fixed: non public projects were shown on welcome screen even if current user is not a member

git-svn-id: http://redmine.rubyforge.org/svn/trunk@129 e93f8b46-1217-0410-a6f0-8f06a7374b81

1 files changed, 12 insertions, 3 deletions

diff --git a/app/models/project.rb b/app/models/project.rb
index 1fc2cffa1..7db061a62 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -35,11 +35,20 @@ class Project < ActiveRecord::Base
   validates_associated :repository

   validates_format_of :name, :with => /^[\w\s\'\-]*$/i

 

-  # returns 5 last created projects

-  def self.latest

-    find(:all, :limit => 5, :order => "created_on DESC")	

+  # returns latest created projects

+  # non public projects will be returned only if user is a member of those

+  def self.latest(user=nil, count=5)

+    find(:all, :limit => count, :conditions => visible_by(user), :order => "projects.created_on DESC")	

   end	

 

+  def self.visible_by(user=nil)

+    if user && !user.memberships.empty?

+      return ["projects.is_public = ? or projects.id IN (#{user.memberships.collect{|m| m.project_id}.join(',')})", true]

+    else

+      return ["projects.is_public = ?", true]

+    end

+  end

+  

   # Returns an array of all custom fields enabled for project issues

   # (explictly associated custom fields and custom fields enabled for all projects)

   def custom_fields_for_issues(tracker)