authorized_projects and authorized_groups methods for user

app/controllers/dashboard_controller.rb

@@ -5,8 +5,10 @@ class DashboardController < ApplicationController
   before_filter :event_filter, only: :index
 
   def index
-    @groups = current_user.accessed_groups
+    @groups = current_user.authorized_groups
+
     @projects = @projects.page(params[:page]).per(30)
+
     @events = Event.in_projects(current_user.project_ids)
     @events = @event_filter.apply_filter(@events)
     @events = @events.limit(20).offset(params[:offset] || 0)
@@ -43,7 +45,7 @@ class DashboardController < ApplicationController
   protected
 
   def projects
-    @projects = current_user.projects_sorted_by_activity
+    @projects = current_user.authorized_projects.sorted_by_activity
   end
 
   def event_filter

app/controllers/groups_controller.rb

@@ -5,6 +5,9 @@ class GroupsController < ApplicationController
   before_filter :group
   before_filter :projects
 
+  # Authorize
+  before_filter :authorize_read_group!
+
   def show
     @events = Event.in_projects(project_ids).limit(20).offset(params[:offset] || 0)
     @last_push = current_user.recent_push
@@ -54,16 +57,17 @@ class GroupsController < ApplicationController
   end
 
   def projects
-    @projects ||= begin
-                    if can?(current_user, :manage_group, @group)
-                      @group.projects
-                    else
-                      current_user.projects.where(namespace_id: @group.id)
-                    end.sorted_by_activity.all
-                  end
+    @projects ||= group.projects.authorized_for(current_user).sorted_by_activity
   end
 
   def project_ids
     projects.map(&:id)
   end
+
+  # Dont allow unauthorized access to group
+  def authorize_read_group!
+    unless projects.present? or can?(current_user, :manage_group, @group)
+      return render_404
+    end
+  end
 end