :activity, User %>
   <%= link_to 'Recent Activity', users_activity_path %> |
 <% end %>
+<% if can? :new_member_report, User %>
   <%= link_to 'New Members Report', users_new_member_report_path %>
+<% end %>
 
 <% @certifications = Certification.all.sort_by(&:id) %>
 <table>