私有项目非项目成员不能通过url访问关注列表

app/controllers/projects_controller.rb

@@ -676,11 +676,11 @@ class ProjectsController < ApplicationController
     true
   end
 
-  # added by huang
-
   def watcherlist
-    if @watched
-       @users -= watched.watcher_users
+    if !@project.is_public? && !User.current.member_of?(@project)
+      render_403
+    else
+      @users -= watched.watcher_users if  @watched
     end
   end