diff options
| author | Tomasz Maczukin <tomasz@maczukin.pl> | 2016-02-04 16:53:53 +0300 |
|---|---|---|
| committer | Tomasz Maczukin <tomasz@maczukin.pl> | 2016-02-19 15:18:47 +0300 |
| commit | f21b15d5f5af150ef39f338a4d4afb495402311a (patch) | |
| tree | 5bfa6a61003232857d02980c4265e5fe90c780ee /lib/api/runners.rb | |
| parent | b58744cd93ed572e4a40ab3f35ff69753a4cd42b (diff) | |
Limit projects to user available projects if user is not an admin
Diffstat (limited to 'lib/api/runners.rb')
| -rw-r--r-- | lib/api/runners.rb | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/lib/api/runners.rb b/lib/api/runners.rb index c08d6729dd8..4a0e68a4ddb 100644 --- a/lib/api/runners.rb +++ b/lib/api/runners.rb @@ -33,7 +33,11 @@ module API runner = get_runner(params[:id]) authenticate_show_runner!(runner) - present runner, with: Entities::RunnerDetails, user_is_admin: current_user.is_admin? + available_projects_ids = runner.projects.select{ |p| can?(current_user, :read_project, p) } + .map(&:id) unless current_user.is_admin? + + present runner, with: Entities::RunnerDetails, user_is_admin: current_user.is_admin?, + available_projects_ids: available_projects_ids end # Update runner's details |