diff options
| author | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2007-06-23 14:06:21 +0000 |
|---|---|---|
| committer | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2007-06-23 14:06:21 +0000 |
| commit | 1a2aee84b21a90ea0b0658520e3b93e6085c8eea (patch) | |
| tree | 31ae3e7aeacc3a3c0416ef2f57a38f03a39a3694 /app/controllers/account_controller.rb | |
| parent | 1c44600c62dc1063583d9e2015ab815d9dd22fa5 (diff) | |
| download | redmine-1a2aee84b21a90ea0b0658520e3b93e6085c8eea.tar.gz redmine-1a2aee84b21a90ea0b0658520e3b93e6085c8eea.zip | |
Fixed confidentiality issue on account/show.
Only public projects or private projects that the logged in user belongs to are displayed.
git-svn-id: http://redmine.rubyforge.org/svn/trunk@567 e93f8b46-1217-0410-a6f0-8f06a7374b81
Diffstat (limited to 'app/controllers/account_controller.rb')
| -rw-r--r-- | app/controllers/account_controller.rb | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/app/controllers/account_controller.rb b/app/controllers/account_controller.rb index 9b54a90ec..ecf37ed53 100644 --- a/app/controllers/account_controller.rb +++ b/app/controllers/account_controller.rb @@ -28,6 +28,11 @@ class AccountController < ApplicationController def show @user = User.find(params[:id]) @custom_values = @user.custom_values.find(:all, :include => :custom_field) + + # show only public projects and private projects that the logged in user is also a member of + @memberships = @user.memberships.select do |membership| + membership.project.is_public? || (logged_in_user && logged_in_user.role_for_project(membership.project)) + end rescue ActiveRecord::RecordNotFound render_404 end |