models

24445 commits behind the upstream repository.

Restrict starred projects to viewable ones

Sean McGivern authored 8 years ago

`User#starred_projects` doesn't perform any visibility checks. This has
a couple of problems:

1. It assumes a user can always view all of their starred projects in
   perpetuity (project not changed to private, access revoked, etc.).
2. It assumes that we'll only ever allow a user to star a project they
   can view. This is currently the case, but bugs happen.

Add `User#viewable_starred_projects` to filter the starred projects by
those the user either has explicit access to, or are public or
internal. Then use that in all places where we list the user's starred
projects.

97424ea5

History

97424ea5 8 years ago

History

Name	Last commit	Last update
..
ci
concerns
hooks
members
project_services
abuse_report_spec.rb
appearance_spec.rb
application_setting_spec.rb
blob_spec.rb
broadcast_message_spec.rb
build_spec.rb
commit_range_spec.rb
commit_spec.rb
commit_status_spec.rb
deploy_key_spec.rb
deploy_keys_project_spec.rb
email_spec.rb
event_spec.rb
external_issue_spec.rb
forked_project_link_spec.rb
generic_commit_status_spec.rb
global_milestone_spec.rb
group_spec.rb
identity_spec.rb
issue_spec.rb
jira_issue_spec.rb
key_spec.rb
label_link_spec.rb
label_spec.rb
member_spec.rb
merge_request_spec.rb
milestone_spec.rb
namespace_spec.rb
note_spec.rb
notification_setting_spec.rb
project_group_link_spec.rb
project_security_spec.rb
project_snippet_spec.rb
project_spec.rb
project_team_spec.rb
project_wiki_spec.rb
protected_branch_spec.rb
release_spec.rb
repository_spec.rb
service_spec.rb
snippet_spec.rb
spam_log_spec.rb
todo_spec.rb
tree_spec.rb
user_spec.rb
wiki_page_spec.rb

Admin message

Admin message

models