security improved

app/models/ability.rb

@@ -2,6 +2,9 @@ class Ability
   def self.allowed(object, subject)
     case subject.class.name
     when "Project" then project_abilities(object, subject)
+    when "Issue" then issue_abilities(object, subject)
+    when "Note" then note_abilities(object, subject)
+    when "Snippet" then snippet_abilities(object, subject)
     else []
     end
   end
@@ -34,4 +37,21 @@ class Ability
 
     rules.flatten
   end
+
+  class << self 
+    [:issue, :note, :snippet].each do |name|
+      define_method "#{name}_abilities" do |user, subject|
+        if subject.author == user
+          [
+            :"read_#{name}",
+            :"write_#{name}",
+            :"admin_#{name}"
+          ]
+        else
+          subject.respond_to?(:project) ? 
+            project_abilities(user, subject.project) : []
+        end
+      end
+    end
+  end
 end