ryanb/cancan — pull request #531 by steerio (2011-12-15 17:17:18+00:00)
Title: Method destructs parameter, unconditionally authorizing the next rule

`Rule#nested_subject_matches_conditions?` uses `shift` on its `subject_hash` parameter, destroying it. As this hash contains one element (the hash format is merely syntactic sugar in calls to `can`), the next rule will get an empty hash, causing it to always return true.

I replaced it with `first`.