diff options
author | Douglas Barbosa Alexandre <dbalexandre@gmail.com> | 2016-06-23 01:29:40 +0300 |
---|---|---|
committer | Douglas Barbosa Alexandre <dbalexandre@gmail.com> | 2016-06-23 02:09:19 +0300 |
commit | 256cd8e498edfcbb8199abfb2b54d2d2905f030e (patch) | |
tree | 0b1b782c5c84488c148a6e4e7f6ada0918de2bce /app/models/snippet.rb | |
parent | 8f9b64c720d55ee40066d5a6b1017ab95dbd9781 (diff) |
Fix visibility of private project snippets for members when searching
Diffstat (limited to 'app/models/snippet.rb')
-rw-r--r-- | app/models/snippet.rb | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/app/models/snippet.rb b/app/models/snippet.rb index 3a191cd91d0..51f6ae7b25c 100644 --- a/app/models/snippet.rb +++ b/app/models/snippet.rb @@ -135,10 +135,16 @@ class Snippet < ActiveRecord::Base end def accessible_to(user) - visibility_levels = [Snippet::PUBLIC] - visibility_levels << Snippet::INTERNAL if user - - where('visibility_level IN (?) OR author_id = ?', visibility_levels, user) + return are_public unless user.present? + return all if user.admin? + + where( + 'visibility_level IN (:visibility_levels) + OR author_id = :author_id + OR project_id IN (:project_ids)', + visibility_levels: [Snippet::PUBLIC, Snippet::INTERNAL], + author_id: user.id, + project_ids: user.authorized_projects.select(:id)) end end end |