Authorization and supplier abilities

[ronzalo]

Maybe I'm wrong, but as a supplier, I can add new images to a product from another vendor if I access /admin/products/not-my-product/images

From the supplier_ability.rb

can [:admin, :manage], Spree::Image do |image|
  image.viewable.product.supplier_ids.include?(user.supplier_id)
end
can :create, Spree::Image

How can i patch this?

Any help would be welcome.