diff --git a/app/controllers/form/support_letters_controller.rb b/app/controllers/form/support_letters_controller.rb index 2aa7a0efd..673f6039c 100644 --- a/app/controllers/form/support_letters_controller.rb +++ b/app/controllers/form/support_letters_controller.rb @@ -30,6 +30,9 @@ def new end def destroy + # safeguard for the case when not a user tries to delete a letter + return if current_assessor || current_leutenant + if @support_letter.destroy remove_support_letter_from_document! @form_answer.save diff --git a/app/views/qae_form/_supporter_fields.html.slim b/app/views/qae_form/_supporter_fields.html.slim index abad4528c..531f51bd6 100644 --- a/app/views/qae_form/_supporter_fields.html.slim +++ b/app/views/qae_form/_supporter_fields.html.slim @@ -43,7 +43,7 @@ li.js-add-example class="#{'read-only js-support-letter-received' if persisted}" button.govuk-button.js-save-collection class=(persisted ? "visuallyhidden" : "") data-save-collection-url=users_form_answer_support_letters_url(@form_answer) | Submit letter of support - - if current_form_is_editable? + - if current_form_is_editable? && !current_lieutenant && !current_assessor - if persisted - if supporter["support_letter_id"].present? && @form_answer.support_letters.find_by_id(supporter["support_letter_id"]) - url = users_form_answer_support_letter_path(form_answer_id: @form_answer.id, id: supporter["support_letter_id"])