diff --git a/app/models/issue.rb b/app/models/issue.rb index 96c3f85..cfbe1bd 100644 --- a/app/models/issue.rb +++ b/app/models/issue.rb @@ -105,7 +105,7 @@ class Issue < ActiveRecord::Base when 'all' true when 'default' - !self.is_private? || self.author == user || user.is_or_belongs_to?(assigned_to) + !self.is_private? || (self.author == user && user != User.anonymous) || user.is_or_belongs_to?(assigned_to) when 'own' self.author == user || user.is_or_belongs_to?(assigned_to) else diff --git a/app/models/user.rb b/app/models/user.rb index d0d1df8..b8cd746 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -464,7 +464,7 @@ class User < Principal roles = roles_for_project(context) return false unless roles - roles.detect {|role| + roles.any? {|role| (context.is_public? || role.member?) && role.allowed_to?(action) && (block_given? ? yield(role, self) : true) @@ -483,7 +483,7 @@ class User < Principal # authorize if user has at least one role that has this permission roles = memberships.collect {|m| m.roles}.flatten.uniq roles << (self.logged? ? Role.non_member : Role.anonymous) - roles.detect {|role| + roles.any? {|role| role.allowed_to?(action) && (block_given? ? yield(role, self) : true) }