spree/spree — pull request #5624 by greinacker (2014-11-17 23:03:22+00:00)
Title: Authorization fix for shipment manifests

When editing a shipment with limited permissions (e.g. a point of sale role), the shipment manifest authorization fails. Specifically this code:

```
<% shipment.manifest.each do |item| %>
[...]
<% if can? :update, item %>
```

The item variable is a shipment manifest, which is an OpenStruct. This doesn't fit well into the authorization scheme used throughout.

To fix, I made the authorization check be against the shipment as a whole:

```
<% if can? :update, shipment %>
```

I made the update against 2-0-stable, as that's the version I'm using - however, a quick look indicates this code is still being used in master, so presumably all release branches should be updated.