fix: some bug from security

2026-05-20 11:45:57 +08:00 · 2021-06-22 15:54:42 +08:00
parent 526920f564
commit 4126ea7b4e
5 changed files with 17 additions and 2 deletions
--- a/app/models/concerns/project_operable.rb
+++ b/app/models/concerns/project_operable.rb
@@ -94,7 +94,7 @@ module ProjectOperable
  end

  def operator?(user)
-    user.admin? || !reporter?(user) 
+    user.admin? || (member?(user.id) && !reporter?(user))
  end

  def set_developer_role(member, role_name)