97424ea544
`User#starred_projects` doesn't perform any visibility checks. This has a couple of problems: 1. It assumes a user can always view all of their starred projects in perpetuity (project not changed to private, access revoked, etc.). 2. It assumes that we'll only ever allow a user to star a project they can view. This is currently the case, but bugs happen. Add `User#viewable_starred_projects` to filter the starred projects by those the user either has explicit access to, or are public or internal. Then use that in all places where we list the user's starred projects.
58 lines
1.5 KiB
Ruby
58 lines
1.5 KiB
Ruby
class Dashboard::ProjectsController < Dashboard::ApplicationController
|
|
include FilterProjects
|
|
|
|
before_action :event_filter
|
|
|
|
def index
|
|
@projects = current_user.authorized_projects.sorted_by_activity
|
|
@projects = filter_projects(@projects)
|
|
@projects = @projects.includes(:namespace)
|
|
@projects = @projects.sort(@sort = params[:sort])
|
|
@projects = @projects.page(params[:page])
|
|
|
|
@last_push = current_user.recent_push
|
|
|
|
respond_to do |format|
|
|
format.html
|
|
format.atom do
|
|
event_filter
|
|
load_events
|
|
render layout: false
|
|
end
|
|
format.json do
|
|
render json: {
|
|
html: view_to_html_string("dashboard/projects/_projects", locals: { projects: @projects })
|
|
}
|
|
end
|
|
end
|
|
end
|
|
|
|
def starred
|
|
@projects = current_user.viewable_starred_projects.sorted_by_activity
|
|
@projects = filter_projects(@projects)
|
|
@projects = @projects.includes(:namespace, :forked_from_project, :tags)
|
|
@projects = @projects.sort(@sort = params[:sort])
|
|
@projects = @projects.page(params[:page])
|
|
|
|
@last_push = current_user.recent_push
|
|
@groups = []
|
|
|
|
respond_to do |format|
|
|
format.html
|
|
|
|
format.json do
|
|
render json: {
|
|
html: view_to_html_string("dashboard/projects/_projects", locals: { projects: @projects })
|
|
}
|
|
end
|
|
end
|
|
end
|
|
|
|
private
|
|
|
|
def load_events
|
|
@events = Event.in_projects(@projects)
|
|
@events = @event_filter.apply_filter(@events).with_associations
|
|
@events = @events.limit(20).offset(params[:offset] || 0)
|
|
end
|
|
end
|