Fix visibility of private project snippets for members when searching

1 files changed, 10 insertions, 4 deletions

diff --git a/app/models/snippet.rb b/app/models/snippet.rb
index 3a191cd91d0..51f6ae7b25c 100644
--- a/app/models/snippet.rb
+++ b/app/models/snippet.rb
@@ -135,10 +135,16 @@ class Snippet < ActiveRecord::Base
     end
 
     def accessible_to(user)
-      visibility_levels = [Snippet::PUBLIC]
-      visibility_levels << Snippet::INTERNAL if user
-
-      where('visibility_level IN (?) OR author_id = ?', visibility_levels, user)
+      return are_public unless user.present?
+      return all if user.admin?
+
+      where(
+        'visibility_level IN (:visibility_levels)
+         OR author_id = :author_id
+         OR project_id IN (:project_ids)',
+         visibility_levels: [Snippet::PUBLIC, Snippet::INTERNAL],
+         author_id: user.id,
+         project_ids: user.authorized_projects.select(:id))
     end
   end
 end