##// END OF EJS Templates
Fixed: users should not be able to add relations with issues they're not allowed to view (#2589)....
Jean-Philippe Lang -
r2321:10994e902779
parent child
Show More
@@ -21,6 +21,9 class IssueRelationsController < ApplicationController
21 def new
21 def new
22 @relation = IssueRelation.new(params[:relation])
22 @relation = IssueRelation.new(params[:relation])
23 @relation.issue_from = @issue
23 @relation.issue_from = @issue
24 if params[:relation] && !params[:relation][:issue_to_id].blank?
25 @relation.issue_to = Issue.visible.find_by_id(params[:relation][:issue_to_id])
26 end
24 @relation.save if request.post?
27 @relation.save if request.post?
25 respond_to do |format|
28 respond_to do |format|
26 format.html { redirect_to :controller => 'issues', :action => 'show', :id => @issue }
29 format.html { redirect_to :controller => 'issues', :action => 'show', :id => @issue }
@@ -35,6 +35,8 class IssueRelation < ActiveRecord::Base
35 validates_numericality_of :delay, :allow_nil => true
35 validates_numericality_of :delay, :allow_nil => true
36 validates_uniqueness_of :issue_to_id, :scope => :issue_from_id
36 validates_uniqueness_of :issue_to_id, :scope => :issue_from_id
37
37
38 attr_protected :issue_from_id, :issue_to_id
39
38 def validate
40 def validate
39 if issue_from && issue_to
41 if issue_from && issue_to
40 errors.add :issue_to_id, :activerecord_error_invalid if issue_from_id == issue_to_id
42 errors.add :issue_to_id, :activerecord_error_invalid if issue_from_id == issue_to_id
@@ -6,6 +6,23 class IssueRelationsController; def rescue_action(e) raise e end; end
6
6
7
7
8 class IssueRelationsControllerTest < Test::Unit::TestCase
8 class IssueRelationsControllerTest < Test::Unit::TestCase
9 fixtures :projects,
10 :users,
11 :roles,
12 :members,
13 :issues,
14 :issue_statuses,
15 :enabled_modules,
16 :enumerations,
17 :trackers
18
19 def setup
20 @controller = IssueRelationsController.new
21 @request = ActionController::TestRequest.new
22 @response = ActionController::TestResponse.new
23 User.current = nil
24 end
25
9 def test_new_routing
26 def test_new_routing
10 assert_routing(
27 assert_routing(
11 {:method => :post, :path => '/issues/1/relations'},
28 {:method => :post, :path => '/issues/1/relations'},
@@ -19,4 +36,23 class IssueRelationsControllerTest < Test::Unit::TestCase
19 {:method => :post, :path => '/issues/1/relations/23/destroy'}
36 {:method => :post, :path => '/issues/1/relations/23/destroy'}
20 )
37 )
21 end
38 end
39
40 def test_new
41 assert_difference 'IssueRelation.count' do
42 @request.session[:user_id] = 3
43 post :new, :issue_id => 1,
44 :relation => {:issue_to_id => '2', :relation_type => 'relates', :delay => ''}
45 end
46 end
47
48 def test_should_create_relations_with_visible_issues_only
49 Setting.cross_project_issue_relations = '1'
50 assert_nil Issue.visible(User.find(3)).find_by_id(4)
51
52 assert_no_difference 'IssueRelation.count' do
53 @request.session[:user_id] = 3
54 post :new, :issue_id => 1,
55 :relation => {:issue_to_id => '4', :relation_type => 'relates', :delay => ''}
56 end
57 end
22 end
58 end
General Comments 0
You need to be logged in to leave comments. Login now