Fixed: private queries should not be accessible to other users (#8729).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@6163 e93f8b46-1217-0410-a6f0-8f06a7374b81
2011-07-03 11:01:08 +00:00
parent aede35d226
commit 8914d323ee
4 changed files with 33 additions and 3 deletions
@@ -165,6 +165,11 @@ class Query < ActiveRecord::Base
          ["o", "c", "!*", "*", "t", "w"].include? operator_for(field)
    end if filters
  end
+  
+  # Returns true if the query is visible to +user+ or the current user.
+  def visible?(user=User.current)
+    self.is_public? || self.user_id == user.id
+  end

  def editable_by?(user)
    return false unless user