ignore cannot clause with attributes when not checking for with attributes - closes #406

lib/cancan/rule.rb

@@ -97,8 +97,13 @@ module CanCan
     end
 
     def matches_attribute?(attribute)
+      # don't consider attributes in a cannot clause when not matching - this can probably be refactored
+      if !@base_behavior && @attributes && attribute.nil?
+        false
+      else
         @attributes.nil? || attribute.nil? || @attributes.include?(attribute.to_sym)
       end
+    end
 
     # TODO deperecate this
     def matches_subject_class?(subject)

spec/cancan/ability_spec.rb

@@ -345,6 +345,7 @@ describe CanCan::Ability do
     @ability.can?(:update, :books, :author).should be_false
   end
 
+
   # Hash Association
 
   it "checks permission through association when hash is passed as subject" do