Redmine

The following patch adapts the find_group behavior in the GroupsController to directly rely on the Principal.visible scope rather than a manual check. The visible behavior should not change at all, the check is just at a more explicit area and thus is a little less likely to be forgotten with future changes.

diff --git a/app/controllers/groups_controller.rb b/app/controllers/groups_controller.rb
index 69dd0d5920..a88c06391e 100644
--- a/app/controllers/groups_controller.rb
+++ b/app/controllers/groups_controller.rb
@@ -50,8 +50,6 @@ def index
   end

   def show
-    return render_404 unless @group.visible?
-
     respond_to do |format|
       format.html do
         render :layout => 'base'
@@ -149,7 +147,7 @@ def autocomplete_for_user
   private

   def find_group
-    @group = Group.find(params[:id])
+    @group = Group.visible.find(params[:id])
   rescue ActiveRecord::RecordNotFound
     render_404
   end