fixed: non public projects were shown on welcome screen even if current user is not...

git-svn-id: http://redmine.rubyforge.org/svn/trunk@129 e93f8b46-1217-0410-a6f0-8f06a7374b81

diff --git a/app/controllers/welcome_controller.rb b/app/controllers/welcome_controller.rb
index c47198d514081eff42c0779fe909d5f693c24f4c..ce45076d5642d7aa09a4e2279e853347df94ac93 100644 (file)
--- a/app/controllers/welcome_controller.rb
+++ b/app/controllers/welcome_controller.rb
@@ -19,7 +19,7 @@ class WelcomeController < ApplicationController
   layout 'base'\r
 \r
   def index\r
-    @news = News.latest\r
-    @projects = Project.latest\r
+    @news = News.latest logged_in_user\r
+    @projects = Project.latest logged_in_user\r
   end
 end

diff --git a/app/models/news.rb b/app/models/news.rb
index 0083a0eaeb962211212e40b236c605c21e3aec28..89e94f1ce45e0df4cf1910e45702559e9f78855f 100644 (file)
--- a/app/models/news.rb
+++ b/app/models/news.rb
@@ -22,8 +22,8 @@ class News < ActiveRecord::Base
   \r
   validates_presence_of :title, :description\r
   \r
-  # returns last created news\r
-  def self.latest\r
-    find(:all, :limit => 5, :include => [ :author, :project ], :order => "news.created_on DESC")       \r
+  # returns latest news for projects visible by user\r
+  def self.latest(user=nil, count=5)\r
+    find(:all, :limit => count, :conditions => Project.visible_by(user), :include => [ :author, :project ], :order => "news.created_on DESC")  \r
   end
 end

diff --git a/app/models/project.rb b/app/models/project.rb
index 1fc2cffa193cc590d99607060c9e216ac19d955c..7db061a621b422d9a3e1946fb4b22a0761fe894d 100644 (file)
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -35,11 +35,20 @@ class Project < ActiveRecord::Base
   validates_associated :repository\r
   validates_format_of :name, :with => /^[\w\s\'\-]*$/i\r
 \r
-  # returns 5 last created projects\r
-  def self.latest\r
-    find(:all, :limit => 5, :order => "created_on DESC")       \r
+  # returns latest created projects\r
+  # non public projects will be returned only if user is a member of those\r
+  def self.latest(user=nil, count=5)\r
+    find(:all, :limit => count, :conditions => visible_by(user), :order => "projects.created_on DESC") \r
   end  \r
 \r
+  def self.visible_by(user=nil)\r
+    if user && !user.memberships.empty?\r
+      return ["projects.is_public = ? or projects.id IN (#{user.memberships.collect{|m| m.project_id}.join(',')})", true]\r
+    else\r
+      return ["projects.is_public = ?", true]\r
+    end\r
+  end\r
+  \r
   # Returns an array of all custom fields enabled for project issues\r
   # (explictly associated custom fields and custom fields enabled for all projects)\r
   def custom_fields_for_issues(tracker)\r