spree/spree — Issue #741: CanCan AccessDenied exception was not caught by BaseController
Author: zyang
Created: 2011-11-08 23:29:32+00:00
State: open

Go to url /orders/R123, where R123 is a valid order id but doesn't belong to the current logged in user. The CanCan exception page is shown instead of redirecting to the login page.

This bug is consistently reproducible with the store order page. The admin pages are catching the authorization exception correctly.