diff --git a/app/controllers/org_document_comments_controller.rb b/app/controllers/org_document_comments_controller.rb index 5b02a4e9b..82a25cb01 100644 --- a/app/controllers/org_document_comments_controller.rb +++ b/app/controllers/org_document_comments_controller.rb @@ -24,7 +24,11 @@ class OrgDocumentCommentsController < ApplicationController end def index - @documents = @organization.org_document_comments.where("parent_id is null").order("created_at desc") + if @organization.is_public? || User.current.admin? || User.current.member_of_org?(@organization) + @documents = @organization.org_document_comments.where("parent_id is null").order("created_at desc") + else + render_403 + end end def update @org_document = OrgDocumentComment.find(params[:id]) diff --git a/app/controllers/organizations_controller.rb b/app/controllers/organizations_controller.rb index 3713beb22..0d22ab461 100644 --- a/app/controllers/organizations_controller.rb +++ b/app/controllers/organizations_controller.rb @@ -151,7 +151,11 @@ class OrganizationsController < ApplicationController end def members - @members = OrgMember.where("organization_id =?", @organization.id) + if @organization.is_public? || User.current.admin? || User.current.member_of_org?(@organization) + @members = OrgMember.where("organization_id =?", @organization.id) + else + render_403 + end end def more_org_projects diff --git a/app/views/org_document_comments/edit.html.erb b/app/views/org_document_comments/edit.html.erb index e0224afea..4b50c1064 100644 --- a/app/views/org_document_comments/edit.html.erb +++ b/app/views/org_document_comments/edit.html.erb @@ -26,7 +26,7 @@