Login user should not see private projects that they do not belong to…

… #RB-585
rwth-acis · Oct 13, 2017 · 920c996 · 920c996
1 parent 788d014
commit 920c996
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/src/main/de/rwth/dbis/acis/bazaar/service/dal/repositories/ProjectRepositoryImpl.java b/src/main/de/rwth/dbis/acis/bazaar/service/dal/repositories/ProjectRepositoryImpl.java
@@ -248,7 +248,8 @@ public PaginationResult<Project> findAllPublicAndAuthorized(PageInfo pageable, i
 //                    .leftOuterJoin(AUTHORIZATIONS).on(AUTHORIZATIONS.PROJECT_ID.equal(PROJECTS.ID))
 //                    .join(USERS).on(AUTHORIZATIONS.USER_ID.equal(USERS.ID))
 //                    .where(PROJECTS.VISIBILITY.eq(Project.ProjectVisibility.PUBLIC.asChar())
-                    .where(transformer.getSearchCondition(pageable.getSearch()))
+                    .where(PROJECT.VISIBILITY.isTrue().or(leaderUser.ID.equal(userId))
+                            .and(transformer.getSearchCondition(pageable.getSearch())))
                     .orderBy(transformer.getSortFields(pageable.getSorts()))
                     .limit(pageable.getPageSize())
                     .offset(pageable.getOffset())