fix #751

routers/user/home.go

@@ -198,6 +198,15 @@ func Profile(ctx *middleware.Context) {
 		}
 		feeds := make([]*models.Action, 0, len(actions))
 		for _, act := range actions {
+			if act.IsPrivate {
+				if !ctx.IsSigned {
+					continue
+				}
+				if has, _ := models.HasAccess(ctx.User.Name, act.RepoUserName+"/"+act.RepoName,
+					models.READABLE); !has {
+					continue
+				}
+			}
 			// FIXME: cache results?
 			u, err := models.GetUserByName(act.ActUserName)
 			if err != nil {