Defect #44738 ยป 0001-Omit-the-members-subquery-from-allowed_to_condition-.patch
| app/models/project.rb | ||
|---|---|---|
| 214 | 214 |
unless options[:member] |
| 215 | 215 |
role = user.builtin_role |
| 216 | 216 |
if role.allowed_to?(permission, oauth_scope) |
| 217 |
s = "#{Project.table_name}.is_public = #{connection.quoted_true}"
|
|
| 218 |
if user.id |
|
| 217 |
public_project_condition = "#{Project.table_name}.is_public = #{connection.quoted_true}"
|
|
| 218 |
# The subquery is not needed when project_ids_by_role is empty: the |
|
| 219 |
# user and the builtin group have no memberships, so it would return |
|
| 220 |
# nothing |
|
| 221 |
if user.id.nil? || user.project_ids_by_role.empty? |
|
| 222 |
s = public_project_condition |
|
| 223 |
else |
|
| 219 | 224 |
group = role.anonymous? ? Group.anonymous : Group.non_member |
| 220 | 225 |
principal_ids = [user.id, group.id].compact |
| 221 | 226 |
s = |
| 222 |
"(#{s} AND #{Project.table_name}.id NOT IN " \
|
|
| 227 |
"(#{public_project_condition} AND #{Project.table_name}.id NOT IN " \
|
|
| 223 | 228 |
"(SELECT project_id FROM #{Member.table_name} " \
|
| 224 | 229 |
"WHERE user_id IN (#{principal_ids.join(',')})))"
|
| 225 | 230 |
end |
| test/unit/project_test.rb | ||
|---|---|---|
| 1091 | 1091 |
end |
| 1092 | 1092 |
end |
| 1093 | 1093 | |
| 1094 |
def test_allowed_to_condition_should_not_query_members_for_user_without_memberships |
|
| 1095 |
condition = Project.allowed_to_condition(User.anonymous, :view_issues) |
|
| 1096 | ||
| 1097 |
assert_not_includes condition, Member.table_name |
|
| 1098 |
end |
|
| 1099 | ||
| 1094 | 1100 |
def test_safe_attributes_should_include_only_custom_fields_visible_to_user |
| 1095 | 1101 |
cf1 = ProjectCustomField.create!(:name => 'Visible field', |
| 1096 | 1102 |
:field_format => 'string', |