Refs #5950 Fix 404 error when user wants to see CCSet from other organisation :

- remove begin_association_chain in controller
- Change collecyion to only see user organisayion CCSet and STIF CCSet
- add policy for show action

2 files changed, 9 insertions, 0 deletions

diff --git a/app/policies/application_policy.rb b/app/policies/application_policy.rb
index c44937c9e..d14839bdf 100644
--- a/app/policies/application_policy.rb
+++ b/app/policies/application_policy.rb
@@ -96,6 +96,11 @@ class ApplicationPolicy
   end
 
 
+  def belongs_to_stif?
+    record.try(:organisation).try(:code) == "STIF"
+  end
+
+
   #
   #  Helpers
   #  -------
diff --git a/app/policies/compliance_control_set_policy.rb b/app/policies/compliance_control_set_policy.rb
index 011f6c0c7..e3fb83e38 100644
--- a/app/policies/compliance_control_set_policy.rb
+++ b/app/policies/compliance_control_set_policy.rb
@@ -5,6 +5,10 @@ class ComplianceControlSetPolicy < ApplicationPolicy
     end
   end
 
+  def show?
+    organisation_match? or belongs_to_stif?
+  end
+
   def destroy?
     user.has_permission?('compliance_control_sets.destroy')
   end