diff options
author | Sean McGivern <sean@gitlab.com> | 2016-12-12 08:43:56 +0000 |
---|---|---|
committer | Alejandro RodrÃguez <alejorro70@gmail.com> | 2016-12-15 11:41:04 -0300 |
commit | 4bf61b8bd4b04eace6d0f205573f15fc9d981682 (patch) | |
tree | e085a0c2fae4c1791bd59f1dac45c7a0eff16d06 /app/finders/issues_finder.rb | |
parent | 12db4cc0e70d3e249f3bf9fde85e336839422319 (diff) | |
download | gitlab-ce-4bf61b8bd4b04eace6d0f205573f15fc9d981682.tar.gz |
Merge branch 'jej-24637-move-issue-visible_to_user-to-finder' into 'security'
Issue#visible_to_user moved to IssuesFinder
Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/24637.
See merge request !2039
Diffstat (limited to 'app/finders/issues_finder.rb')
-rw-r--r-- | app/finders/issues_finder.rb | 18 |
1 files changed, 17 insertions, 1 deletions
diff --git a/app/finders/issues_finder.rb b/app/finders/issues_finder.rb index be00a219205..707eddd4d29 100644 --- a/app/finders/issues_finder.rb +++ b/app/finders/issues_finder.rb @@ -23,10 +23,26 @@ class IssuesFinder < IssuableFinder private def init_collection - Issue.visible_to_user(current_user) + IssuesFinder.not_restricted_by_confidentiality(current_user) end def iid_pattern @iid_pattern ||= %r{\A#{Regexp.escape(Issue.reference_prefix)}(?<iid>\d+)\z} end + + def self.not_restricted_by_confidentiality(user) + return Issue.where('issues.confidential IS NULL OR issues.confidential IS FALSE') if user.blank? + + return Issue.all if user.admin? + + Issue.where(' + issues.confidential IS NULL + OR issues.confidential IS FALSE + OR (issues.confidential = TRUE + AND (issues.author_id = :user_id + OR issues.assignee_id = :user_id + OR issues.project_id IN(:project_ids)))', + user_id: user.id, + project_ids: user.authorized_projects(Gitlab::Access::REPORTER).select(:id)) + end end |