meineerde/redmine
1
0
Fork 0
mirror of https://github.com/meineerde/redmine.git synced 2026-01-31 11:37:14 +00:00
Code Issues Releases Wiki Activity

Return 404 when filtering by a non-visible user in activity view (#35789).

Browse Source 
Patch by Mischa The Evil.

git-svn-id: http://svn.redmine.org/redmine/trunk@21209 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Marius Balteanu 2021-09-06 18:40:14 +00:00
parent 55ce8de0ae
commit 1e65114d68
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/controllers/activities_controller.rb
View File

@ -33,7 +33,7 @@ class ActivitiesController < ApplicationController
@date_from = @date_to - @days
@with_subprojects = params[:with_subprojects].nil? ? Setting.display_subprojects_issues? : (params[:with_subprojects] == '1')
if params[:user_id].present?
@author = User.active.find(params[:user_id])
@author = User.visible.active.find(params[:user_id])
end
@activity = Redmine::Activity::Fetcher.new(User.current, :project => @project,

12
test/functional/activities_controller_test.rb
View File

@ -107,6 +107,18 @@ class ActivitiesControllerTest < Redmine::ControllerTest
assert_response 404
end
def test_user_index_with_non_visible_user_id_should_respond_404
Role.anonymous.update! :users_visibility => 'members_of_visible_projects'
user = User.generate!
@request.session[:user_id] = nil
get :index, :params => {
:user_id => user.id
}
assert_response 404
end
def test_index_atom_feed
get(
:index,