authorize params passed in create and update action

2011-03-25 17:01:12 -07:00
parent f41b39406c
commit baa1dacc21
2 changed files with 26 additions and 2 deletions
@@ -33,7 +33,15 @@ module CanCan
    end

    def authorize_resource
-      @controller.authorize!(authorization_action, resource_instance) if resource_instance
+      if resource_instance
+        if @params[name] && (authorization_action == :create || authorization_action == :update)
+          @params[name].each do |key, value|
+            @controller.authorize!(authorization_action, resource_instance, key.to_sym)
+          end
+        else
+          @controller.authorize!(authorization_action, resource_instance)
+        end
+      end
    end

    def parent?