diff options
| author | James Lopez <james@jameslopez.es> | 2018-12-21 17:26:33 +0300 |
|---|---|---|
| committer | Yorick Peterse <yorickpeterse@gmail.com> | 2019-01-31 18:51:16 +0300 |
| commit | a3cde02651af6e18fd91416ac1378aaed36ed115 (patch) | |
| tree | cf9412f35f95d078cfba83f7ced326852af8da0f /app/finders | |
| parent | 57f082d969eae04112172495bb099e634069856c (diff) | |
Fix contributed projects finder shown private info
Diffstat (limited to 'app/finders')
| -rw-r--r-- | app/finders/contributed_projects_finder.rb | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/app/finders/contributed_projects_finder.rb b/app/finders/contributed_projects_finder.rb index c1ef9dfefa7..f8c7f0c3167 100644 --- a/app/finders/contributed_projects_finder.rb +++ b/app/finders/contributed_projects_finder.rb @@ -14,6 +14,9 @@ class ContributedProjectsFinder < UnionFinder # Returns an ActiveRecord::Relation. # rubocop: disable CodeReuse/ActiveRecord def execute(current_user = nil) + # Do not show contributed projects if the user profile is private. + return Project.none unless can_read_profile?(current_user) + segments = all_projects(current_user) find_union(segments, Project).includes(:namespace).order_id_desc @@ -22,6 +25,10 @@ class ContributedProjectsFinder < UnionFinder private + def can_read_profile?(current_user) + Ability.allowed?(current_user, :read_user_profile, @user) + end + def all_projects(current_user) projects = [] |