diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index a461903a9..e498ace44 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -2780,7 +2780,8 @@ class UsersController < ApplicationController # 导入资源 def import_resources # 别人的资源库是没有权限去看的 - if User.current.id.to_i != params[:id].to_i + user = User.find_by_login(params[:id]) + if User.current != user render_403 return end diff --git a/app/views/repositories/show.html.erb b/app/views/repositories/show.html.erb index 6fed85acf..276283e97 100644 --- a/app/views/repositories/show.html.erb +++ b/app/views/repositories/show.html.erb @@ -1,7 +1,7 @@ <%= call_hook(:view_repositories_show_contextual, {:repository => @repository, :project => @project}) %>