Enforce restrictions on issue visibility properly

2020-03-01 19:08:40 +00:00 · 2020-03-01 19:08:40 +00:00 · 06122fc090
commit 06122fc090
parent 75d1893343
3 changed files with 131 additions and 23 deletions
--- a/app/controllers/issues_controller.rb
+++ b/app/controllers/issues_controller.rb
@ -80,6 +80,8 @@ class IssuesController < ApplicationController
  private

  def find_issue
-    @issue = Issue.find(params[:id])
+    @issue = Issue.visible_to(current_user).find(params[:id])
+  rescue ActiveRecord::RecordNotFound
+    head :not_found
  end
 end