Skip to content

Perform and cache journal visibility check in RequestStore - #24591

Open
oliverguenther wants to merge 1 commit into
devfrom
fix/visibility-association-journal
Open

Perform and cache journal visibility check in RequestStore#24591
oliverguenther wants to merge 1 commit into
devfrom
fix/visibility-association-journal

Conversation

@oliverguenther

Copy link
Copy Markdown
Member

JournalFormatter::NamedAssociation resolved every association with a bare find_by and printed its name, so a journal could name a record from a project the reader has no access to.

We replace these checks with a visible? check by default IF the association responds to it.

These checks add more computational time, so we cache them in RequestStore.

Ticket

https://community.openproject.org/work_packages/OP-19853

JournalFormatter::NamedAssociation resolved every association with a
bare find_by and printed its name, so a journal could name a record
from a project the reader has no access to.

We replace these checks with a visible? check by default
IF the association responds to it.

These checks add more computational time, so we cache them in RequestStore.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Development

Successfully merging this pull request may close these issues.

1 participant