#108 new
Mike Dvorkin

Activity.latest still allows users to view all tasks of other users

Reported by Mike Dvorkin | October 4th, 2009 @ 09:27 PM | in Feature Requests

From alexp: Just a quick thought, tasks are still displayed as recent activity in the dashboard for all users regardless of who they are assigned to, would it make sense to keep tasks private (left sidebar panel works Activity.for is correct - only finds the current users items) e.g for a new user the dashboard should be empty, but Activity.latest finds all of the other users tasks even though they are assigned to another user.

get_activities in home_controller calls the named scope Activity.latest for the index page of the dashboard, Activity.latest could be modified:

named_scope :latest, lambda { |options|  {
  :conditions => [ "#{options[:asset] ? "subject_type = ?" : "0=?"}
    AND user_id = ? AND activities.created_at >= ?", options[:asset] || 0,
    options[:user] || @current_user, Time.now, options[:duration] || 2.days) ],
  :include => :user,
  :order => "activities.created_at DESC"
} }

It still works in assigning tasks to other users and I cant see any immediate knock on effects, Michael, maybe you had some reason for the original logic, but this allows tasks to be viewed only by the setter and the associated user.

Comments and changes to this ticket

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.

New-ticket Create new ticket

Create your profile

Help contribute to this project by taking a few moments to create your personal profile. Create your profile ยป

Ruby on Rails CRM platform for Web 2.0 and beyond

People watching this ticket