scinote-eln/scinote-web
1
1
Fork 0
mirror of https://github.com/scinote-eln/scinote-web.git synced 2025-09-06 13:14:29 +08:00
Code Issues Projects Releases Packages Wiki Activity

Properly scope permission check to current team for user_group_assignments [SCI-12249]

Browse source
This commit is contained in:
Martin Artnik 2025-08-13 16:39:45 +02:00
parent a5cc736bf0
commit aaf100792c
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/models/concerns/permission_checkable_model.rb
View file

@ -50,7 +50,7 @@ module PermissionCheckableModel
end
user_roles = UserRole.left_outer_joins(:team_assignments, user_group_assignments: { user_group: :users })
user_roles.where(user_group_assignments: { assignable: self, user_groups: { users: user } })
user_roles.where(user_group_assignments: { assignable: self, user_groups: { users: user }, team: permission_team })
.or(user_roles.where(team_assignments: { assignable: self, team: permission_team }))
.exists?(['user_roles.permissions @> ARRAY[?]::varchar[]', [permission]])
end