Commit 20443f02 authored by Dmitriy Zaporozhets's avatar Dmitriy Zaporozhets
Browse files

authorized_projects and authorized_groups methods for user

parent a4f174923fe3
......@@ -5,5 +5,6 @@
before_filter :event_filter, only: :index
def index
@groups = current_user.accessed_groups
@groups = current_user.authorized_groups
@projects = @projects.page(params[:page]).per(30)
......@@ -9,4 +10,5 @@
@projects = @projects.page(params[:page]).per(30)
@events = Event.in_projects(current_user.project_ids)
@events = @event_filter.apply_filter(@events)
@events = @events.limit(20).offset(params[:offset] || 0)
......@@ -43,7 +45,7 @@
protected
def projects
@projects = current_user.projects_sorted_by_activity
@projects = current_user.authorized_projects.sorted_by_activity
end
def event_filter
......
......@@ -5,6 +5,9 @@
before_filter :group
before_filter :projects
# Authorize
before_filter :authorize_read_group!
def show
@events = Event.in_projects(project_ids).limit(20).offset(params[:offset] || 0)
@last_push = current_user.recent_push
......@@ -54,15 +57,9 @@
end
def projects
@projects ||= begin
if can?(current_user, :manage_group, @group)
@group.projects
else
current_user.projects.where(namespace_id: @group.id)
end.sorted_by_activity.all
end
@projects ||= group.projects.authorized_for(current_user).sorted_by_activity
end
def project_ids
projects.map(&:id)
end
......@@ -64,6 +61,13 @@
end
def project_ids
projects.map(&:id)
end
# Dont allow unauthorized access to group
def authorize_read_group!
unless projects.present? or can?(current_user, :manage_group, @group)
return render_404
end
end
end
......@@ -76,6 +76,11 @@
scope :sorted_by_activity, ->() { order("(SELECT max(events.created_at) FROM events WHERE events.project_id = projects.id) DESC") }
class << self
def authorized_for user
projects = includes(:users_projects, :namespace)
projects = projects.where("users_projects.user_id = :user_id or projects.owner_id = :user_id or namespaces.owner_id = :user_id", user_id: user.id)
end
def active
joins(:issues, :notes, :merge_requests).order("issues.created_at, notes.created_at, merge_requests.created_at DESC")
end
......@@ -285,9 +290,4 @@
merge_requests
end
end
def self.authorized_for user
projects = includes(:users_projects, :namespace)
projects = projects.where("users_projects.user_id = :user_id or projects.owner_id = :user_id or namespaces.owner_id = :user_id", user_id: user.id)
end
end
......@@ -124,10 +124,10 @@
end
end
def accessed_groups
@accessed_groups ||= begin
def authorized_groups
@authorized_groups ||= begin
groups = Group.where(id: self.projects.pluck(:namespace_id)).all
groups = groups + self.groups
groups.uniq
end
end
......@@ -129,6 +129,10 @@
groups = Group.where(id: self.projects.pluck(:namespace_id)).all
groups = groups + self.groups
groups.uniq
end
end
def authorized_projects
Project.authorized_for(self)
end
end
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment