diff options
| author | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2007-06-23 14:06:21 +0000 |
|---|---|---|
| committer | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2007-06-23 14:06:21 +0000 |
| commit | 1a2aee84b21a90ea0b0658520e3b93e6085c8eea (patch) | |
| tree | 31ae3e7aeacc3a3c0416ef2f57a38f03a39a3694 | |
| parent | 1c44600c62dc1063583d9e2015ab815d9dd22fa5 (diff) | |
| download | redmine-1a2aee84b21a90ea0b0658520e3b93e6085c8eea.tar.gz redmine-1a2aee84b21a90ea0b0658520e3b93e6085c8eea.zip | |
Fixed confidentiality issue on account/show.
Only public projects or private projects that the logged in user belongs to are displayed.
git-svn-id: http://redmine.rubyforge.org/svn/trunk@567 e93f8b46-1217-0410-a6f0-8f06a7374b81
| -rw-r--r-- | app/controllers/account_controller.rb | 5 | ||||
| -rw-r--r-- | app/views/account/show.rhtml | 10 |
2 files changed, 10 insertions, 5 deletions
diff --git a/app/controllers/account_controller.rb b/app/controllers/account_controller.rb index 9b54a90ec..ecf37ed53 100644 --- a/app/controllers/account_controller.rb +++ b/app/controllers/account_controller.rb @@ -28,6 +28,11 @@ class AccountController < ApplicationController def show @user = User.find(params[:id]) @custom_values = @user.custom_values.find(:all, :include => :custom_field) + + # show only public projects and private projects that the logged in user is also a member of + @memberships = @user.memberships.select do |membership| + membership.project.is_public? || (logged_in_user && logged_in_user.role_for_project(membership.project)) + end rescue ActiveRecord::RecordNotFound render_404 end diff --git a/app/views/account/show.rhtml b/app/views/account/show.rhtml index 19fedb3b6..cadd807f0 100644 --- a/app/views/account/show.rhtml +++ b/app/views/account/show.rhtml @@ -13,12 +13,12 @@ </p> <h3><%=l(:label_project_plural)%></h3> -<p> -<% for membership in @user.memberships %> - <%= membership.project.name %> (<%= membership.role.name %>, <%= format_date(membership.created_on) %>) - <br /> +<ul> +<% for membership in @memberships %> + <li><%= link_to membership.project.name, :controller => 'projects', :action => 'show', :id => membership.project %> + (<%= membership.role.name %>, <%= format_date(membership.created_on) %>)</li> <% end %> -</p> +</ul> <h3><%=l(:label_activity)%></h3> <p> |