Commit cb0af127 authored by Reuben Pereira's avatar Reuben Pereira
Browse files

Use a custom ProjectParser#nodes_visible_to_user function so that the user...

Use a custom ProjectParser#nodes_visible_to_user function so that the user permissions for all project references can be checked together
parent 9780fb6cf819
......@@ -7,10 +7,29 @@ def references_relation
Project
end
def nodes_visible_to_user(user, nodes)
nodes_projects_hash = lazy { projects_for_nodes(nodes) }
project_attr = 'data-project'
readable_project_ids = projects_readable_by_user(nodes_projects_hash.values, user)
nodes.select do |node|
if node.has_attribute?(project_attr)
readable_project_ids.include?(nodes_projects_hash[node].try(:id))
else
true
end
end
end
private
def can_read_reference?(user, ref_project, node)
can?(user, :read_project, ref_project)
# Returns an Array of Project ids that can be read by the given user.
#
# projects - The projects to reduce down to those readable by the user.
# user - The User for which to check the projects
def projects_readable_by_user(projects, user)
Project.public_or_visible_to_user(user).where("projects.id IN (?)", projects.collect(&:id)).pluck(:id)
end
end
end
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment