deac/gitlabhq
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

authorized_projects and authorized_groups methods for user

Browse source
This commit is contained in:
Dmitriy Zaporozhets 2012-11-29 17:17:01 +02:00
parent 83f2a387d6
commit 9df6f7bfad
4 changed files with 26 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

18
app/controllers/groups_controller.rb
View file

@ -5,6 +5,9 @@ class GroupsController < ApplicationController
before_filter :group
before_filter :projects
# Authorize
before_filter :authorize_read_group!
def show
@events = Event.in_projects(project_ids).limit(20).offset(params[:offset] || 0)
@last_push = current_user.recent_push
@ -54,16 +57,17 @@ class GroupsController < ApplicationController
end
def projects
@projects ||= begin
if can?(current_user, :manage_group, @group)
@group.projects
else
current_user.projects.where(namespace_id: @group.id)
end.sorted_by_activity.all
end
@projects ||= group.projects.authorized_for(current_user).sorted_by_activity
end
def project_ids
projects.map(&:id)
end
# Dont allow unauthorized access to group
def authorize_read_group!
unless projects.present? or can?(current_user, :manage_group, @group)
return render_404
end
end
end