私有项目非项目成员不能通过url访问关注列表

2015-05-19 14:02:14 +08:00 · 2015-05-19 14:02:14 +08:00 · b19f61edcb
parent 5cb9cc0903
commit b19f61edcb
1 changed files with 4 additions and 4 deletions
--- a/app/controllers/projects_controller.rb
+++ b/app/controllers/projects_controller.rb
@ -676,11 +676,11 @@ class ProjectsController < ApplicationController
    true
  end

-  # added by huang
-
  def watcherlist
-    if @watched
-       @users -= watched.watcher_users
+    if !@project.is_public? && !User.current.member_of?(@project)
+      render_403
+    else
+      @users -= watched.watcher_users if  @watched
    end
  end