Do not show user profile if no visible project or activity (#4129, #3720).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@2986 e93f8b46-1217-0410-a6f0-8f06a7374b81

Do not show user profile if no visible project or activity (#4129, #3720).
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@2986 e93f8b46-1217-0410-a6f0-8f06a7374b81
ac56d1d5 · Jean-Philippe Lang · 72d208cb · ac56d1d5 · ac56d1d5
Commit ac56d1d5 authored Oct 29, 2009 by Jean-Philippe Lang
Hide whitespace changes
Inline Side-by-side

Showing with 9 additions and 0 deletions

account_controller.rb app/controllers/account_controller.rb +4 -0

account_controller_test.rb test/functional/account_controller_test.rb +5 -0

No files found.
--- a/app/controllers/account_controller.rb
+++ b/app/controllers/account_controller.rb
@@ -35,6 +35,10 @@ class AccountController < ApplicationController
    events = Redmine::Activity::Fetcher.new(User.current, :author => @user).events(nil, nil, :limit => 10)
    @events_by_day = events.group_by(&:event_date)
    
+    if @user != User.current && !User.current.admin? && @memberships.empty? && events.empty?
+      render_404 and return
+    end
+    
  rescue ActiveRecord::RecordNotFound
    render_404
  end

--- a/test/functional/account_controller_test.rb
+++ b/test/functional/account_controller_test.rb
@@ -56,6 +56,11 @@ class AccountControllerTest < ActionController::TestCase
    assert_nil assigns(:user)
  end
  
+  def test_show_should_not_reveal_users_with_no_visible_activity_or_project
+    get :show, :id => 9
+    assert_response 404
+  end
+  
  def test_login_should_redirect_to_back_url_param
    # request.uri is "test.host" in test environment
    post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http%3A%2F%2Ftest.host%2Fissues%2Fshow%2F1'