diff options
author | Douglas Barbosa Alexandre <dbalexandre@gmail.com> | 2016-03-17 22:38:51 +0300 |
---|---|---|
committer | Douglas Barbosa Alexandre <dbalexandre@gmail.com> | 2016-03-18 02:55:38 +0300 |
commit | 34ee75379cf8e6459b8926fbf956a8316f87eea7 (patch) | |
tree | 3e6baf1c719f061d3875a24c2cd0e799f2897f04 /app/models/ability.rb | |
parent | 6b86d3fb800bb551af4a446b87dfd64c963733a3 (diff) |
Restrict access to confidential issues
Diffstat (limited to 'app/models/ability.rb')
-rw-r--r-- | app/models/ability.rb | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/app/models/ability.rb b/app/models/ability.rb index ccac08b7d3f..e22da4806e6 100644 --- a/app/models/ability.rb +++ b/app/models/ability.rb @@ -49,7 +49,6 @@ class Ability rules = [ :read_project, :read_wiki, - :read_issue, :read_label, :read_milestone, :read_project_snippet, @@ -63,6 +62,9 @@ class Ability # Allow to read builds by anonymous user if guests are allowed rules << :read_build if project.public_builds? + # Allow to read issues by anonymous user if issue is not confidential + rules << :read_issue unless subject.is_a?(Issue) && subject.confidential? + rules - project_disabled_features_rules(project) else [] @@ -321,6 +323,7 @@ class Ability end rules += project_abilities(user, subject.project) + rules = filter_confidential_issues_abilities(user, subject, rules) if subject.is_a?(Issue) rules end end @@ -439,5 +442,17 @@ class Ability :"admin_#{name}" ] end + + def filter_confidential_issues_abilities(user, issue, rules) + return rules if user.admin? || !issue.confidential? + + unless issue.author == user || issue.assignee == user || issue.project.team.member?(user.id) + rules.delete(:admin_issue) + rules.delete(:read_issue) + rules.delete(:update_issue) + end + + rules + end end end |