Constrain user queries to the current or relevant account

2025-11-10 17:17:03 -05:00
parent 93b2cef419
commit dbf66f9a50
19 changed files with 34 additions and 16 deletions
@@ -20,7 +20,7 @@ class UsersController < ApplicationController

  private
    def set_user
-      @user = User.active.find(params[:id])
+      @user = Current.account.users.active.find(params[:id])
    end

    def ensure_permission_to_change_user