##// END OF EJS Templates
Fixed that journal details about issue relations may disclose issues that are not visible (#1005)....
Jean-Philippe Lang -
r11709:019f57e5c71e
parent child
Show More
@@ -308,11 +308,11 module IssuesHelper
308 label = l(:label_attachment)
308 label = l(:label_attachment)
309 when 'relation'
309 when 'relation'
310 if detail.value && !detail.old_value
310 if detail.value && !detail.old_value
311 rel_issue = Issue.find_by_id(detail.value)
311 rel_issue = Issue.visible.find_by_id(detail.value)
312 value = rel_issue.nil? ? "#{l(:label_issue)} #{detail.value}" :
312 value = rel_issue.nil? ? "#{l(:label_issue)} #{detail.value}" :
313 (no_html ? rel_issue : link_to_issue(rel_issue))
313 (no_html ? rel_issue : link_to_issue(rel_issue))
314 elsif detail.old_value && !detail.value
314 elsif detail.old_value && !detail.value
315 rel_issue = Issue.find_by_id(detail.old_value)
315 rel_issue = Issue.visible.find_by_id(detail.old_value)
316 old_value = rel_issue.nil? ? "#{l(:label_issue)} #{detail.old_value}" :
316 old_value = rel_issue.nil? ? "#{l(:label_issue)} #{detail.old_value}" :
317 (no_html ? rel_issue : link_to_issue(rel_issue))
317 (no_html ? rel_issue : link_to_issue(rel_issue))
318 end
318 end
@@ -227,6 +227,16 class IssuesHelperTest < ActionView::TestCase
227 assert_equal "<strong>Precedes</strong> <i>Issue #{non_existed_issue_number}</i> added", show_detail(detail, false)
227 assert_equal "<strong>Precedes</strong> <i>Issue #{non_existed_issue_number}</i> added", show_detail(detail, false)
228 end
228 end
229
229
230 def test_show_detail_relation_added_should_not_disclose_issue_that_is_not_visible
231 issue = Issue.generate!(:is_private => true)
232 detail = JournalDetail.new(:property => 'relation',
233 :prop_key => 'label_precedes',
234 :value => issue.id)
235
236 assert_equal "Precedes Issue #{issue.id} added", show_detail(detail, true)
237 assert_equal "<strong>Precedes</strong> <i>Issue #{issue.id}</i> added", show_detail(detail, false)
238 end
239
230 def test_show_detail_delete_relation
240 def test_show_detail_delete_relation
231 detail = JournalDetail.new(:property => 'relation',
241 detail = JournalDetail.new(:property => 'relation',
232 :prop_key => 'label_precedes',
242 :prop_key => 'label_precedes',
@@ -242,4 +252,14 class IssuesHelperTest < ActionView::TestCase
242 assert_equal "Precedes deleted (Issue 9999)", show_detail(detail, true)
252 assert_equal "Precedes deleted (Issue 9999)", show_detail(detail, true)
243 assert_equal "<strong>Precedes</strong> deleted (<i>Issue 9999</i>)", show_detail(detail, false)
253 assert_equal "<strong>Precedes</strong> deleted (<i>Issue 9999</i>)", show_detail(detail, false)
244 end
254 end
255
256 def test_show_detail_relation_deleted_should_not_disclose_issue_that_is_not_visible
257 issue = Issue.generate!(:is_private => true)
258 detail = JournalDetail.new(:property => 'relation',
259 :prop_key => 'label_precedes',
260 :old_value => issue.id)
261
262 assert_equal "Precedes deleted (Issue #{issue.id})", show_detail(detail, true)
263 assert_equal "<strong>Precedes</strong> deleted (<i>Issue #{issue.id}</i>)", show_detail(detail, false)
264 end
245 end
265 end
General Comments 0
You need to be logged in to leave comments. Login now