search: fix searches for private favgroups raising privilege errors.

Change favgroup:<name> searches to return no results instead of raising
a UserPrivilege error when an unpermitted user searches for a private
favgroup.

Partial fix for #4389.
This commit is contained in:
evazion
2020-04-16 18:55:53 -05:00
parent 3aa80c8dc4
commit f8d420d6c0
4 changed files with 46 additions and 23 deletions

View File

@@ -89,14 +89,18 @@ class FavoriteGroup < ApplicationRecord
self.name = FavoriteGroup.normalize_name(name)
end
def self.find_by_name_or_id(name, user)
def self.name_or_id_matches(name, user)
if name =~ /\A\d+\z/
find_by(id: name)
where(id: name)
else
user.favorite_groups.where_iequals(:name, normalize_name(name)).first
where(creator: user).where_iequals(:name, normalize_name(name))
end
end
def self.find_by_name_or_id(name, user)
name_or_id_matches(name, user).first
end
def self.find_by_name_or_id!(name, user)
find_by_name_or_id(name, user) or raise ActiveRecord::RecordNotFound
end