From 3ecf150636987d48fd44d3ecbeb5ef5b1f74ef68 Mon Sep 17 00:00:00 2001
From: David Heinemeier Hansson <david@37signals.com>
Date: Fri, 11 Apr 2025 17:41:28 +0200
Subject: [PATCH] Use proper access control

Otherwise you could react to any comment on the entire account. And then
you might as well just do Comment.find.
---
 app/controllers/cards/comments/reactions_controller.rb | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/app/controllers/cards/comments/reactions_controller.rb b/app/controllers/cards/comments/reactions_controller.rb
index 1226c605c..f843d7e42 100644
--- a/app/controllers/cards/comments/reactions_controller.rb
+++ b/app/controllers/cards/comments/reactions_controller.rb
@@ -1,4 +1,6 @@
 class Cards::Comments::ReactionsController < ApplicationController
+  include CardScoped
+
   before_action :set_comment
 
   def index
@@ -24,7 +26,7 @@ class Cards::Comments::ReactionsController < ApplicationController
 
   private
     def set_comment
-      @comment = Current.account.comments.find(params[:comment_id])
+      @comment = @card.comments.find(params[:comment_id])
     end
 
     def reaction_params