dice/impress
1
0
Fork 0
forked from OpenNeo/impress
Code Pull requests Activity

privacy bug: would show hangers even in private lists as Trading if unlisted hangers were marked Trading

Browse source
This commit is contained in:
Emi Matchu 2011-08-06 23:15:32 -04:00
parent 4c510f91db
commit 4e74589118
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
app/models/closet_hanger.rb
View file

@ -20,7 +20,9 @@ class ClosetHanger < ActiveRecord::Base
scope "#{name}_trading", joins(:user).includes(:list).
where(:owned => owned).
where((
User.arel_table["#{name}_closet_hangers_visibility"].gteq(ClosetVisibility[:trading].id)
arel_table[:list_id].eq(nil).and(
User.arel_table["#{name}_closet_hangers_visibility"].gteq(ClosetVisibility[:trading].id)
)
).or(
ClosetList.arel_table[:visibility].gteq(ClosetVisibility[:trading].id)
))