Redmine

+1

The following code allows users to see group members according to "Users visibility" setting (#11724) of their role.

diff --git a/app/controllers/groups_controller.rb b/app/controllers/groups_controller.rb
index fb21e2f05..68fa826c9 100644
--- a/app/controllers/groups_controller.rb
+++ b/app/controllers/groups_controller.rb
@@ -21,7 +21,7 @@ class GroupsController < ApplicationController
   layout 'admin'
   self.main_menu = false

-  before_action :require_admin
+  before_action :require_admin, :except => [:show]
   before_action :find_group, :except => [:index, :new, :create]
   accept_api_auth :index, :show, :create, :update, :destroy, :add_users, :remove_user

@@ -50,6 +50,8 @@ class GroupsController < ApplicationController
   end

   def show
+    return render_404 unless @group.visible?
+
     respond_to do |format|
       format.html
       format.api

Go MAEDA wrote:

Committed the patch.

Non-admin users can see group members by clicking a group name on the project overview page.

Also, the assignee field now shows a link to the group page if the assignee is a group (r21075).