scinote-eln/scinote-web
1
1
Fork 0
mirror of https://github.com/scinote-eln/scinote-web.git synced 2025-01-31 12:09:17 +08:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #1349 from okriuchykhin/ok_SCI_2818

Browse source 
Fix project index endpoint permission bug [SCI-2818]
This commit is contained in:
Alex Kriuchykhin 2018-10-29 14:59:22 +01:00 committed by GitHub
commit 126fa03305
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
app/controllers/api/v1/projects_controller.rb
View file

@ -9,6 +9,7 @@ module Api
def index
projects = @team.projects
.visible_to(current_user, @team)
.page(params.dig(:page, :number))
.per(params.dig(:page, :size))

10
app/models/project.rb
View file

@ -39,6 +39,16 @@ class Project < ApplicationRecord
has_many :reports, inverse_of: :project, dependent: :destroy
has_many :report_elements, inverse_of: :project, dependent: :destroy
scope :visible_to, (lambda do |user, team|
unless user.is_admin_of_team?(team)
left_outer_joins(:user_projects)
.where(
'visibility = 1 OR user_projects.user_id = :id',
id: user.id
)
end
end)
after_commit do
Views::Datatables::DatatablesReport.refresh_materialized_view
end