Only show activities for repositories on dashboard, that the user has access to

diff --git a/models/action.go b/models/action.go
index 33d5246ee57e8134a1a525b993915f7e22595650..5a38da87c0218af42454763edc2bbe97b90b1ea4 100644 (file)
--- a/models/action.go
+++ b/models/action.go
@@ -593,12 +593,29 @@ func MergePullRequestAction(actUser *User, repo *Repository, pull *Issue) error
 }
 
 // GetFeeds returns action list of given user in given context.
-func GetFeeds(uid, offset int64, isProfile bool) ([]*Action, error) {
+// ctxUserID is the user who's requesting, userID is the user/org that is requested.
+// ctxUserID can be -1, if isProfile is true or in order to skip the permission check.
+func GetFeeds(ctxUserID, userID, offset int64, isProfile bool) ([]*Action, error) {
        actions := make([]*Action, 0, 20)
-       sess := x.Limit(20, int(offset)).Desc("id").Where("user_id=?", uid)
+       sess := x.Limit(20, int(offset)).Desc("id").Where("user_id=?", userID)
        if isProfile {
-               sess.And("is_private=?", false).And("act_user_id=?", uid)
+               sess.And("is_private=?", false).And("act_user_id=?", userID)
+       } else if ctxUserID != -1 {
+               ctxUser := &User{Id: userID}
+               if err := ctxUser.GetUserRepositories(ctxUserID); err != nil {
+                       return nil, err
+               }
+
+               var repoIDs []int64
+               for     _, repo := range ctxUser.Repos {
+                       repoIDs = append(repoIDs, repo.ID)
+               }
+
+               if len(repoIDs) > 0 {
+                       sess.In("repo_id", repoIDs)
+               }
        }
+
        err := sess.Find(&actions)
        return actions, err
 }

diff --git a/routers/user/home.go b/routers/user/home.go
index e1f942df8fe8a067477078ec9d4ade6e9d2fa4dd..d48f28316ee9930d90b0ea636f2be2668db7b70b 100644 (file)
--- a/routers/user/home.go
+++ b/routers/user/home.go
@@ -51,8 +51,8 @@ func getDashboardContextUser(ctx *middleware.Context) *models.User {
        return ctxUser
 }
 
-func retrieveFeeds(ctx *middleware.Context, uid, offset int64, isProfile bool) {
-       actions, err := models.GetFeeds(uid, offset, isProfile)
+func retrieveFeeds(ctx *middleware.Context, ctxUserID, userID, offset int64, isProfile bool) {
+       actions, err := models.GetFeeds(ctxUserID, userID, offset, isProfile)
        if err != nil {
                ctx.Handle(500, "GetFeeds", err)
                return
@@ -140,7 +140,7 @@ func Dashboard(ctx *middleware.Context) {
        ctx.Data["MirrorCount"] = len(mirrors)
        ctx.Data["Mirrors"] = mirrors
 
-       retrieveFeeds(ctx, ctxUser.Id, 0, false)
+       retrieveFeeds(ctx, ctx.User.Id, ctxUser.Id, 0, false)
        if ctx.Written() {
                return
        }

diff --git a/routers/user/profile.go b/routers/user/profile.go
index 0a876610edec33230839ff2a29f4f9b6b2d8a25a..c1ebc3bf83b91f0fad77b80427b02dea11c35324 100644 (file)
--- a/routers/user/profile.go
+++ b/routers/user/profile.go
@@ -86,7 +86,7 @@ func Profile(ctx *middleware.Context) {
        ctx.Data["TabName"] = tab
        switch tab {
        case "activity":
-               retrieveFeeds(ctx, u.Id, 0, true)
+               retrieveFeeds(ctx, -1, u.Id, 0, true)
                if ctx.Written() {
                        return
                }