ensure users have permission to view cards

dradis · Sep 23, 2024 · 6425e54 · 6425e54
1 parent 18e2d53
commit 6425e54
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/app/helpers/tasks_helper.rb b/app/helpers/tasks_helper.rb
@@ -9,7 +9,8 @@ def assigned_cards(project_id = nil)
       if project_id
         cards.select { |card| card.project.id == current_project.id }
       else
-        cards
+        valid_project_ids = Project.kept.current.accessible_by(current_ability).ids
+        cards.select { |card| card.project.id.in? valid_project_ids }
       end
     end
   end