xrymbos/nztrain-v2 — comment on commit 05fbc2af0a3eb2d3f25dfe663351ab16edb2b340
File:  line 0
By ronalchn:

This branch is now in a usable form.
/app/model/ability.rb file, with permission settings, can be reviewed, before this branch gets merged into master.

Tested that some of the authorizations works already. Further tests can be done.

Also, existing code has security flaws. Before this branch, any users can make themselves admins when they sign up. With this branch, other parts may still be somewhat vulnerable. For example, users may also be able to give themselves any number of brownie points. However, I won't detail how this can be done, ahead of updates to the live code.