From db267e4c9cf5ac42e8819fd885f99f524ea0a9c4 Mon Sep 17 00:00:00 2001 From: Juliet Shin Date: Tue, 1 Sep 2026 15:04:23 -0700 Subject: [PATCH 1/2] fix(policy): harden authorization for plan resources Harden Pundit policies for contributor and research output endpoints to enforce the expected access controls. Reference: CDLUC3#803 - NOTE: The referenced PR also fixes app/controllers/paginable/research_outputs_controller.rb. However, that file does not exist within this codebase. Co-Authored-By: Juliet Shin <8452761+jupiter007@users.noreply.github.com> --- app/controllers/contributors_controller.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/app/controllers/contributors_controller.rb b/app/controllers/contributors_controller.rb index e260dbd731..1d4e2719bc 100644 --- a/app/controllers/contributors_controller.rb +++ b/app/controllers/contributors_controller.rb @@ -12,13 +12,13 @@ class ContributorsController < ApplicationController # GET /plans/:plan_id/contributors def index - authorize @plan + authorize @plan, :show? @contributors = @plan.contributors end # GET /plans/:plan_id/contributors/new def new - authorize @plan + authorize @plan, :edit? default_org = @plan.org.present? ? @plan.org : current_user.org @contributor = Contributor.new(plan: @plan, org: default_org) end From 0d56007e4a41d58ec682d15af1f2b7114df969d8 Mon Sep 17 00:00:00 2001 From: aaronskiba <71047780+aaronskiba@users.noreply.github.com> Date: Thu, 3 Sep 2026 10:32:35 -0600 Subject: [PATCH 2/2] Update CHANGELOG.md --- CHANGELOG.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index b5637083df..b45755b5c2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,8 @@ # Changelog +## v5.0.3 +- fix(policy): harden authorization for plan resources [#3613](https://github.com/DMPRoadmap/roadmap/pull/3613) + ## v5.0.2 - Bump Ruby to v3.1.4 and use `.ruby-version` in CI - [#3566](https://github.com/DMPRoadmap/roadmap/pull/3566)