jro_apps/redmine Commit - r2321:10994e902779

Fixed: users should not be able to add relations with issues they're not allowed to view (#2589)....

Jean-Philippe Lang -

r2321:10994e902779

parent child

Context file:

r2321:10994e902779

Collapse all files

app/controllers/issue_relations_controller.rb +3 0

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class IssueRelationsController < ApplicationController
               before_filter :find_project, :authorize
               def new
                 @relation = IssueRelation.new(params[:relation])
                 @relation.issue_from = @issue
+                if params[:relation] && !params[:relation][:issue_to_id].blank?
+                  @relation.issue_to = Issue.visible.find_by_id(params[:relation][:issue_to_id])
+                end
                 @relation.save if request.post?
                 respond_to do |format|
                   format.html { redirect_to :controller => 'issues', :action => 'show', :id => @issue }
                   format.js do
                     render :update do |page|
                       page.replace_html "relations", :partial => 'issues/relations'
                       if @relation.errors.empty?
                         page << "$('relation_delay').value = ''"
                         page << "$('relation_issue_to_id').value = ''"
                       end
                     end
                   end
                 end
               end
               def destroy
                 relation = IssueRelation.find(params[:id])
                 if request.post? && @issue.relations.include?(relation)
                   relation.destroy
                   @issue.reload
                 end
                 respond_to do |format|
                   format.html { redirect_to :controller => 'issues', :action => 'show', :id => @issue }
                   format.js { render(:update) {|page| page.replace_html "relations", :partial => 'issues/relations'} }
                 end
               end
             private
               def find_project
                 @issue = Issue.find(params[:issue_id])
                 @project = @issue.project
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
             end

app/models/issue_relation.rb +2 0

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class IssueRelation < ActiveRecord::Base
               belongs_to :issue_from, :class_name => 'Issue', :foreign_key => 'issue_from_id'
               belongs_to :issue_to, :class_name => 'Issue', :foreign_key => 'issue_to_id'
               TYPE_RELATES      = "relates"
               TYPE_DUPLICATES   = "duplicates"
               TYPE_BLOCKS       = "blocks"
               TYPE_PRECEDES     = "precedes"
               TYPES = { TYPE_RELATES =>     { :name => :label_relates_to, :sym_name => :label_relates_to, :order => 1 },
                         TYPE_DUPLICATES =>  { :name => :label_duplicates, :sym_name => :label_duplicated_by, :order => 2 },
                         TYPE_BLOCKS =>      { :name => :label_blocks, :sym_name => :label_blocked_by, :order => 3 },
                         TYPE_PRECEDES =>    { :name => :label_precedes, :sym_name => :label_follows, :order => 4 },
                       }.freeze
               validates_presence_of :issue_from, :issue_to, :relation_type
               validates_inclusion_of :relation_type, :in => TYPES.keys
               validates_numericality_of :delay, :allow_nil => true
               validates_uniqueness_of :issue_to_id, :scope => :issue_from_id
+              attr_protected :issue_from_id, :issue_to_id
               def validate
                 if issue_from && issue_to
                   errors.add :issue_to_id, :activerecord_error_invalid if issue_from_id == issue_to_id
                   errors.add :issue_to_id, :activerecord_error_not_same_project unless issue_from.project_id == issue_to.project_id || Setting.cross_project_issue_relations?
                   errors.add_to_base :activerecord_error_circular_dependency if issue_to.all_dependent_issues.include? issue_from
                 end
               end
               def other_issue(issue)
                 (self.issue_from_id == issue.id) ? issue_to : issue_from
               end
               def label_for(issue)
                 TYPES[relation_type] ? TYPES[relation_type][(self.issue_from_id == issue.id) ? :name : :sym_name] : :unknow
               end
               def before_save
                 if TYPE_PRECEDES == relation_type
                   self.delay ||= 0
                 else
                   self.delay = nil
                 end
                 set_issue_to_dates
               end
               def set_issue_to_dates
                 soonest_start = self.successor_soonest_start
                 if soonest_start && (!issue_to.start_date || issue_to.start_date < soonest_start)
                   issue_to.start_date, issue_to.due_date = successor_soonest_start, successor_soonest_start + issue_to.duration
                   issue_to.save
                 end
               end
               def successor_soonest_start
                 return nil unless (TYPE_PRECEDES == self.relation_type) && (issue_from.start_date || issue_from.due_date)
                 (issue_from.due_date || issue_from.start_date) + 1 + delay
               end
               def <=>(relation)
                 TYPES[self.relation_type][:order] <=> TYPES[relation.relation_type][:order]
               end
             end

test/functional/issue_relations_controller_test.rb +36 0

@@ -1,22 +1,58
1	require File.dirname(__FILE__) + '/../test_helper'	1	require File.dirname(__FILE__) + '/../test_helper'
2	require 'issue_relations_controller'	2	require 'issue_relations_controller'
3		3
4	# Re-raise errors caught by the controller.	4	# Re-raise errors caught by the controller.
5	class IssueRelationsController; def rescue_action(e) raise e end; end	5	class IssueRelationsController; def rescue_action(e) raise e end; end
6		6
7		7
8	class IssueRelationsControllerTest < Test::Unit::TestCase	8	class IssueRelationsControllerTest < Test::Unit::TestCase
		9	fixtures :projects,
		10	:users,
		11	:roles,
		12	:members,
		13	:issues,
		14	:issue_statuses,
		15	:enabled_modules,
		16	:enumerations,
		17	:trackers
		18
		19	def setup
		20	@controller = IssueRelationsController.new
		21	@request = ActionController::TestRequest.new
		22	@response = ActionController::TestResponse.new
		23	User.current = nil
		24	end
		25
9	def test_new_routing	26	def test_new_routing
10	assert_routing(	27	assert_routing(
11	{:method => :post, :path => '/issues/1/relations'},	28	{:method => :post, :path => '/issues/1/relations'},
12	{:controller => 'issue_relations', :action => 'new', :issue_id => '1'}	29	{:controller => 'issue_relations', :action => 'new', :issue_id => '1'}
13	)	30	)
14	end	31	end
15		32
16	def test_destroy_routing	33	def test_destroy_routing
17	assert_recognizes( #TODO: use DELETE on issue URI	34	assert_recognizes( #TODO: use DELETE on issue URI
18	{:controller => 'issue_relations', :action => 'destroy', :issue_id => '1', :id => '23'},	35	{:controller => 'issue_relations', :action => 'destroy', :issue_id => '1', :id => '23'},
19	{:method => :post, :path => '/issues/1/relations/23/destroy'}	36	{:method => :post, :path => '/issues/1/relations/23/destroy'}
20	)	37	)
21	end	38	end
		39
		40	def test_new
		41	assert_difference 'IssueRelation.count' do
		42	@request.session[:user_id] = 3
		43	post :new, :issue_id => 1,
		44	:relation => {:issue_to_id => '2', :relation_type => 'relates', :delay => ''}
		45	end
		46	end
		47
		48	def test_should_create_relations_with_visible_issues_only
		49	Setting.cross_project_issue_relations = '1'
		50	assert_nil Issue.visible(User.find(3)).find_by_id(4)
		51
		52	assert_no_difference 'IssueRelation.count' do
		53	@request.session[:user_id] = 3
		54	post :new, :issue_id => 1,
		55	:relation => {:issue_to_id => '4', :relation_type => 'relates', :delay => ''}
		56	end
		57	end
22	end	58	end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages