Project

General

Profile

« Previous | Next » 

Revision caa5fcf0

Added by Greg Sutcliffe about 12 years ago

  • ID caa5fcf0b6aabc8d69ceda82bf60cad060f8221d

Fix privacy leaks in stats, facts, and dashboard - fixes #1582

View differences:

app/controllers/fact_values_controller.rb
def index
begin
values = FactValue.no_timestamp_facts.search_for(params[:search],:order => params[:order])
# restrict allowed facts list based on the user permissions
my_facts = User.current.admin? ? FactValue : FactValue.my_facts
values = my_facts.no_timestamp_facts.search_for(params[:search],:order => params[:order])
rescue => e
error e.to_s
values = FactValue.no_timestamp_facts.search_for ""

Also available in: Unified diff