diff options
author | Douwe Maan <douwe@selenight.nl> | 2016-03-20 16:57:25 +0300 |
---|---|---|
committer | Douwe Maan <douwe@selenight.nl> | 2016-03-20 16:57:25 +0300 |
commit | 2eb19ea3ea36916bbea72a8ccab3e6d15f602ac9 (patch) | |
tree | 55c08bbb50e92ce76028f68a5267401a76bc4b02 /app/models/ability.rb | |
parent | 8b830b8c3b32774e8ccf562b8bc9dbce3ecf3073 (diff) | |
parent | 01fe50a72513a88f2168c8c0a649661b1382a42b (diff) |
Merge branch 'master' into issue_12658
Diffstat (limited to 'app/models/ability.rb')
-rw-r--r-- | app/models/ability.rb | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/app/models/ability.rb b/app/models/ability.rb index 61d5e7dc859..88d7ecf3a16 100644 --- a/app/models/ability.rb +++ b/app/models/ability.rb @@ -49,7 +49,6 @@ class Ability rules = [ :read_project, :read_wiki, - :read_issue, :read_label, :read_milestone, :read_project_snippet, @@ -63,6 +62,9 @@ class Ability # Allow to read builds by anonymous user if guests are allowed rules << :read_build if project.public_builds? + # Allow to read issues by anonymous user if issue is not confidential + rules << :read_issue unless subject.is_a?(Issue) && subject.confidential? + rules - project_disabled_features_rules(project) else [] @@ -325,6 +327,7 @@ class Ability end rules += project_abilities(user, subject.project) + rules = filter_confidential_issues_abilities(user, subject, rules) if subject.is_a?(Issue) rules end end @@ -443,5 +446,17 @@ class Ability :"admin_#{name}" ] end + + def filter_confidential_issues_abilities(user, issue, rules) + return rules if user.admin? || !issue.confidential? + + unless issue.author == user || issue.assignee == user || issue.project.team.member?(user.id) + rules.delete(:admin_issue) + rules.delete(:read_issue) + rules.delete(:update_issue) + end + + rules + end end end |