summaryrefslogtreecommitdiff
path: root/app/finders
diff options
context:
space:
mode:
authorJames Lopez <james@jameslopez.es>2018-12-21 15:26:33 +0100
committerYorick Peterse <yorickpeterse@gmail.com>2019-01-31 16:51:16 +0100
commita3cde02651af6e18fd91416ac1378aaed36ed115 (patch)
treecf9412f35f95d078cfba83f7ced326852af8da0f /app/finders
parent57f082d969eae04112172495bb099e634069856c (diff)
downloadgitlab-ce-a3cde02651af6e18fd91416ac1378aaed36ed115.tar.gz
Fix contributed projects finder shown private info
Diffstat (limited to 'app/finders')
-rw-r--r--app/finders/contributed_projects_finder.rb7
1 files changed, 7 insertions, 0 deletions
diff --git a/app/finders/contributed_projects_finder.rb b/app/finders/contributed_projects_finder.rb
index c1ef9dfefa7..f8c7f0c3167 100644
--- a/app/finders/contributed_projects_finder.rb
+++ b/app/finders/contributed_projects_finder.rb
@@ -14,6 +14,9 @@ class ContributedProjectsFinder < UnionFinder
# Returns an ActiveRecord::Relation.
# rubocop: disable CodeReuse/ActiveRecord
def execute(current_user = nil)
+ # Do not show contributed projects if the user profile is private.
+ return Project.none unless can_read_profile?(current_user)
+
segments = all_projects(current_user)
find_union(segments, Project).includes(:namespace).order_id_desc
@@ -22,6 +25,10 @@ class ContributedProjectsFinder < UnionFinder
private
+ def can_read_profile?(current_user)
+ Ability.allowed?(current_user, :read_user_profile, @user)
+ end
+
def all_projects(current_user)
projects = []