search: fix searches for private favgroups raising privilege errors.
Change favgroup:<name> searches to return no results instead of raising a UserPrivilege error when an unpermitted user searches for a private favgroup. Partial fix for #4389.
This commit is contained in:
@@ -89,14 +89,18 @@ class FavoriteGroup < ApplicationRecord
|
||||
self.name = FavoriteGroup.normalize_name(name)
|
||||
end
|
||||
|
||||
def self.find_by_name_or_id(name, user)
|
||||
def self.name_or_id_matches(name, user)
|
||||
if name =~ /\A\d+\z/
|
||||
find_by(id: name)
|
||||
where(id: name)
|
||||
else
|
||||
user.favorite_groups.where_iequals(:name, normalize_name(name)).first
|
||||
where(creator: user).where_iequals(:name, normalize_name(name))
|
||||
end
|
||||
end
|
||||
|
||||
def self.find_by_name_or_id(name, user)
|
||||
name_or_id_matches(name, user).first
|
||||
end
|
||||
|
||||
def self.find_by_name_or_id!(name, user)
|
||||
find_by_name_or_id(name, user) or raise ActiveRecord::RecordNotFound
|
||||
end
|
||||
|
||||
Reference in New Issue
Block a user