adds fix for security issue when annonymous user does not have access to repository we now display the activity feed instead of the readme23990-project-show-error-when-empty-repo

1 files changed, 3 insertions, 3 deletions

diff --git a/app/helpers/preferences_helper.rb b/app/helpers/preferences_helper.rb
index f7189e0c5a1..6e68aad4cb7 100644
--- a/app/helpers/preferences_helper.rb
+++ b/app/helpers/preferences_helper.rb
@@ -50,7 +50,7 @@ module PreferencesHelper
   end
 
   def default_project_view
-    return annonymous_project_view unless current_user
+    return anonymous_project_view unless current_user
 
     user_view = current_user.project_view
 
@@ -67,7 +67,7 @@ module PreferencesHelper
     end
   end
 
-  def annonymous_project_view
-    @project.empty_repo? ? 'empty' : 'readme'
+  def anonymous_project_view
+    @project.empty_repo? || !can?(current_user, :download_code, @project) ? 'activity' : 'readme'
   end
 end