From 4da64362676d82f720287f3c83a4ba84d709e27b Mon Sep 17 00:00:00 2001
From: Harry Bomrah <harry@rulingcom.com>
Date: Sat, 9 Mar 2019 13:28:52 +0800
Subject: [PATCH] Added authorization for index

---
 app/views/admin/universal_tables/_index.html.erb | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/app/views/admin/universal_tables/_index.html.erb b/app/views/admin/universal_tables/_index.html.erb
index 25ca3cc..4597fb9 100644
--- a/app/views/admin/universal_tables/_index.html.erb
+++ b/app/views/admin/universal_tables/_index.html.erb
@@ -8,12 +8,13 @@
 </thead>
 <tbody>
 	<% @tables.each do |table| %>
+	    <% can_edit = can_edit_or_delete?(table) %>
 		<tr id="table_<%= table.id.to_s %>">
 			<td>
 				<a href="<%= admin_universal_table_path(table) %>"><%= table.title %></a>
 				   <div class="quick-edit">
 		            <ul class="nav nav-pills">
-		              <% if can_edit_or_delete?(table) %>
+		              <% if can_edit %>
 		                <li><a href="<%= edit_admin_universal_table_path(table) %>"><%= t(:edit) %></a></li>
 		                <li><a href="/admin/universal_tables/<%=table.id.to_s%>/export_data?format=xlsx" data-table-id="<%= table.id.to_s %>" class="export-xls"><%= t('universal_table.export_xls') %></a></li>
 		                <li><a href="<%= admin_universal_table_path(table) %>" class="delete text-error" data-method="delete" data-confirm="Are you sure?"><%= t(:delete_) %></a></li>
@@ -28,6 +29,7 @@
 				<%= table.table_entries.count %>
 			</td>
 			<td>
+			<% if can_edit %>
 				<form action="/admin/universal_tables/import_data_from_excel" method="post" enctype="multipart/form-data" class="import_from_excel_form">
 					<%= hidden_field_tag :authenticity_token, form_authenticity_token %>
 					<input type="file" name="import_data" />
@@ -35,6 +37,7 @@
 					<input type="hidden" name="universal_table_id" value="<%= table.id.to_s %>" />
 					<a href="<%= admin_universal_table_export_structure_path(table, :format => "xlsx") %>"><%= t("universal_table.export_structure") %></a>
 				</form>
+			<% end %>
 			</td>
 		</tr>
 	<% end %>