kotovalexarian-likes-gitlab
/
gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Block internal groups/projects visibility to external users

This commit is contained in:
Felipe Artur 2016-03-16 21:23:59 -03:00
parent 44c127447b
commit a18ac62756
5 changed files with 11 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/finders/contributed_projects_finder.rb
View File

@ -11,7 +11,7 @@ class ContributedProjectsFinder
#
# Returns an ActiveRecord::Relation.
def execute(current_user = nil)
if current_user
if current_user && !current_user.external?
relation = projects_visible_to_user(current_user)
else
relation = public_projects

2
app/finders/joined_groups_finder.rb
View File

@ -12,7 +12,7 @@ class JoinedGroupsFinder
#
# Returns an ActiveRecord::Relation.
def execute(current_user = nil)
if current_user
if current_user && !current_user.external?
relation = groups_visible_to_user(current_user)
else
relation = public_groups

2
app/finders/personal_projects_finder.rb
View File

@ -11,7 +11,7 @@ class PersonalProjectsFinder
#
# Returns an ActiveRecord::Relation.
def execute(current_user = nil)
if current_user
if current_user && !current_user.external?
relation = projects_visible_to_user(current_user)
else
relation = public_projects

7
app/models/ability.rb
View File

@ -295,8 +295,11 @@ class Ability
end
def can_read_group?(user, group)
user.admin? || group.public? || group.internal? || group.users.include?(user) ||
ProjectsFinder.new.execute(user, group: group).any?
if user.external?
group.public? || ProjectsFinder.new.execute(user, group: group).any?
else
user.admin? || group.public? || group.internal? || group.users.include?(user) || ProjectsFinder.new.execute(user, group: group).any?
end
end
def namespace_abilities(user, namespace)

6
db/schema.rb
View File

@ -777,9 +777,9 @@ ActiveRecord::Schema.define(version: 20160314143402) do
t.string "type"
t.string "title"
t.integer "project_id"
t.datetime "created_at"
t.datetime "updated_at"
t.boolean "active", default: false, null: false
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
t.boolean "active", null: false
t.text "properties"
t.boolean "template", default: false
t.boolean "push_events", default: true