Andy Allan 981e4a34b5 Use only token capabilities when a token is provided ... The Authenticate#allow? method (from oauth-plugin) sets current_user as a side effect of checking the token. But this allows a valid token to access all actions that are available to that user, beyond the capabilities for that token.		2018-12-12 16:16:23 +01:00
..
abilities	Use CanCanCan for user_roles auth	2018-11-28 21:39:26 +01:00
controllers	Use only token capabilities when a token is provided	2018-12-12 16:16:23 +01:00
factories	Use CanCanCan for changeset comments	2018-11-28 12:35:45 +01:00
gpx	Link GPX fixture files instead of stubbing	2017-02-05 17:26:31 +00:00
helpers	Split browse_helper.rb into two modules due to rubocop ModuleLength	2018-11-28 18:18:14 +00:00
http	Remove npemap as a source for UK postcodes	2018-02-04 15:14:41 +00:00
integration	Remove user_roles integration test since it is not meaningful	2018-11-28 17:22:31 +01:00
javascripts	Filter out nodes which are too far away	2014-03-16 16:18:13 +00:00
lib	Resolve 34 Rubocop Lint/AmbiguousOperator conflicts	2018-09-10 11:43:50 +08:00
models	Remove unnecessary include from redaction model test	2018-11-07 16:48:48 +01:00
system	Remove custom deny_access handlers	2018-11-14 14:10:51 +01:00
validators	Merge character validators	2018-11-05 18:54:19 +00:00
application_system_test_case.rb	Block non-localhost requests for all tests	2018-07-10 18:59:15 +01:00
test_helper.rb	Fix tests for rails 5.2.1 compatibility	2018-11-15 00:46:53 +00:00