jro_apps/redmine Commit - r2321:10994e902779

Fixed: users should not be able to add relations with issues they're not allowed to view (#2589)....

Jean-Philippe Lang -

r2321:10994e902779

parent child

Context file:

r2321:10994e902779

Collapse all files

app/controllers/issue_relations_controller.rb +3 0

              # redMine - project management software
              # Copyright (C) 2006-2007  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              class IssueRelationsController < ApplicationController
                before_filter :find_project, :authorize
                def new
                  @relation = IssueRelation.new(params[:relation])
                  @relation.issue_from = @issue
+                 if params[:relation] && !params[:relation][:issue_to_id].blank?
+                   @relation.issue_to = Issue.visible.find_by_id(params[:relation][:issue_to_id])
+                 end
                  @relation.save if request.post?
                  respond_to do |format|
                    format.html { redirect_to :controller => 'issues', :action => 'show', :id => @issue }
                    format.js do
                      render :update do |page|
                        page.replace_html "relations", :partial => 'issues/relations'
                        if @relation.errors.empty?
                          page << "$('relation_delay').value = ''"
                          page << "$('relation_issue_to_id').value = ''"
                        end
                      end
                    end
                  end
                end
                def destroy
                  relation = IssueRelation.find(params[:id])
                  if request.post? && @issue.relations.include?(relation)
                    relation.destroy
                    @issue.reload
                  end
                  respond_to do |format|
                    format.html { redirect_to :controller => 'issues', :action => 'show', :id => @issue }
                    format.js { render(:update) {|page| page.replace_html "relations", :partial => 'issues/relations'} }
                  end
                end
              private
                def find_project
                  @issue = Issue.find(params[:issue_id])
                  @project = @issue.project
                rescue ActiveRecord::RecordNotFound
                  render_404
                end
              end

app/models/issue_relation.rb +2 0

              # redMine - project management software
              # Copyright (C) 2006-2007  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              class IssueRelation < ActiveRecord::Base
                belongs_to :issue_from, :class_name => 'Issue', :foreign_key => 'issue_from_id'
                belongs_to :issue_to, :class_name => 'Issue', :foreign_key => 'issue_to_id'
                TYPE_RELATES      = "relates"
                TYPE_DUPLICATES   = "duplicates"
                TYPE_BLOCKS       = "blocks"
                TYPE_PRECEDES     = "precedes"
                TYPES = { TYPE_RELATES =>     { :name => :label_relates_to, :sym_name => :label_relates_to, :order => 1 },
                          TYPE_DUPLICATES =>  { :name => :label_duplicates, :sym_name => :label_duplicated_by, :order => 2 },
                          TYPE_BLOCKS =>      { :name => :label_blocks, :sym_name => :label_blocked_by, :order => 3 },
                          TYPE_PRECEDES =>    { :name => :label_precedes, :sym_name => :label_follows, :order => 4 },
                        }.freeze
                validates_presence_of :issue_from, :issue_to, :relation_type
                validates_inclusion_of :relation_type, :in => TYPES.keys
                validates_numericality_of :delay, :allow_nil => true
                validates_uniqueness_of :issue_to_id, :scope => :issue_from_id
+               attr_protected :issue_from_id, :issue_to_id
                def validate
                  if issue_from && issue_to
                    errors.add :issue_to_id, :activerecord_error_invalid if issue_from_id == issue_to_id
                    errors.add :issue_to_id, :activerecord_error_not_same_project unless issue_from.project_id == issue_to.project_id || Setting.cross_project_issue_relations?
                    errors.add_to_base :activerecord_error_circular_dependency if issue_to.all_dependent_issues.include? issue_from
                  end
                end
                def other_issue(issue)
                  (self.issue_from_id == issue.id) ? issue_to : issue_from
                end
                def label_for(issue)
                  TYPES[relation_type] ? TYPES[relation_type][(self.issue_from_id == issue.id) ? :name : :sym_name] : :unknow
                end
                def before_save
                  if TYPE_PRECEDES == relation_type
                    self.delay ||= 0
                  else
                    self.delay = nil
                  end
                  set_issue_to_dates
                end
                def set_issue_to_dates
                  soonest_start = self.successor_soonest_start
                  if soonest_start && (!issue_to.start_date || issue_to.start_date < soonest_start)
                    issue_to.start_date, issue_to.due_date = successor_soonest_start, successor_soonest_start + issue_to.duration
                    issue_to.save
                  end
                end
                def successor_soonest_start
                  return nil unless (TYPE_PRECEDES == self.relation_type) && (issue_from.start_date || issue_from.due_date)
                  (issue_from.due_date || issue_from.start_date) + 1 + delay
                end
                def <=>(relation)
                  TYPES[self.relation_type][:order] <=> TYPES[relation.relation_type][:order]
                end
              end

test/functional/issue_relations_controller_test.rb +36 0

              require File.dirname(__FILE__) + '/../test_helper'
              require 'issue_relations_controller'
              # Re-raise errors caught by the controller.
              class IssueRelationsController; def rescue_action(e) raise e end; end
              class IssueRelationsControllerTest < Test::Unit::TestCase
+               fixtures :projects,
+                        :users,
+                        :roles,
+                        :members,
+                        :issues,
+                        :issue_statuses,
+                        :enabled_modules,
+                        :enumerations,
+                        :trackers
+               def setup
+                 @controller = IssueRelationsController.new
+                 @request    = ActionController::TestRequest.new
+                 @response   = ActionController::TestResponse.new
+                 User.current = nil
+               end
                def test_new_routing
                  assert_routing(
                    {:method => :post, :path => '/issues/1/relations'},
                    {:controller => 'issue_relations', :action => 'new', :issue_id => '1'}
                  )
                end
                def test_destroy_routing
                  assert_recognizes( #TODO: use DELETE on issue URI
                    {:controller => 'issue_relations', :action => 'destroy', :issue_id => '1', :id => '23'},
                    {:method => :post, :path => '/issues/1/relations/23/destroy'}
                  )
                end
+               def test_new
+                 assert_difference 'IssueRelation.count' do
+                   @request.session[:user_id] = 3
+                   post :new, :issue_id => 1,
+                              :relation => {:issue_to_id => '2', :relation_type => 'relates', :delay => ''}
+                 end
+               end
+               def test_should_create_relations_with_visible_issues_only
+                 Setting.cross_project_issue_relations = '1'
+                 assert_nil Issue.visible(User.find(3)).find_by_id(4)
+                 assert_no_difference 'IssueRelation.count' do
+                   @request.session[:user_id] = 3
+                   post :new, :issue_id => 1,
+                              :relation => {:issue_to_id => '4', :relation_type => 'relates', :delay => ''}
+                 end
+               end
              end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages