diff --git a/app/controllers/account_controller.rb b/app/controllers/account_controller.rb index 38bd4bfe5..f2a553c38 100644 --- a/app/controllers/account_controller.rb +++ b/app/controllers/account_controller.rb @@ -25,7 +25,7 @@ class AccountController < ApplicationController if @account.organization? params.require(:account).permit(:phone_number, :email_on_comment, :email_on_comment_reply, organization_attributes: [:name, :responsible_name]) else - params.require(:account).permit(:username, :email_on_comment, :email_on_comment_reply) + params.require(:account).permit(:username, :public_activity, :email_on_comment, :email_on_comment_reply) end end diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index 38c36b7cc..a978cd1ce 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -3,10 +3,8 @@ class UsersController < ApplicationController load_and_authorize_resource - before_action :set_activity_counts, only: :show - def show - load_filtered_activity + load_filtered_activity if valid_access? end private @@ -18,6 +16,7 @@ class UsersController < ApplicationController end def load_filtered_activity + set_activity_counts case params[:filter] when "proposals" then load_proposals when "debates" then load_debates @@ -51,4 +50,11 @@ class UsersController < ApplicationController @comments = Comment.where(user_id: @user.id).includes(:commentable).order(created_at: :desc).page(params[:page]) end + def valid_access? + @user.public_activity || authorized_current_user? + end + + def authorized_current_user? + @authorized_current_user ||= current_user && (current_user == @user || current_user.moderator? || current_user.administrator?) + end end diff --git a/app/views/devise/menu/_login_items.html.erb b/app/views/devise/menu/_login_items.html.erb index 6cd27160d..b0998949f 100644 --- a/app/views/devise/menu/_login_items.html.erb +++ b/app/views/devise/menu/_login_items.html.erb @@ -1,5 +1,8 @@