From e60ec75303475083746e2d09d2a99cc5c6ea0221 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jarka=20Kadlecov=C3=A1?= Date: Tue, 17 Jul 2018 16:16:46 +0200 Subject: =?UTF-8?q?Don=E2=80=99t=20do=20authorisation=20checks=20for=20tod?= =?UTF-8?q?os?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- app/finders/todos_finder.rb | 19 ------------------- 1 file changed, 19 deletions(-) (limited to 'app/finders/todos_finder.rb') diff --git a/app/finders/todos_finder.rb b/app/finders/todos_finder.rb index 2156413fb26..c505a5cc8d5 100644 --- a/app/finders/todos_finder.rb +++ b/app/finders/todos_finder.rb @@ -39,7 +39,6 @@ class TodosFinder # Filtering by project HAS TO be the last because we use # the project IDs yielded by the todos query thus far items = by_project(items) - items = visible_to_user(items) sort(items) end @@ -96,10 +95,6 @@ class TodosFinder @project = Project.find(params[:project_id]) @project = nil if @project.pending_delete? - - unless Ability.allowed?(current_user, :read_project, @project) - @project = nil - end else @project = nil end @@ -170,20 +165,6 @@ class TodosFinder items end - def visible_to_user(items) - projects = Project.public_or_visible_to_user(current_user) - groups = Group.public_or_visible_to_user(current_user) - - items - .joins('LEFT JOIN namespaces ON namespaces.id = todos.group_id') - .joins('LEFT JOIN projects ON projects.id = todos.project_id') - .where( - 'project_id IN (?) OR group_id IN (?)', - projects.select(:id), - groups.select(:id) - ) - end - def by_state(items) case params[:state].to_s when 'done' -- cgit v1.2.3