scinote-eln/scinote-web
1
1
Fork 0
mirror of https://github.com/scinote-eln/scinote-web.git synced 2025-10-09 13:28:53 +08:00
Code Issues Projects Releases Packages Wiki Activity

Improve hadling of unaccessible inventories in snapshot versions sidebar [SCI-7577]

Browse source
This commit is contained in:
Oleksii Kriuchykhin 2022-12-13 16:12:08 +01:00
parent ff6471ce14
commit 9900b62e03
3 changed files with 5 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
app/controllers/my_module_repository_snapshots_controller.rb
View file

@ -71,12 +71,7 @@ class MyModuleRepositorySnapshotsController < ApplicationController
end end
def full_view_sidebar def full_view_sidebar
@repository = Repository.find_by(id: params[:repository_id]) @repository = Repository.viewable_by_user(current_user, current_team).find_by(id: params[:repository_id])
if @repository
return render_403 unless can_read_repository?(@repository)
end
@repository_snapshots = @my_module.repository_snapshots @repository_snapshots = @my_module.repository_snapshots
.where(parent_id: params[:repository_id]) .where(parent_id: params[:repository_id])
.order(created_at: :desc) .order(created_at: :desc)

4
app/models/repository.rb
View file

@ -170,8 +170,8 @@ class Repository < RepositoryBase
team_shared_objects.where(team: team, permission_level: :shared_write).any? team_shared_objects.where(team: team, permission_level: :shared_write).any?
end end
def self.viewable_by_user(_user, teams) def self.viewable_by_user(user, teams)
accessible_by_teams(teams) accessible_by_teams(teams).with_granted_permissions(user, RepositoryPermissions::READ)
end end
def self.name_like(query) def self.name_like(query)

4
app/permissions/repository.rb
View file

@ -4,9 +4,9 @@ Canaid::Permissions.register_for(RepositoryBase) do
# repository: read/export # repository: read/export
can :read_repository do |user, repository| can :read_repository do |user, repository|
if repository.is_a?(RepositorySnapshot) if repository.is_a?(RepositorySnapshot)
user.teams.include?(repository.team) can_read_my_module?(user, repository.my_module)
else else
user.teams.include?(repository.team) || repository.shared_with?(user.current_team) repository.permission_granted?(user, RepositoryPermissions::READ)
end end
end end
end end