vikunja
/
vikunja
6
43
Fork 72
Code Issues 150 Pull Requests 19 Packages Releases 32 Activity

Fixed a bug where a user could see every namespace

This commit is contained in:
konrad 2018-09-06 08:39:05 +02:00 committed by kolaente
parent f2758e239c
commit 92174aac08
Signed by: konrad
GPG Key ID: F40E70337AB24C9B
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
models/namespace_rights.go
View File

@ -67,8 +67,9 @@ func (n *Namespace) checkTeamRights(user *User, r TeamRight) bool {
Table("namespaces").
Join("LEFT", "team_namespaces", "namespaces.id = team_namespaces.namespace_id").
Join("LEFT", "team_members", "team_members.team_id = team_namespaces.team_id").
Where("team_members.user_id = ? AND team_namespaces.right = ?", user.ID, r).
Or("namespaces.owner_id = ?", user.ID).
Where("namespaces.id = ? " +
"AND ((team_members.user_id = ? AND team_namespaces.right = ?) " +
"OR namespaces.owner_id = ?)", n.ID, user.ID, r, user.ID).
Get(&Namespace{})
if err != nil {