Merge pull request #2146 from basecamp/show-only-published-cards-on-public-boards

Show only public cards on public boards

app/controllers/public/base_controller.rb

@@ -11,7 +11,7 @@ class Public::BaseController < ApplicationController
     end
 
     def set_card
-      @card = @board.cards.find_by!(number: params[:id]) if params[:board_id] && params[:id]
+      @card = @board.cards.published.find_by!(number: params[:id]) if params[:board_id] && params[:id]
     end
 
     def set_public_cache_expiration

test/controllers/public/cards_controller_test.rb

@@ -18,4 +18,10 @@ class Public::CardsControllerTest < ActionDispatch::IntegrationTest
     get public_board_card_path(@board.publication.key, @card)
     assert_response :not_found
   end
+
+  test "not found if the card is drafted" do
+    @card.update!(status: :drafted)
+    get public_board_card_path(@board.publication.key, @card)
+    assert_response :not_found
+  end
 end