From c1cc4777caad078e3eff9ba6170beb7ee7254917 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20D=C3=A1vila?= Date: Tue, 12 Jun 2018 10:02:06 -0500 Subject: Hide events from internal projects in public feed for anonymous users This change fixes a bug where an anonymous user was able to see the activity related to internal projects when visiting the public profile of a user of the GitLab instance. --- app/finders/user_recent_events_finder.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'app/finders') diff --git a/app/finders/user_recent_events_finder.rb b/app/finders/user_recent_events_finder.rb index 65d6e019746..74776b2ed1f 100644 --- a/app/finders/user_recent_events_finder.rb +++ b/app/finders/user_recent_events_finder.rb @@ -56,7 +56,7 @@ class UserRecentEventsFinder visible = target_user .project_interactions - .where(visibility_level: [Gitlab::VisibilityLevel::INTERNAL, Gitlab::VisibilityLevel::PUBLIC]) + .where(visibility_level: Gitlab::VisibilityLevel.levels_for_user(current_user)) .select(:id) Gitlab::SQL::Union.new([authorized, visible]).to_sql -- cgit v1.2.1