diff --git a/app/models/user.rb b/app/models/user.rb index 4b65b3d..45ab4b4 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -368,8 +368,10 @@ class User < Principal elsif project && project.is_a?(Array) # Authorize if user is authorized on every element of the array - project.inject do |memo,p| - memo && allowed_to?(action,p,options) + project.map do |p| + allowed_to?(action,p,options) + end.inject do |memo,p| + memo && p end elsif options[:global] # Admin users are always authorized diff --git a/test/unit/user_test.rb b/test/unit/user_test.rb index b451c1e..3f824f9 100644 --- a/test/unit/user_test.rb +++ b/test/unit/user_test.rb @@ -408,6 +408,10 @@ class UserTest < ActiveSupport::TestCase assert @jsmith.allowed_to?(:edit_issues, @jsmith.projects) #Manager or Developer everywhere assert ! @jsmith.allowed_to?(:delete_issue_watchers, @jsmith.projects) #Dev cannot delete_issue_watchers end + + should "behave correctly with arrays of 1 project" do + assert ! User.anonymous.allowed_to?(:delete_issues, [Project.first]) + end end context "with options[:global]" do