ryanb/cancan — pull request #622 by emiltin (2012-05-16 20:02:19+00:00)
Title: disable_risky_blocks() for disabling risky default block behaviour

consider this simple ability definition:

```ruby
class Ability < ActiveRecord::Base
include CanCan::Ability
def initialize(user)
can :manage, Group do |group|
user.admin?
end
end
end
```

without this patch, you might get a nasty surprise when you find out that non-admins can create (as well as index) groups. this is because defining a block makes cancan always return true when authorizing the involved class (without an object). there seems to be no way to disallowing :new on Groups without effectively disabling the block logic.

with this patch, you can call disable_risky_blocks() to make blocks return false instead of true when authorizing a class:

```ruby
class Ability < ActiveRecord::Base
include CanCan::Ability
def initialize(user)
disable_risky_blocks
can :manage, Group do |group|
user.admin?
end
end
end
```

now non-admins cannot create groups. if you want to allow it, just add:

```
can :new, Group
``

seems to work for me.