[refs #57] Forbid access to users_path for simple users

app/models/ability.rb

@@ -31,6 +31,7 @@ class Ability
         can :read, Project, :visibility => 'open'
         can :read, Group
         can :read, User
+        cannot :index, User
         can :manage_collaborators, Project do |project|
           project.relations.exists? :object_id => user.id, :object_type => 'User', :role => 'admin'
         end

spec/controllers/users_controller_spec.rb

@@ -53,6 +53,9 @@ describe UsersController do
       set_session_for(@simple_user)
     end
 
-    it_should_behave_like 'user with users list viewer rights'
+    it 'should not be able to perform index action' do
+      get :index
+      response.should redirect_to(forbidden_path)
+    end
   end
 end