jro_apps/redmine Commit - r9792:18f693f9f7c1

Fixed that 200 API responses have a body containing one space (#11388)....

Jean-Philippe Lang -

r9792:18f693f9f7c1

parent child

Context file:

r9792:18f693f9f7c1

Collapse all files

app/controllers/application_controller.rb +6 0

              # Redmine - project management software
              # Copyright (C) 2006-2012  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              require 'uri'
              require 'cgi'
              class Unauthorized < Exception; end
              class ApplicationController < ActionController::Base
                include Redmine::I18n
                class_attribute :accept_api_auth_actions
                class_attribute :accept_rss_auth_actions
                class_attribute :model_object
                layout 'base'
                protect_from_forgery
                def handle_unverified_request
                  super
                  cookies.delete(:autologin)
                end
                before_filter :session_expiration, :user_setup, :check_if_login_required, :set_localization
                rescue_from ActionController::InvalidAuthenticityToken, :with => :invalid_authenticity_token
                rescue_from ::Unauthorized, :with => :deny_access
                include Redmine::Search::Controller
                include Redmine::MenuManager::MenuController
                helper Redmine::MenuManager::MenuHelper
                def session_expiration
                  if session[:user_id]
                    if session_expired? && !try_to_autologin
                      reset_session
                      flash[:error] = l(:error_session_expired)
                      redirect_to signin_url
                    else
                      session[:atime] = Time.now.utc.to_i
                    end
                  end
                end
                def session_expired?
                  if Setting.session_lifetime?
                    unless session[:ctime] && (Time.now.utc.to_i - session[:ctime].to_i <= Setting.session_lifetime.to_i * 60)
                      return true
                    end
                  end
                  if Setting.session_timeout?
                    unless session[:atime] && (Time.now.utc.to_i - session[:atime].to_i <= Setting.session_timeout.to_i * 60)
                      return true
                    end
                  end
                  false
                end
                def start_user_session(user)
                  session[:user_id] = user.id
                  session[:ctime] = Time.now.utc.to_i
                  session[:atime] = Time.now.utc.to_i
                end
                def user_setup
                  # Check the settings cache for each request
                  Setting.check_cache
                  # Find the current user
                  User.current = find_current_user
                end
                # Returns the current user or nil if no user is logged in
                # and starts a session if needed
                def find_current_user
                  if session[:user_id]
                    # existing session
                    (User.active.find(session[:user_id]) rescue nil)
                  elsif user = try_to_autologin
                    user
                  elsif params[:format] == 'atom' && params[:key] && request.get? && accept_rss_auth?
                    # RSS key authentication does not start a session
                    User.find_by_rss_key(params[:key])
                  elsif Setting.rest_api_enabled? && accept_api_auth?
                    if (key = api_key_from_request)
                      # Use API key
                      User.find_by_api_key(key)
                    else
                      # HTTP Basic, either username/password or API key/random
                      authenticate_with_http_basic do |username, password|
                        User.try_to_login(username, password) || User.find_by_api_key(username)
                      end
                    end
                  end
                end
                def try_to_autologin
                  if cookies[:autologin] && Setting.autologin?
                    # auto-login feature starts a new session
                    user = User.try_to_autologin(cookies[:autologin])
                    if user
                      reset_session
                      start_user_session(user)
                    end
                    user
                  end
                end
                # Sets the logged in user
                def logged_user=(user)
                  reset_session
                  if user && user.is_a?(User)
                    User.current = user
                    start_user_session(user)
                  else
                    User.current = User.anonymous
                  end
                end
                # Logs out current user
                def logout_user
                  if User.current.logged?
                    cookies.delete :autologin
                    Token.delete_all(["user_id = ? AND action = ?", User.current.id, 'autologin'])
                    self.logged_user = nil
                  end
                end
                # check if login is globally required to access the application
                def check_if_login_required
                  # no check needed if user is already logged in
                  return true if User.current.logged?
                  require_login if Setting.login_required?
                end
                def set_localization
                  lang = nil
                  if User.current.logged?
                    lang = find_language(User.current.language)
                  end
                  if lang.nil? && request.env['HTTP_ACCEPT_LANGUAGE']
                    accept_lang = parse_qvalues(request.env['HTTP_ACCEPT_LANGUAGE']).first
                    if !accept_lang.blank?
                      accept_lang = accept_lang.downcase
                      lang = find_language(accept_lang) || find_language(accept_lang.split('-').first)
                    end
                  end
                  lang ||= Setting.default_language
                  set_language_if_valid(lang)
                end
                def require_login
                  if !User.current.logged?
                    # Extract only the basic url parameters on non-GET requests
                    if request.get?
                      url = url_for(params)
                    else
                      url = url_for(:controller => params[:controller], :action => params[:action], :id => params[:id], :project_id => params[:project_id])
                    end
                    respond_to do |format|
                      format.html { redirect_to :controller => "account", :action => "login", :back_url => url }
                      format.atom { redirect_to :controller => "account", :action => "login", :back_url => url }
                      format.xml  { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
                      format.js   { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
                      format.json { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="Redmine API"' }
                    end
                    return false
                  end
                  true
                end
                def require_admin
                  return unless require_login
                  if !User.current.admin?
                    render_403
                    return false
                  end
                  true
                end
                def deny_access
                  User.current.logged? ? render_403 : require_login
                end
                # Authorize the user for the requested action
                def authorize(ctrl = params[:controller], action = params[:action], global = false)
                  allowed = User.current.allowed_to?({:controller => ctrl, :action => action}, @project || @projects, :global => global)
                  if allowed
                    true
                  else
                    if @project && @project.archived?
                      render_403 :message => :notice_not_authorized_archived_project
                    else
                      deny_access
                    end
                  end
                end
                # Authorize the user for the requested action outside a project
                def authorize_global(ctrl = params[:controller], action = params[:action], global = true)
                  authorize(ctrl, action, global)
                end
                # Find project of id params[:id]
                def find_project
                  @project = Project.find(params[:id])
                rescue ActiveRecord::RecordNotFound
                  render_404
                end
                # Find project of id params[:project_id]
                def find_project_by_project_id
                  @project = Project.find(params[:project_id])
                rescue ActiveRecord::RecordNotFound
                  render_404
                end
                # Find a project based on params[:project_id]
                # TODO: some subclasses override this, see about merging their logic
                def find_optional_project
                  @project = Project.find(params[:project_id]) unless params[:project_id].blank?
                  allowed = User.current.allowed_to?({:controller => params[:controller], :action => params[:action]}, @project, :global => true)
                  allowed ? true : deny_access
                rescue ActiveRecord::RecordNotFound
                  render_404
                end
                # Finds and sets @project based on @object.project
                def find_project_from_association
                  render_404 unless @object.present?
                  @project = @object.project
                end
                def find_model_object
                  model = self.class.model_object
                  if model
                    @object = model.find(params[:id])
                    self.instance_variable_set('@' + controller_name.singularize, @object) if @object
                  end
                rescue ActiveRecord::RecordNotFound
                  render_404
                end
                def self.model_object(model)
                  self.model_object = model
                end
                # Filter for bulk issue operations
                def find_issues
                  @issues = Issue.find_all_by_id(params[:id] || params[:ids])
                  raise ActiveRecord::RecordNotFound if @issues.empty?
                  if @issues.detect {|issue| !issue.visible?}
                    deny_access
                    return
                  end
                  @projects = @issues.collect(&:project).compact.uniq
                  @project = @projects.first if @projects.size == 1
                rescue ActiveRecord::RecordNotFound
                  render_404
                end
                # make sure that the user is a member of the project (or admin) if project is private
                # used as a before_filter for actions that do not require any particular permission on the project
                def check_project_privacy
                  if @project && !@project.archived?
                    if @project.visible?
                      true
                    else
                      deny_access
                    end
                  else
                    @project = nil
                    render_404
                    false
                  end
                end
                def back_url
                  params[:back_url] || request.env['HTTP_REFERER']
                end
                def redirect_back_or_default(default)
                  back_url = CGI.unescape(params[:back_url].to_s)
                  if !back_url.blank?
                    begin
                      uri = URI.parse(back_url)
                      # do not redirect user to another host or to the login or register page
                      if (uri.relative? || (uri.host == request.host)) && !uri.path.match(%r{/(login|account/register)})
                        redirect_to(back_url)
                        return
                      end
                    rescue URI::InvalidURIError
                      # redirect to default
                    end
                  end
                  redirect_to default
                  false
                end
                # Redirects to the request referer if present, redirects to args or call block otherwise.
                def redirect_to_referer_or(*args, &block)
                  redirect_to :back
                rescue ::ActionController::RedirectBackError
                  if args.any?
                    redirect_to *args
                  elsif block_given?
                    block.call
                  else
                    raise "#redirect_to_referer_or takes arguments or a block"
                  end
                end
                def render_403(options={})
                  @project = nil
                  render_error({:message => :notice_not_authorized, :status => 403}.merge(options))
                  return false
                end
                def render_404(options={})
                  render_error({:message => :notice_file_not_found, :status => 404}.merge(options))
                  return false
                end
                # Renders an error response
                def render_error(arg)
                  arg = {:message => arg} unless arg.is_a?(Hash)
                  @message = arg[:message]
                  @message = l(@message) if @message.is_a?(Symbol)
                  @status = arg[:status] || 500
                  respond_to do |format|
                    format.html {
                      render :template => 'common/error', :layout => use_layout, :status => @status
                    }
                    format.atom { head @status }
                    format.xml { head @status }
                    format.js { head @status }
                    format.json { head @status }
                  end
                end
                # Filter for actions that provide an API response
                # but have no HTML representation for non admin users
                def require_admin_or_api_request
                  return true if api_request?
                  if User.current.admin?
                    true
                  elsif User.current.logged?
                    render_error(:status => 406)
                  else
                    deny_access
                  end
                end
                # Picks which layout to use based on the request
                #
                # @return [boolean, string] name of the layout to use or false for no layout
                def use_layout
                  request.xhr? ? false : 'base'
                end
                def invalid_authenticity_token
                  if api_request?
                    logger.error "Form authenticity token is missing or is invalid. API calls must include a proper Content-type header (text/xml or text/json)."
                  end
                  render_error "Invalid form authenticity token."
                end
                def render_feed(items, options={})
                  @items = items || []
                  @items.sort! {|x,y| y.event_datetime <=> x.event_datetime }
                  @items = @items.slice(0, Setting.feeds_limit.to_i)
                  @title = options[:title] || Setting.app_title
                  render :template => "common/feed.atom", :layout => false,
                         :content_type => 'application/atom+xml'
                end
                def self.accept_rss_auth(*actions)
                  if actions.any?
                    self.accept_rss_auth_actions = actions
                  else
                    self.accept_rss_auth_actions || []
                  end
                end
                def accept_rss_auth?(action=action_name)
                  self.class.accept_rss_auth.include?(action.to_sym)
                end
                def self.accept_api_auth(*actions)
                  if actions.any?
                    self.accept_api_auth_actions = actions
                  else
                    self.accept_api_auth_actions || []
                  end
                end
                def accept_api_auth?(action=action_name)
                  self.class.accept_api_auth.include?(action.to_sym)
                end
                # Returns the number of objects that should be displayed
                # on the paginated list
                def per_page_option
                  per_page = nil
                  if params[:per_page] && Setting.per_page_options_array.include?(params[:per_page].to_s.to_i)
                    per_page = params[:per_page].to_s.to_i
                    session[:per_page] = per_page
                  elsif session[:per_page]
                    per_page = session[:per_page]
                  else
                    per_page = Setting.per_page_options_array.first || 25
                  end
                  per_page
                end
                # Returns offset and limit used to retrieve objects
                # for an API response based on offset, limit and page parameters
                def api_offset_and_limit(options=params)
                  if options[:offset].present?
                    offset = options[:offset].to_i
                    if offset < 0
                      offset = 0
                    end
                  end
                  limit = options[:limit].to_i
                  if limit < 1
                    limit = 25
                  elsif limit > 100
                    limit = 100
                  end
                  if offset.nil? && options[:page].present?
                    offset = (options[:page].to_i - 1) * limit
                    offset = 0 if offset < 0
                  end
                  offset ||= 0
                  [offset, limit]
                end
                # qvalues http header parser
                # code taken from webrick
                def parse_qvalues(value)
                  tmp = []
                  if value
                    parts = value.split(/,\s*/)
                    parts.each {|part|
                      if m = %r{^([^\s,]+?)(?:;\s*q=(\d+(?:\.\d+)?))?$}.match(part)
                        val = m[1]
                        q = (m[2] or 1).to_f
                        tmp.push([val, q])
                      end
                    }
                    tmp = tmp.sort_by{|val, q| -q}
                    tmp.collect!{|val, q| val}
                  end
                  return tmp
                rescue
                  nil
                end
                # Returns a string that can be used as filename value in Content-Disposition header
                def filename_for_content_disposition(name)
                  request.env['HTTP_USER_AGENT'] =~ %r{MSIE} ? ERB::Util.url_encode(name) : name
                end
                def api_request?
                  %w(xml json).include? params[:format]
                end
                # Returns the API key present in the request
                def api_key_from_request
                  if params[:key].present?
                    params[:key].to_s
                  elsif request.headers["X-Redmine-API-Key"].present?
                    request.headers["X-Redmine-API-Key"].to_s
                  end
                end
                # Renders a warning flash if obj has unsaved attachments
                def render_attachment_warning_if_needed(obj)
                  flash[:warning] = l(:warning_attachments_not_saved, obj.unsaved_attachments.size) if obj.unsaved_attachments.present?
                end
                # Sets the `flash` notice or error based the number of issues that did not save
                #
                # @param [Array, Issue] issues all of the saved and unsaved Issues
                # @param [Array, Integer] unsaved_issue_ids the issue ids that were not saved
                def set_flash_from_bulk_issue_save(issues, unsaved_issue_ids)
                  if unsaved_issue_ids.empty?
                    flash[:notice] = l(:notice_successful_update) unless issues.empty?
                  else
                    flash[:error] = l(:notice_failed_to_save_issues,
                                      :count => unsaved_issue_ids.size,
                                      :total => issues.size,
                                      :ids => '#' + unsaved_issue_ids.join(', #'))
                  end
                end
                # Rescues an invalid query statement. Just in case...
                def query_statement_invalid(exception)
                  logger.error "Query::StatementInvalid: #{exception.message}" if logger
                  session.delete(:query)
                  sort_clear if respond_to?(:sort_clear)
                  render_error "An error occurred while executing the query and has been logged. Please report this error to your Redmine administrator."
                end
+               # Renders a 200 response for successfull updates or deletions via the API
+               def render_api_ok
+                 # head :ok would return a response body with one space
+                 render :text => '', :status => :ok, :layout => nil
+               end
                # Renders API response on validation failure
                def render_validation_errors(objects)
                  if objects.is_a?(Array)
                    @error_messages = objects.map {|object| object.errors.full_messages}.flatten
                  else
                    @error_messages = objects.errors.full_messages
                  end
                  render :template => 'common/error_messages.api', :status => :unprocessable_entity, :layout => nil
                end
                # Overrides #_include_layout? so that #render with no arguments
                # doesn't use the layout for api requests
                def _include_layout?(*args)
                  api_request? ? false : super
                end
              end

app/controllers/groups_controller.rb +4 -4

              # Redmine - project management software
              # Copyright (C) 2006-2012  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              class GroupsController < ApplicationController
                layout 'admin'
                before_filter :require_admin
                before_filter :find_group, :except => [:index, :new, :create]
                accept_api_auth :index, :show, :create, :update, :destroy, :add_users, :remove_user
                helper :custom_fields
                def index
                  @groups = Group.sorted.all
                  respond_to do |format|
                    format.html
                    format.api
                  end
                end
                def show
                  respond_to do |format|
                    format.html
                    format.api
                  end
                end
                def new
                  @group = Group.new
                end
                def create
                  @group = Group.new
                  @group.safe_attributes = params[:group]
                  respond_to do |format|
                    if @group.save
                      format.html {
                        flash[:notice] = l(:notice_successful_create)
                        redirect_to(params[:continue] ? new_group_path : groups_path)
                      }
                      format.api  { render :action => 'show', :status => :created, :location => group_url(@group) }
                    else
                      format.html { render :action => "new" }
                      format.api  { render_validation_errors(@group) }
                    end
                  end
                end
                def edit
                end
                def update
                  @group.safe_attributes = params[:group]
                  respond_to do |format|
                    if @group.save
                      flash[:notice] = l(:notice_successful_update)
                      format.html { redirect_to(groups_path) }
-                     format.api  { head :ok }
+                     format.api  { render_api_ok }
                    else
                      format.html { render :action => "edit" }
                      format.api  { render_validation_errors(@group) }
                    end
                  end
                end
                def destroy
                  @group.destroy
                  respond_to do |format|
                    format.html { redirect_to(groups_url) }
-                   format.api  { head :ok }
+                   format.api  { render_api_ok }
                  end
                end
                def add_users
                  users = User.find_all_by_id(params[:user_id] || params[:user_ids])
                  @group.users << users if request.post?
                  respond_to do |format|
                    format.html { redirect_to :controller => 'groups', :action => 'edit', :id => @group, :tab => 'users' }
                    format.js {
                      render(:update) {|page|
                        page.replace_html "tab-content-users", :partial => 'groups/users'
                        users.each {|user| page.visual_effect(:highlight, "user-#{user.id}") }
                      }
                    }
-                   format.api { head :ok }
+                   format.api { render_api_ok }
                  end
                end
                def remove_user
                  @group.users.delete(User.find(params[:user_id])) if request.delete?
                  respond_to do |format|
                    format.html { redirect_to :controller => 'groups', :action => 'edit', :id => @group, :tab => 'users' }
                    format.js { render(:update) {|page| page.replace_html "tab-content-users", :partial => 'groups/users'} }
-                   format.api { head :ok }
+                   format.api { render_api_ok }
                  end
                end
                def autocomplete_for_user
                  @users = User.active.not_in_group(@group).like(params[:q]).all(:limit => 100)
                  render :layout => false
                end
                def edit_membership
                  @membership = Member.edit_membership(params[:membership_id], params[:membership], @group)
                  @membership.save if request.post?
                  respond_to do |format|
                    if @membership.valid?
                      format.html { redirect_to :controller => 'groups', :action => 'edit', :id => @group, :tab => 'memberships' }
                      format.js {
                        render(:update) {|page|
                          page.replace_html "tab-content-memberships", :partial => 'groups/memberships'
                          page.visual_effect(:highlight, "member-#{@membership.id}")
                        }
                      }
                    else
                      format.js {
                        render(:update) {|page|
                          page.alert(l(:notice_failed_to_save_members, :errors => @membership.errors.full_messages.join(', ')))
                        }
                      }
                    end
                  end
                end
                def destroy_membership
                  Member.find(params[:membership_id]).destroy if request.post?
                  respond_to do |format|
                    format.html { redirect_to :controller => 'groups', :action => 'edit', :id => @group, :tab => 'memberships' }
                    format.js { render(:update) {|page| page.replace_html "tab-content-memberships", :partial => 'groups/memberships'} }
                  end
                end
                private
                def find_group
                  @group = Group.find(params[:id])
                rescue ActiveRecord::RecordNotFound
                  render_404
                end
              end

app/controllers/issue_categories_controller.rb +2 -2

              # Redmine - project management software
              # Copyright (C) 2006-2012  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              class IssueCategoriesController < ApplicationController
                menu_item :settings
                model_object IssueCategory
                before_filter :find_model_object, :except => [:index, :new, :create]
                before_filter :find_project_from_association, :except => [:index, :new, :create]
                before_filter :find_project_by_project_id, :only => [:index, :new, :create]
                before_filter :authorize
                accept_api_auth :index, :show, :create, :update, :destroy
                def index
                  respond_to do |format|
                    format.html { redirect_to :controller => 'projects', :action => 'settings', :tab => 'categories', :id => @project }
                    format.api { @categories = @project.issue_categories.all }
                  end
                end
                def show
                  respond_to do |format|
                    format.html { redirect_to :controller => 'projects', :action => 'settings', :tab => 'categories', :id => @project }
                    format.api
                  end
                end
                def new
                  @category = @project.issue_categories.build
                  @category.safe_attributes = params[:issue_category]
                  respond_to do |format|
                    format.html
                    format.js do
                      render :update do |page|
                        page.replace_html 'ajax-modal', :partial => 'issue_categories/new_modal'
                        page << "showModal('ajax-modal', '600px');"
                        page << "Form.Element.focus('issue_category_name');"
                      end
                    end
                  end
                end
                def create
                  @category = @project.issue_categories.build
                  @category.safe_attributes = params[:issue_category]
                  if @category.save
                    respond_to do |format|
                      format.html do
                        flash[:notice] = l(:notice_successful_create)
                        redirect_to :controller => 'projects', :action => 'settings', :tab => 'categories', :id => @project
                      end
                      format.js do
                        render(:update) {|page|
                          page << 'hideModal();'
                          # IE doesn't support the replace_html rjs method for select box options
                          page.replace "issue_category_id",
                            content_tag('select', content_tag('option') + options_from_collection_for_select(@project.issue_categories, 'id', 'name', @category.id), :id => 'issue_category_id', :name => 'issue[category_id]')
                        }
                      end
                      format.api { render :action => 'show', :status => :created, :location => issue_category_path(@category) }
                    end
                  else
                    respond_to do |format|
                      format.html { render :action => 'new'}
                      format.js do
                        render :update do |page|
                          page.replace_html 'ajax-modal', :partial => 'issue_categories/new_modal'
                          page << "Form.Element.focus('version_name');"
                        end
                      end
                      format.api { render_validation_errors(@category) }
                    end
                  end
                end
                def edit
                end
                def update
                  @category.safe_attributes = params[:issue_category]
                  if @category.save
                    respond_to do |format|
                      format.html {
                        flash[:notice] = l(:notice_successful_update)
                        redirect_to :controller => 'projects', :action => 'settings', :tab => 'categories', :id => @project
                      }
-                     format.api { head :ok }
+                     format.api { render_api_ok }
                    end
                  else
                    respond_to do |format|
                      format.html { render :action => 'edit' }
                      format.api { render_validation_errors(@category) }
                    end
                  end
                end
                def destroy
                  @issue_count = @category.issues.size
                  if @issue_count == 0 || params[:todo] || api_request?
                    reassign_to = nil
                    if params[:reassign_to_id] && (params[:todo] == 'reassign' || params[:todo].blank?)
                      reassign_to = @project.issue_categories.find_by_id(params[:reassign_to_id])
                    end
                    @category.destroy(reassign_to)
                    respond_to do |format|
                      format.html { redirect_to :controller => 'projects', :action => 'settings', :id => @project, :tab => 'categories' }
-                     format.api { head :ok }
+                     format.api { render_api_ok }
                    end
                    return
                  end
                  @categories = @project.issue_categories - [@category]
                end
              private
                # Wrap ApplicationController's find_model_object method to set
                # @category instead of just @issue_category
                def find_model_object
                  super
                  @category = @object
                end
              end

app/controllers/issue_relations_controller.rb +1 -1

              # Redmine - project management software
              # Copyright (C) 2006-2012  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              class IssueRelationsController < ApplicationController
                before_filter :find_issue, :find_project_from_association, :authorize, :only => [:index, :create]
                before_filter :find_relation, :except => [:index, :create]
                accept_api_auth :index, :show, :create, :destroy
                def index
                  @relations = @issue.relations
                  respond_to do |format|
                    format.html { render :nothing => true }
                    format.api
                  end
                end
                def show
                  raise Unauthorized unless @relation.visible?
                  respond_to do |format|
                    format.html { render :nothing => true }
                    format.api
                  end
                end
                def create
                  @relation = IssueRelation.new(params[:relation])
                  @relation.issue_from = @issue
                  if params[:relation] && m = params[:relation][:issue_to_id].to_s.strip.match(/^#?(\d+)$/)
                    @relation.issue_to = Issue.visible.find_by_id(m[1].to_i)
                  end
                  saved = @relation.save
                  respond_to do |format|
                    format.html { redirect_to :controller => 'issues', :action => 'show', :id => @issue }
                    format.js do
                      @relations = @issue.relations.select {|r| r.other_issue(@issue) && r.other_issue(@issue).visible? }
                      render :update do |page|
                        page.replace_html "relations", :partial => 'issues/relations'
                        if @relation.errors.empty?
                          page << "$('relation_delay').value = ''"
                          page << "$('relation_issue_to_id').value = ''"
                        end
                      end
                    end
                    format.api {
                      if saved
                        render :action => 'show', :status => :created, :location => relation_url(@relation)
                      else
                        render_validation_errors(@relation)
                      end
                    }
                  end
                end
                def destroy
                  raise Unauthorized unless @relation.deletable?
                  @relation.destroy
                  respond_to do |format|
                    format.html { redirect_to issue_path } # TODO : does this really work since @issue is always nil? What is it useful to?
                    format.js   { render(:update) {|page| page.remove "relation-#{@relation.id}"} }
-                   format.api  { head :ok }
+                   format.api  { render_api_ok }
                  end
                end
              private
                def find_issue
                  @issue = @object = Issue.find(params[:issue_id])
                rescue ActiveRecord::RecordNotFound
                  render_404
                end
                def find_relation
                  @relation = IssueRelation.find(params[:id])
                rescue ActiveRecord::RecordNotFound
                  render_404
                end
              end

app/controllers/issues_controller.rb +2 -2

              # Redmine - project management software
              # Copyright (C) 2006-2012  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              class IssuesController < ApplicationController
                menu_item :new_issue, :only => [:new, :create]
                default_search_scope :issues
                before_filter :find_issue, :only => [:show, :edit, :update]
                before_filter :find_issues, :only => [:bulk_edit, :bulk_update, :destroy]
                before_filter :find_project, :only => [:new, :create]
                before_filter :authorize, :except => [:index]
                before_filter :find_optional_project, :only => [:index]
                before_filter :check_for_default_issue_status, :only => [:new, :create]
                before_filter :build_new_issue_from_params, :only => [:new, :create]
                accept_rss_auth :index, :show
                accept_api_auth :index, :show, :create, :update, :destroy
                rescue_from Query::StatementInvalid, :with => :query_statement_invalid
                helper :journals
                helper :projects
                include ProjectsHelper
                helper :custom_fields
                include CustomFieldsHelper
                helper :issue_relations
                include IssueRelationsHelper
                helper :watchers
                include WatchersHelper
                helper :attachments
                include AttachmentsHelper
                helper :queries
                include QueriesHelper
                helper :repositories
                include RepositoriesHelper
                helper :sort
                include SortHelper
                include IssuesHelper
                helper :timelog
                include Redmine::Export::PDF
                def index
                  retrieve_query
                  sort_init(@query.sort_criteria.empty? ? [['id', 'desc']] : @query.sort_criteria)
                  sort_update(@query.sortable_columns)
                  if @query.valid?
                    case params[:format]
                    when 'csv', 'pdf'
                      @limit = Setting.issues_export_limit.to_i
                    when 'atom'
                      @limit = Setting.feeds_limit.to_i
                    when 'xml', 'json'
                      @offset, @limit = api_offset_and_limit
                    else
                      @limit = per_page_option
                    end
                    @issue_count = @query.issue_count
                    @issue_pages = Paginator.new self, @issue_count, @limit, params['page']
                    @offset ||= @issue_pages.current.offset
                    @issues = @query.issues(:include => [:assigned_to, :tracker, :priority, :category, :fixed_version],
                                            :order => sort_clause,
                                            :offset => @offset,
                                            :limit => @limit)
                    @issue_count_by_group = @query.issue_count_by_group
                    respond_to do |format|
                      format.html { render :template => 'issues/index', :layout => !request.xhr? }
                      format.api  {
                        Issue.load_relations(@issues) if include_in_api_response?('relations')
                      }
                      format.atom { render_feed(@issues, :title => "#{@project || Setting.app_title}: #{l(:label_issue_plural)}") }
                      format.csv  { send_data(issues_to_csv(@issues, @project, @query, params), :type => 'text/csv; header=present', :filename => 'export.csv') }
                      format.pdf  { send_data(issues_to_pdf(@issues, @project, @query), :type => 'application/pdf', :filename => 'export.pdf') }
                    end
                  else
                    respond_to do |format|
                      format.html { render(:template => 'issues/index', :layout => !request.xhr?) }
                      format.any(:atom, :csv, :pdf) { render(:nothing => true) }
                      format.api { render_validation_errors(@query) }
                    end
                  end
                rescue ActiveRecord::RecordNotFound
                  render_404
                end
                def show
                  @journals = @issue.journals.find(:all, :include => [:user, :details], :order => "#{Journal.table_name}.created_on ASC")
                  @journals.each_with_index {|j,i| j.indice = i+1}
                  @journals.reverse! if User.current.wants_comments_in_reverse_order?
                  @changesets = @issue.changesets.visible.all
                  @changesets.reverse! if User.current.wants_comments_in_reverse_order?
                  @relations = @issue.relations.select {|r| r.other_issue(@issue) && r.other_issue(@issue).visible? }
                  @allowed_statuses = @issue.new_statuses_allowed_to(User.current)
                  @edit_allowed = User.current.allowed_to?(:edit_issues, @project)
                  @priorities = IssuePriority.active
                  @time_entry = TimeEntry.new(:issue => @issue, :project => @issue.project)
                  respond_to do |format|
                    format.html {
                      retrieve_previous_and_next_issue_ids
                      render :template => 'issues/show'
                    }
                    format.api
                    format.atom { render :template => 'journals/index', :layout => false, :content_type => 'application/atom+xml' }
                    format.pdf  { send_data(issue_to_pdf(@issue), :type => 'application/pdf', :filename => "#{@project.identifier}-#{@issue.id}.pdf") }
                  end
                end
                # Add a new issue
                # The new issue will be created from an existing one if copy_from parameter is given
                def new
                  respond_to do |format|
                    format.html { render :action => 'new', :layout => !request.xhr? }
                    format.js {
                      render(:update) { |page|
                        if params[:project_change]
                          page.replace_html 'all_attributes', :partial => 'form'
                        else
                          page.replace_html 'attributes', :partial => 'attributes'
                        end
                        m = User.current.allowed_to?(:log_time, @issue.project) ? 'show' : 'hide'
                        page << "if ($('log_time')) {Element.#{m}('log_time');}"
                      }
                    }
                  end
                end
                def create
                  call_hook(:controller_issues_new_before_save, { :params => params, :issue => @issue })
                  @issue.save_attachments(params[:attachments] || (params[:issue] && params[:issue][:uploads]))
                  if @issue.save
                    call_hook(:controller_issues_new_after_save, { :params => params, :issue => @issue})
                    respond_to do |format|
                      format.html {
                        render_attachment_warning_if_needed(@issue)
                        flash[:notice] = l(:notice_issue_successful_create, :id => view_context.link_to("##{@issue.id}", issue_path(@issue)))
                        redirect_to(params[:continue] ?  { :action => 'new', :project_id => @issue.project, :issue => {:tracker_id => @issue.tracker, :parent_issue_id => @issue.parent_issue_id}.reject {|k,v| v.nil?} } :
                                    { :action => 'show', :id => @issue })
                      }
                      format.api  { render :action => 'show', :status => :created, :location => issue_url(@issue) }
                    end
                    return
                  else
                    respond_to do |format|
                      format.html { render :action => 'new' }
                      format.api  { render_validation_errors(@issue) }
                    end
                  end
                end
                def edit
                  return unless update_issue_from_params
                  respond_to do |format|
                    format.html { }
                    format.xml  { }
                  end
                end
                def update
                  return unless update_issue_from_params
                  @issue.save_attachments(params[:attachments] || (params[:issue] && params[:issue][:uploads]))
                  saved = false
                  begin
                    saved = @issue.save_issue_with_child_records(params, @time_entry)
                  rescue ActiveRecord::StaleObjectError
                    @conflict = true
                    if params[:last_journal_id]
                      if params[:last_journal_id].present?
                        last_journal_id = params[:last_journal_id].to_i
                        @conflict_journals = @issue.journals.all(:conditions => ["#{Journal.table_name}.id > ?", last_journal_id])
                      else
                        @conflict_journals = @issue.journals.all
                      end
                    end
                  end
                  if saved
                    render_attachment_warning_if_needed(@issue)
                    flash[:notice] = l(:notice_successful_update) unless @issue.current_journal.new_record?
                    respond_to do |format|
                      format.html { redirect_back_or_default({:action => 'show', :id => @issue}) }
-                     format.api  { head :ok }
+                     format.api  { render_api_ok }
                    end
                  else
                    respond_to do |format|
                      format.html { render :action => 'edit' }
                      format.api  { render_validation_errors(@issue) }
                    end
                  end
                end
                # Bulk edit/copy a set of issues
                def bulk_edit
                  @issues.sort!
                  @copy = params[:copy].present?
                  @notes = params[:notes]
                  if User.current.allowed_to?(:move_issues, @projects)
                    @allowed_projects = Issue.allowed_target_projects_on_move
                    if params[:issue]
                      @target_project = @allowed_projects.detect {|p| p.id.to_s == params[:issue][:project_id].to_s}
                      if @target_project
                        target_projects = [@target_project]
                      end
                    end
                  end
                  target_projects ||= @projects
                  if @copy
                    @available_statuses = [IssueStatus.default]
                  else
                    @available_statuses = @issues.map(&:new_statuses_allowed_to).reduce(:&)
                  end
                  @custom_fields = target_projects.map{|p|p.all_issue_custom_fields}.reduce(:&)
                  @assignables = target_projects.map(&:assignable_users).reduce(:&)
                  @trackers = target_projects.map(&:trackers).reduce(:&)
                  @versions = target_projects.map {|p| p.shared_versions.open}.reduce(:&)
                  @categories = target_projects.map {|p| p.issue_categories}.reduce(:&)
                  if @copy
                    @attachments_present = @issues.detect {|i| i.attachments.any?}.present?
                  end
                  @safe_attributes = @issues.map(&:safe_attribute_names).reduce(:&)
                  render :layout => false if request.xhr?
                end
                def bulk_update
                  @issues.sort!
                  @copy = params[:copy].present?
                  attributes = parse_params_for_bulk_issue_attributes(params)
                  unsaved_issue_ids = []
                  moved_issues = []
                  @issues.each do |issue|
                    issue.reload
                    if @copy
                      issue = issue.copy({}, :attachments => params[:copy_attachments].present?)
                    end
                    journal = issue.init_journal(User.current, params[:notes])
                    issue.safe_attributes = attributes
                    call_hook(:controller_issues_bulk_edit_before_save, { :params => params, :issue => issue })
                    if issue.save
                      moved_issues << issue
                    else
                      # Keep unsaved issue ids to display them in flash error
                      unsaved_issue_ids << issue.id
                    end
                  end
                  set_flash_from_bulk_issue_save(@issues, unsaved_issue_ids)
                  if params[:follow]
                    if @issues.size == 1 && moved_issues.size == 1
                      redirect_to :controller => 'issues', :action => 'show', :id => moved_issues.first
                    elsif moved_issues.map(&:project).uniq.size == 1
                      redirect_to :controller => 'issues', :action => 'index', :project_id => moved_issues.map(&:project).first
                    end
                  else
                    redirect_back_or_default({:controller => 'issues', :action => 'index', :project_id => @project})
                  end
                end
                def destroy
                  @hours = TimeEntry.sum(:hours, :conditions => ['issue_id IN (?)', @issues]).to_f
                  if @hours > 0
                    case params[:todo]
                    when 'destroy'
                      # nothing to do
                    when 'nullify'
                      TimeEntry.update_all('issue_id = NULL', ['issue_id IN (?)', @issues])
                    when 'reassign'
                      reassign_to = @project.issues.find_by_id(params[:reassign_to_id])
                      if reassign_to.nil?
                        flash.now[:error] = l(:error_issue_not_found_in_project)
                        return
                      else
                        TimeEntry.update_all("issue_id = #{reassign_to.id}", ['issue_id IN (?)', @issues])
                      end
                    else
                      # display the destroy form if it's a user request
                      return unless api_request?
                    end
                  end
                  @issues.each do |issue|
                    begin
                      issue.reload.destroy
                    rescue ::ActiveRecord::RecordNotFound # raised by #reload if issue no longer exists
                      # nothing to do, issue was already deleted (eg. by a parent)
                    end
                  end
                  respond_to do |format|
                    format.html { redirect_back_or_default(:action => 'index', :project_id => @project) }
-                   format.api  { head :ok }
+                   format.api  { render_api_ok }
                  end
                end
              private
                def find_issue
                  # Issue.visible.find(...) can not be used to redirect user to the login form
                  # if the issue actually exists but requires authentication
                  @issue = Issue.find(params[:id], :include => [:project, :tracker, :status, :author, :priority, :category])
                  unless @issue.visible?
                    deny_access
                    return
                  end
                  @project = @issue.project
                rescue ActiveRecord::RecordNotFound
                  render_404
                end
                def find_project
                  project_id = params[:project_id] || (params[:issue] && params[:issue][:project_id])
                  @project = Project.find(project_id)
                rescue ActiveRecord::RecordNotFound
                  render_404
                end
                def retrieve_previous_and_next_issue_ids
                  retrieve_query_from_session
                  if @query
                    sort_init(@query.sort_criteria.empty? ? [['id', 'desc']] : @query.sort_criteria)
                    sort_update(@query.sortable_columns, 'issues_index_sort')
                    limit = 500
                    issue_ids = @query.issue_ids(:order => sort_clause, :limit => (limit + 1), :include => [:assigned_to, :tracker, :priority, :category, :fixed_version])
                    if (idx = issue_ids.index(@issue.id)) && idx < limit
                      if issue_ids.size < 500
                        @issue_position = idx + 1
                        @issue_count = issue_ids.size
                      end
                      @prev_issue_id = issue_ids[idx - 1] if idx > 0
                      @next_issue_id = issue_ids[idx + 1] if idx < (issue_ids.size - 1)
                    end
                  end
                end
                # Used by #edit and #update to set some common instance variables
                # from the params
                # TODO: Refactor, not everything in here is needed by #edit
                def update_issue_from_params
                  @edit_allowed = User.current.allowed_to?(:edit_issues, @project)
                  @time_entry = TimeEntry.new(:issue => @issue, :project => @issue.project)
                  @time_entry.attributes = params[:time_entry]
                  @notes = params[:notes] || (params[:issue].present? ? params[:issue][:notes] : nil)
                  @issue.init_journal(User.current, @notes)
                  issue_attributes = params[:issue]
                  if issue_attributes && params[:conflict_resolution]
                    case params[:conflict_resolution]
                    when 'overwrite'
                      issue_attributes = issue_attributes.dup
                      issue_attributes.delete(:lock_version)
                    when 'add_notes'
                      issue_attributes = {}
                    when 'cancel'
                      redirect_to issue_path(@issue)
                      return false
                    end
                  end
                  @issue.safe_attributes = issue_attributes
                  @priorities = IssuePriority.active
                  @allowed_statuses = @issue.new_statuses_allowed_to(User.current)
                  true
                end
                # TODO: Refactor, lots of extra code in here
                # TODO: Changing tracker on an existing issue should not trigger this
                def build_new_issue_from_params
                  if params[:id].blank?
                    @issue = Issue.new
                    if params[:copy_from]
                      begin
                        @copy_from = Issue.visible.find(params[:copy_from])
                        @copy_attachments = params[:copy_attachments].present? || request.get?
                        @issue.copy_from(@copy_from, :attachments => @copy_attachments)
                      rescue ActiveRecord::RecordNotFound
                        render_404
                        return
                      end
                    end
                    @issue.project = @project
                  else
                    @issue = @project.issues.visible.find(params[:id])
                  end
                  @issue.project = @project
                  @issue.author = User.current
                  # Tracker must be set before custom field values
                  @issue.tracker ||= @project.trackers.find((params[:issue] && params[:issue][:tracker_id]) || params[:tracker_id] || :first)
                  if @issue.tracker.nil?
                    render_error l(:error_no_tracker_in_project)
                    return false
                  end
                  @issue.start_date ||= Date.today if Setting.default_issue_start_date_to_creation_date?
                  @issue.safe_attributes = params[:issue]
                  @priorities = IssuePriority.active
                  @allowed_statuses = @issue.new_statuses_allowed_to(User.current, true)
                  @available_watchers = (@issue.project.users.sort + @issue.watcher_users).uniq
                end
                def check_for_default_issue_status
                  if IssueStatus.default.nil?
                    render_error l(:error_no_default_issue_status)
                    return false
                  end
                end
                def parse_params_for_bulk_issue_attributes(params)
                  attributes = (params[:issue] || {}).reject {|k,v| v.blank?}
                  attributes.keys.each {|k| attributes[k] = '' if attributes[k] == 'none'}
                  if custom = attributes[:custom_field_values]
                    custom.reject! {|k,v| v.blank?}
                    custom.keys.each do |k|
                      if custom[k].is_a?(Array)
                        custom[k] << '' if custom[k].delete('__none__')
                      else
                        custom[k] = '' if custom[k] == '__none__'
                      end
                    end
                  end
                  attributes
                end
              end

app/controllers/members_controller.rb +2 -2

              # Redmine - project management software
              # Copyright (C) 2006-2012  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              class MembersController < ApplicationController
                model_object Member
                before_filter :find_model_object, :except => [:index, :create, :autocomplete]
                before_filter :find_project_from_association, :except => [:index, :create, :autocomplete]
                before_filter :find_project_by_project_id, :only => [:index, :create, :autocomplete]
                before_filter :authorize
                accept_api_auth :index, :show, :create, :update, :destroy
                def index
                  @offset, @limit = api_offset_and_limit
                  @member_count = @project.member_principals.count
                  @member_pages = Paginator.new self, @member_count, @limit, params['page']
                  @offset ||= @member_pages.current.offset
                  @members =  @project.member_principals.all(
                    :order => "#{Member.table_name}.id",
                    :limit  =>  @limit,
                    :offset =>  @offset
                  )
                  respond_to do |format|
                    format.html { head 406 }
                    format.api
                  end
                end
                def show
                  respond_to do |format|
                    format.html { head 406 }
                    format.api
                  end
                end
                def create
                  members = []
                  if params[:membership]
                    if params[:membership][:user_ids]
                      attrs = params[:membership].dup
                      user_ids = attrs.delete(:user_ids)
                      user_ids.each do |user_id|
                        members << Member.new(:role_ids => params[:membership][:role_ids], :user_id => user_id)
                      end
                    else
                      members << Member.new(:role_ids => params[:membership][:role_ids], :user_id => params[:membership][:user_id])
                    end
                    @project.members << members
                  end
                  respond_to do |format|
                    if members.present? && members.all? {|m| m.valid? }
                      format.html { redirect_to :controller => 'projects', :action => 'settings', :tab => 'members', :id => @project }
                      format.js {
                        render(:update) {|page|
                          page.replace_html "tab-content-members", :partial => 'projects/settings/members'
                          page << 'hideOnLoad()'
                          members.each {|member| page.visual_effect(:highlight, "member-#{member.id}") }
                        }
                      }
                      format.api {
                        @member = members.first
                        render :action => 'show', :status => :created, :location => membership_url(@member)
                      }
                    else
                      format.js {
                        render(:update) {|page|
                          errors = members.collect {|m|
                            m.errors.full_messages
                          }.flatten.uniq
                          page.alert(l(:notice_failed_to_save_members, :errors => errors.join(', ')))
                        }
                      }
                      format.api { render_validation_errors(members.first) }
                    end
                  end
                end
                def update
                  if params[:membership]
                    @member.role_ids = params[:membership][:role_ids]
                  end
                  saved = @member.save
                  respond_to do |format|
                    format.html { redirect_to :controller => 'projects', :action => 'settings', :tab => 'members', :id => @project }
                    format.js {
                      render(:update) {|page|
                        page.replace_html "tab-content-members", :partial => 'projects/settings/members'
                        page << 'hideOnLoad()'
                        page.visual_effect(:highlight, "member-#{@member.id}")
                      }
                    }
                    format.api {
                      if saved
-                       head :ok
+                       render_api_ok
                      else
                        render_validation_errors(@member)
                      end
                    }
                  end
                end
                def destroy
                  if request.delete? && @member.deletable?
                    @member.destroy
                  end
                  respond_to do |format|
                    format.html { redirect_to :controller => 'projects', :action => 'settings', :tab => 'members', :id => @project }
                    format.js { render(:update) {|page|
                        page.replace_html "tab-content-members", :partial => 'projects/settings/members'
                        page << 'hideOnLoad()'
                      }
                    }
                    format.api {
                      if @member.destroyed?
-                       head :ok
+                       render_api_ok
                      else
                        head :unprocessable_entity
                      end
                    }
                  end
                end
                def autocomplete
                  @principals = Principal.active.not_member_of(@project).like(params[:q]).all(:limit => 100)
                  render :layout => false
                end
              end

app/controllers/projects_controller.rb +2 -2

              # Redmine - project management software
              # Copyright (C) 2006-2012  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              class ProjectsController < ApplicationController
                menu_item :overview
                menu_item :roadmap, :only => :roadmap
                menu_item :settings, :only => :settings
                before_filter :find_project, :except => [ :index, :list, :new, :create, :copy ]
                before_filter :authorize, :except => [ :index, :list, :new, :create, :copy, :archive, :unarchive, :destroy]
                before_filter :authorize_global, :only => [:new, :create]
                before_filter :require_admin, :only => [ :copy, :archive, :unarchive, :destroy ]
                accept_rss_auth :index
                accept_api_auth :index, :show, :create, :update, :destroy
                after_filter :only => [:create, :edit, :update, :archive, :unarchive, :destroy] do |controller|
                  if controller.request.post?
                    controller.send :expire_action, :controller => 'welcome', :action => 'robots'
                  end
                end
                helper :sort
                include SortHelper
                helper :custom_fields
                include CustomFieldsHelper
                helper :issues
                helper :queries
                include QueriesHelper
                helper :repositories
                include RepositoriesHelper
                include ProjectsHelper
                # Lists visible projects
                def index
                  respond_to do |format|
                    format.html {
                      scope = Project
                      unless params[:closed]
                        scope = scope.active
                      end
                      @projects = scope.visible.order('lft').all
                    }
                    format.api  {
                      @offset, @limit = api_offset_and_limit
                      @project_count = Project.visible.count
                      @projects = Project.visible.all(:offset => @offset, :limit => @limit, :order => 'lft')
                    }
                    format.atom {
                      projects = Project.visible.find(:all, :order => 'created_on DESC',
                                                            :limit => Setting.feeds_limit.to_i)
                      render_feed(projects, :title => "#{Setting.app_title}: #{l(:label_project_latest)}")
                    }
                  end
                end
                def new
                  @issue_custom_fields = IssueCustomField.find(:all, :order => "#{CustomField.table_name}.position")
                  @trackers = Tracker.sorted.all
                  @project = Project.new
                  @project.safe_attributes = params[:project]
                end
                def create
                  @issue_custom_fields = IssueCustomField.find(:all, :order => "#{CustomField.table_name}.position")
                  @trackers = Tracker.sorted.all
                  @project = Project.new
                  @project.safe_attributes = params[:project]
                  if validate_parent_id && @project.save
                    @project.set_allowed_parent!(params[:project]['parent_id']) if params[:project].has_key?('parent_id')
                    # Add current user as a project member if he is not admin
                    unless User.current.admin?
                      r = Role.givable.find_by_id(Setting.new_project_user_role_id.to_i) || Role.givable.first
                      m = Member.new(:user => User.current, :roles => [r])
                      @project.members << m
                    end
                    respond_to do |format|
                      format.html {
                        flash[:notice] = l(:notice_successful_create)
                        redirect_to(params[:continue] ?
                          {:controller => 'projects', :action => 'new', :project => {:parent_id => @project.parent_id}.reject {|k,v| v.nil?}} :
                          {:controller => 'projects', :action => 'settings', :id => @project}
                        )
                      }
                      format.api  { render :action => 'show', :status => :created, :location => url_for(:controller => 'projects', :action => 'show', :id => @project.id) }
                    end
                  else
                    respond_to do |format|
                      format.html { render :action => 'new' }
                      format.api  { render_validation_errors(@project) }
                    end
                  end
                end
                def copy
                  @issue_custom_fields = IssueCustomField.find(:all, :order => "#{CustomField.table_name}.position")
                  @trackers = Tracker.sorted.all
                  @root_projects = Project.find(:all,
                                                :conditions => "parent_id IS NULL AND status = #{Project::STATUS_ACTIVE}",
                                                :order => 'name')
                  @source_project = Project.find(params[:id])
                  if request.get?
                    @project = Project.copy_from(@source_project)
                    if @project
                      @project.identifier = Project.next_identifier if Setting.sequential_project_identifiers?
                    else
                      redirect_to :controller => 'admin', :action => 'projects'
                    end
                  else
                    Mailer.with_deliveries(params[:notifications] == '1') do
                      @project = Project.new
                      @project.safe_attributes = params[:project]
                      if validate_parent_id && @project.copy(@source_project, :only => params[:only])
                        @project.set_allowed_parent!(params[:project]['parent_id']) if params[:project].has_key?('parent_id')
                        flash[:notice] = l(:notice_successful_create)
                        redirect_to :controller => 'projects', :action => 'settings', :id => @project
                      elsif !@project.new_record?
                        # Project was created
                        # But some objects were not copied due to validation failures
                        # (eg. issues from disabled trackers)
                        # TODO: inform about that
                        redirect_to :controller => 'projects', :action => 'settings', :id => @project
                      end
                    end
                  end
                rescue ActiveRecord::RecordNotFound
                  redirect_to :controller => 'admin', :action => 'projects'
                end
                # Show @project
                def show
                  if params[:jump]
                    # try to redirect to the requested menu item
                    redirect_to_project_menu_item(@project, params[:jump]) && return
                  end
                  @users_by_role = @project.users_by_role
                  @subprojects = @project.children.visible.all
                  @news = @project.news.find(:all, :limit => 5, :include => [ :author, :project ], :order => "#{News.table_name}.created_on DESC")
                  @trackers = @project.rolled_up_trackers
                  cond = @project.project_condition(Setting.display_subprojects_issues?)
                  @open_issues_by_tracker = Issue.visible.open.where(cond).count(:group => :tracker)
                  @total_issues_by_tracker = Issue.visible.where(cond).count(:group => :tracker)
                  if User.current.allowed_to?(:view_time_entries, @project)
                    @total_hours = TimeEntry.visible.sum(:hours, :include => :project, :conditions => cond).to_f
                  end
                  @key = User.current.rss_key
                  respond_to do |format|
                    format.html
                    format.api
                  end
                end
                def settings
                  @issue_custom_fields = IssueCustomField.find(:all, :order => "#{CustomField.table_name}.position")
                  @issue_category ||= IssueCategory.new
                  @member ||= @project.members.new
                  @trackers = Tracker.sorted.all
                  @wiki ||= @project.wiki
                end
                def edit
                end
                def update
                  @project.safe_attributes = params[:project]
                  if validate_parent_id && @project.save
                    @project.set_allowed_parent!(params[:project]['parent_id']) if params[:project].has_key?('parent_id')
                    respond_to do |format|
                      format.html {
                        flash[:notice] = l(:notice_successful_update)
                        redirect_to :action => 'settings', :id => @project
                      }
-                     format.api  { head :ok }
+                     format.api  { render_api_ok }
                    end
                  else
                    respond_to do |format|
                      format.html {
                        settings
                        render :action => 'settings'
                      }
                      format.api  { render_validation_errors(@project) }
                    end
                  end
                end
                def modules
                  @project.enabled_module_names = params[:enabled_module_names]
                  flash[:notice] = l(:notice_successful_update)
                  redirect_to :action => 'settings', :id => @project, :tab => 'modules'
                end
                def archive
                  if request.post?
                    unless @project.archive
                      flash[:error] = l(:error_can_not_archive_project)
                    end
                  end
                  redirect_to(url_for(:controller => 'admin', :action => 'projects', :status => params[:status]))
                end
                def unarchive
                  @project.unarchive if request.post? && !@project.active?
                  redirect_to(url_for(:controller => 'admin', :action => 'projects', :status => params[:status]))
                end
                def close
                  @project.close
                  redirect_to project_path(@project)
                end
                def reopen
                  @project.reopen
                  redirect_to project_path(@project)
                end
                # Delete @project
                def destroy
                  @project_to_destroy = @project
                  if api_request? || params[:confirm]
                    @project_to_destroy.destroy
                    respond_to do |format|
                      format.html { redirect_to :controller => 'admin', :action => 'projects' }
-                     format.api  { head :ok }
+                     format.api  { render_api_ok }
                    end
                  end
                  # hide project in layout
                  @project = nil
                end
                private
                # Validates parent_id param according to user's permissions
                # TODO: move it to Project model in a validation that depends on User.current
                def validate_parent_id
                  return true if User.current.admin?
                  parent_id = params[:project] && params[:project][:parent_id]
                  if parent_id || @project.new_record?
                    parent = parent_id.blank? ? nil : Project.find_by_id(parent_id.to_i)
                    unless @project.allowed_parents.include?(parent)
                      @project.errors.add :parent_id, :invalid
                      return false
                    end
                  end
                  true
                end
              end

app/controllers/timelog_controller.rb +2 -2

              # Redmine - project management software
              # Copyright (C) 2006-2012  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              class TimelogController < ApplicationController
                menu_item :issues
                before_filter :find_project_for_new_time_entry, :only => [:create]
                before_filter :find_time_entry, :only => [:show, :edit, :update]
                before_filter :find_time_entries, :only => [:bulk_edit, :bulk_update, :destroy]
                before_filter :authorize, :except => [:new, :index, :report]
                before_filter :find_optional_project, :only => [:index, :report]
                before_filter :find_optional_project_for_new_time_entry, :only => [:new]
                before_filter :authorize_global, :only => [:new, :index, :report]
                accept_rss_auth :index
                accept_api_auth :index, :show, :create, :update, :destroy
                helper :sort
                include SortHelper
                helper :issues
                include TimelogHelper
                helper :custom_fields
                include CustomFieldsHelper
                def index
                  sort_init 'spent_on', 'desc'
                  sort_update 'spent_on' => ['spent_on', "#{TimeEntry.table_name}.created_on"],
                              'user' => 'user_id',
                              'activity' => 'activity_id',
                              'project' => "#{Project.table_name}.name",
                              'issue' => 'issue_id',
                              'hours' => 'hours'
                  retrieve_date_range
                  scope = TimeEntry.visible.spent_between(@from, @to)
                  if @issue
                    scope = scope.on_issue(@issue)
                  elsif @project
                    scope = scope.on_project(@project, Setting.display_subprojects_issues?)
                  end
                  respond_to do |format|
                    format.html {
                      # Paginate results
                      @entry_count = scope.count
                      @entry_pages = Paginator.new self, @entry_count, per_page_option, params['page']
                      @entries = scope.all(
                        :include => [:project, :activity, :user, {:issue => :tracker}],
                        :order => sort_clause,
                        :limit  =>  @entry_pages.items_per_page,
                        :offset =>  @entry_pages.current.offset
                      )
                      @total_hours = scope.sum(:hours).to_f
                      render :layout => !request.xhr?
                    }
                    format.api  {
                      @entry_count = scope.count
                      @offset, @limit = api_offset_and_limit
                      @entries = scope.all(
                        :include => [:project, :activity, :user, {:issue => :tracker}],
                        :order => sort_clause,
                        :limit  => @limit,
                        :offset => @offset
                      )
                    }
                    format.atom {
                      entries = scope.all(
                        :include => [:project, :activity, :user, {:issue => :tracker}],
                        :order => "#{TimeEntry.table_name}.created_on DESC",
                        :limit => Setting.feeds_limit.to_i
                      )
                      render_feed(entries, :title => l(:label_spent_time))
                    }
                    format.csv {
                      # Export all entries
                      @entries = scope.all(
                        :include => [:project, :activity, :user, {:issue => [:tracker, :assigned_to, :priority]}],
                        :order => sort_clause
                      )
                      send_data(entries_to_csv(@entries), :type => 'text/csv; header=present', :filename => 'timelog.csv')
                    }
                  end
                end
                def report
                  retrieve_date_range
                  @report = Redmine::Helpers::TimeReport.new(@project, @issue, params[:criteria], params[:columns], @from, @to)
                  respond_to do |format|
                    format.html { render :layout => !request.xhr? }
                    format.csv  { send_data(report_to_csv(@report), :type => 'text/csv; header=present', :filename => 'timelog.csv') }
                  end
                end
                def show
                  respond_to do |format|
                    # TODO: Implement html response
                    format.html { render :nothing => true, :status => 406 }
                    format.api
                  end
                end
                def new
                  @time_entry ||= TimeEntry.new(:project => @project, :issue => @issue, :user => User.current, :spent_on => User.current.today)
                  @time_entry.safe_attributes = params[:time_entry]
                end
                def create
                  @time_entry ||= TimeEntry.new(:project => @project, :issue => @issue, :user => User.current, :spent_on => User.current.today)
                  @time_entry.safe_attributes = params[:time_entry]
                  call_hook(:controller_timelog_edit_before_save, { :params => params, :time_entry => @time_entry })
                  if @time_entry.save
                    respond_to do |format|
                      format.html {
                        flash[:notice] = l(:notice_successful_create)
                        if params[:continue]
                          if params[:project_id]
                            redirect_to :action => 'new', :project_id => @time_entry.project, :issue_id => @time_entry.issue,
                              :time_entry => {:issue_id => @time_entry.issue_id, :activity_id => @time_entry.activity_id},
                              :back_url => params[:back_url]
                          else
                            redirect_to :action => 'new',
                              :time_entry => {:project_id => @time_entry.project_id, :issue_id => @time_entry.issue_id, :activity_id => @time_entry.activity_id},
                              :back_url => params[:back_url]
                          end
                        else
                          redirect_back_or_default :action => 'index', :project_id => @time_entry.project
                        end
                      }
                      format.api  { render :action => 'show', :status => :created, :location => time_entry_url(@time_entry) }
                    end
                  else
                    respond_to do |format|
                      format.html { render :action => 'new' }
                      format.api  { render_validation_errors(@time_entry) }
                    end
                  end
                end
                def edit
                  @time_entry.safe_attributes = params[:time_entry]
                end
                def update
                  @time_entry.safe_attributes = params[:time_entry]
                  call_hook(:controller_timelog_edit_before_save, { :params => params, :time_entry => @time_entry })
                  if @time_entry.save
                    respond_to do |format|
                      format.html {
                        flash[:notice] = l(:notice_successful_update)
                        redirect_back_or_default :action => 'index', :project_id => @time_entry.project
                      }
-                     format.api  { head :ok }
+                     format.api  { render_api_ok }
                    end
                  else
                    respond_to do |format|
                      format.html { render :action => 'edit' }
                      format.api  { render_validation_errors(@time_entry) }
                    end
                  end
                end
                def bulk_edit
                  @available_activities = TimeEntryActivity.shared.active
                  @custom_fields = TimeEntry.first.available_custom_fields
                end
                def bulk_update
                  attributes = parse_params_for_bulk_time_entry_attributes(params)
                  unsaved_time_entry_ids = []
                  @time_entries.each do |time_entry|
                    time_entry.reload
                    time_entry.safe_attributes = attributes
                    call_hook(:controller_time_entries_bulk_edit_before_save, { :params => params, :time_entry => time_entry })
                    unless time_entry.save
                      # Keep unsaved time_entry ids to display them in flash error
                      unsaved_time_entry_ids << time_entry.id
                    end
                  end
                  set_flash_from_bulk_time_entry_save(@time_entries, unsaved_time_entry_ids)
                  redirect_back_or_default({:controller => 'timelog', :action => 'index', :project_id => @projects.first})
                end
                def destroy
                  destroyed = TimeEntry.transaction do
                    @time_entries.each do |t|
                      unless t.destroy && t.destroyed?
                        raise ActiveRecord::Rollback
                      end
                    end
                  end
                  respond_to do |format|
                    format.html {
                      if destroyed
                        flash[:notice] = l(:notice_successful_delete)
                      else
                        flash[:error] = l(:notice_unable_delete_time_entry)
                      end
                      redirect_back_or_default(:action => 'index', :project_id => @projects.first)
                    }
                    format.api  {
                      if destroyed
-                       head :ok
+                       render_api_ok
                      else
                        render_validation_errors(@time_entries)
                      end
                    }
                  end
                end
              private
                def find_time_entry
                  @time_entry = TimeEntry.find(params[:id])
                  unless @time_entry.editable_by?(User.current)
                    render_403
                    return false
                  end
                  @project = @time_entry.project
                rescue ActiveRecord::RecordNotFound
                  render_404
                end
                def find_time_entries
                  @time_entries = TimeEntry.find_all_by_id(params[:id] || params[:ids])
                  raise ActiveRecord::RecordNotFound if @time_entries.empty?
                  @projects = @time_entries.collect(&:project).compact.uniq
                  @project = @projects.first if @projects.size == 1
                rescue ActiveRecord::RecordNotFound
                  render_404
                end
                def set_flash_from_bulk_time_entry_save(time_entries, unsaved_time_entry_ids)
                  if unsaved_time_entry_ids.empty?
                    flash[:notice] = l(:notice_successful_update) unless time_entries.empty?
                  else
                    flash[:error] = l(:notice_failed_to_save_time_entries,
                                      :count => unsaved_time_entry_ids.size,
                                      :total => time_entries.size,
                                      :ids => '#' + unsaved_time_entry_ids.join(', #'))
                  end
                end
                def find_optional_project_for_new_time_entry
                  if (project_id = (params[:project_id] || params[:time_entry] && params[:time_entry][:project_id])).present?
                    @project = Project.find(project_id)
                  end
                  if (issue_id = (params[:issue_id] || params[:time_entry] && params[:time_entry][:issue_id])).present?
                    @issue = Issue.find(issue_id)
                    @project ||= @issue.project
                  end
                rescue ActiveRecord::RecordNotFound
                  render_404
                end
                def find_project_for_new_time_entry
                  find_optional_project_for_new_time_entry
                  if @project.nil?
                    render_404
                  end
                end
                def find_optional_project
                  if !params[:issue_id].blank?
                    @issue = Issue.find(params[:issue_id])
                    @project = @issue.project
                  elsif !params[:project_id].blank?
                    @project = Project.find(params[:project_id])
                  end
                end
                # Retrieves the date range based on predefined ranges or specific from/to param dates
                def retrieve_date_range
                  @free_period = false
                  @from, @to = nil, nil
                  if params[:period_type] == '1' || (params[:period_type].nil? && !params[:period].nil?)
                    case params[:period].to_s
                    when 'today'
                      @from = @to = Date.today
                    when 'yesterday'
                      @from = @to = Date.today - 1
                    when 'current_week'
                      @from = Date.today - (Date.today.cwday - 1)%7
                      @to = @from + 6
                    when 'last_week'
                      @from = Date.today - 7 - (Date.today.cwday - 1)%7
                      @to = @from + 6
                    when '7_days'
                      @from = Date.today - 7
                      @to = Date.today
                    when 'current_month'
                      @from = Date.civil(Date.today.year, Date.today.month, 1)
                      @to = (@from >> 1) - 1
                    when 'last_month'
                      @from = Date.civil(Date.today.year, Date.today.month, 1) << 1
                      @to = (@from >> 1) - 1
                    when '30_days'
                      @from = Date.today - 30
                      @to = Date.today
                    when 'current_year'
                      @from = Date.civil(Date.today.year, 1, 1)
                      @to = Date.civil(Date.today.year, 12, 31)
                    end
                  elsif params[:period_type] == '2' || (params[:period_type].nil? && (!params[:from].nil? || !params[:to].nil?))
                    begin; @from = params[:from].to_s.to_date unless params[:from].blank?; rescue; end
                    begin; @to = params[:to].to_s.to_date unless params[:to].blank?; rescue; end
                    @free_period = true
                  else
                    # default
                  end
                  @from, @to = @to, @from if @from && @to && @from > @to
                end
                def parse_params_for_bulk_time_entry_attributes(params)
                  attributes = (params[:time_entry] || {}).reject {|k,v| v.blank?}
                  attributes.keys.each {|k| attributes[k] = '' if attributes[k] == 'none'}
                  attributes[:custom_field_values].reject! {|k,v| v.blank?} if attributes[:custom_field_values]
                  attributes
                end
              end

app/controllers/users_controller.rb +2 -2

              # Redmine - project management software
              # Copyright (C) 2006-2012  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              class UsersController < ApplicationController
                layout 'admin'
                before_filter :require_admin, :except => :show
                before_filter :find_user, :only => [:show, :edit, :update, :destroy, :edit_membership, :destroy_membership]
                accept_api_auth :index, :show, :create, :update, :destroy
                helper :sort
                include SortHelper
                helper :custom_fields
                include CustomFieldsHelper
                def index
                  sort_init 'login', 'asc'
                  sort_update %w(login firstname lastname mail admin created_on last_login_on)
                  case params[:format]
                  when 'xml', 'json'
                    @offset, @limit = api_offset_and_limit
                  else
                    @limit = per_page_option
                  end
                  @status = params[:status] || 1
                  scope = User.logged.status(@status)
                  scope = scope.like(params[:name]) if params[:name].present?
                  scope = scope.in_group(params[:group_id]) if params[:group_id].present?
                  @user_count = scope.count
                  @user_pages = Paginator.new self, @user_count, @limit, params['page']
                  @offset ||= @user_pages.current.offset
                  @users =  scope.find :all,
                                      :order => sort_clause,
                                      :limit  =>  @limit,
                                      :offset =>  @offset
                  respond_to do |format|
                    format.html {
                      @groups = Group.all.sort
                      render :layout => !request.xhr?
                    }
                    format.api
                  end
                end
                def show
                  # show projects based on current user visibility
                  @memberships = @user.memberships.all(:conditions => Project.visible_condition(User.current))
                  events = Redmine::Activity::Fetcher.new(User.current, :author => @user).events(nil, nil, :limit => 10)
                  @events_by_day = events.group_by(&:event_date)
                  unless User.current.admin?
                    if !@user.active? || (@user != User.current  && @memberships.empty? && events.empty?)
                      render_404
                      return
                    end
                  end
                  respond_to do |format|
                    format.html { render :layout => 'base' }
                    format.api
                  end
                end
                def new
                  @user = User.new(:language => Setting.default_language, :mail_notification => Setting.default_notification_option)
                  @auth_sources = AuthSource.find(:all)
                end
                def create
                  @user = User.new(:language => Setting.default_language, :mail_notification => Setting.default_notification_option)
                  @user.safe_attributes = params[:user]
                  @user.admin = params[:user][:admin] || false
                  @user.login = params[:user][:login]
                  @user.password, @user.password_confirmation = params[:user][:password], params[:user][:password_confirmation] unless @user.auth_source_id
                  if @user.save
                    @user.pref.attributes = params[:pref]
                    @user.pref[:no_self_notified] = (params[:no_self_notified] == '1')
                    @user.pref.save
                    @user.notified_project_ids = (@user.mail_notification == 'selected' ? params[:notified_project_ids] : [])
                    Mailer.account_information(@user, params[:user][:password]).deliver if params[:send_information]
                    respond_to do |format|
                      format.html {
                        flash[:notice] = l(:notice_user_successful_create, :id => view_context.link_to(@user.login, user_path(@user)))
                        redirect_to(params[:continue] ?
                          {:controller => 'users', :action => 'new'} :
                          {:controller => 'users', :action => 'edit', :id => @user}
                        )
                      }
                      format.api  { render :action => 'show', :status => :created, :location => user_url(@user) }
                    end
                  else
                    @auth_sources = AuthSource.find(:all)
                    # Clear password input
                    @user.password = @user.password_confirmation = nil
                    respond_to do |format|
                      format.html { render :action => 'new' }
                      format.api  { render_validation_errors(@user) }
                    end
                  end
                end
                def edit
                  @auth_sources = AuthSource.find(:all)
                  @membership ||= Member.new
                end
                def update
                  @user.admin = params[:user][:admin] if params[:user][:admin]
                  @user.login = params[:user][:login] if params[:user][:login]
                  if params[:user][:password].present? && (@user.auth_source_id.nil? || params[:user][:auth_source_id].blank?)
                    @user.password, @user.password_confirmation = params[:user][:password], params[:user][:password_confirmation]
                  end
                  @user.safe_attributes = params[:user]
                  # Was the account actived ? (do it before User#save clears the change)
                  was_activated = (@user.status_change == [User::STATUS_REGISTERED, User::STATUS_ACTIVE])
                  # TODO: Similar to My#account
                  @user.pref.attributes = params[:pref]
                  @user.pref[:no_self_notified] = (params[:no_self_notified] == '1')
                  if @user.save
                    @user.pref.save
                    @user.notified_project_ids = (@user.mail_notification == 'selected' ? params[:notified_project_ids] : [])
                    if was_activated
                      Mailer.account_activated(@user).deliver
                    elsif @user.active? && params[:send_information] && !params[:user][:password].blank? && @user.auth_source_id.nil?
                      Mailer.account_information(@user, params[:user][:password]).deliver
                    end
                    respond_to do |format|
                      format.html {
                        flash[:notice] = l(:notice_successful_update)
                        redirect_to_referer_or edit_user_path(@user)
                      }
-                     format.api  { head :ok }
+                     format.api  { render_api_ok }
                    end
                  else
                    @auth_sources = AuthSource.find(:all)
                    @membership ||= Member.new
                    # Clear password input
                    @user.password = @user.password_confirmation = nil
                    respond_to do |format|
                      format.html { render :action => :edit }
                      format.api  { render_validation_errors(@user) }
                    end
                  end
                end
                def destroy
                  @user.destroy
                  respond_to do |format|
                    format.html { redirect_to_referer_or(users_url) }
-                   format.api  { head :ok }
+                   format.api  { render_api_ok }
                  end
                end
                def edit_membership
                  @membership = Member.edit_membership(params[:membership_id], params[:membership], @user)
                  @membership.save
                  respond_to do |format|
                    if @membership.valid?
                      format.html { redirect_to :controller => 'users', :action => 'edit', :id => @user, :tab => 'memberships' }
                      format.js {
                        render(:update) {|page|
                          page.replace_html "tab-content-memberships", :partial => 'users/memberships'
                          page.visual_effect(:highlight, "member-#{@membership.id}")
                        }
                      }
                    else
                      format.js {
                        render(:update) {|page|
                          page.alert(l(:notice_failed_to_save_members, :errors => @membership.errors.full_messages.join(', ')))
                        }
                      }
                    end
                  end
                end
                def destroy_membership
                  @membership = Member.find(params[:membership_id])
                  if @membership.deletable?
                    @membership.destroy
                  end
                  respond_to do |format|
                    format.html { redirect_to :controller => 'users', :action => 'edit', :id => @user, :tab => 'memberships' }
                    format.js { render(:update) {|page| page.replace_html "tab-content-memberships", :partial => 'users/memberships'} }
                  end
                end
                private
                def find_user
                  if params[:id] == 'current'
                    require_login || return
                    @user = User.current
                  else
                    @user = User.find(params[:id])
                  end
                rescue ActiveRecord::RecordNotFound
                  render_404
                end
              end

app/controllers/versions_controller.rb +2 -2

              # Redmine - project management software
              # Copyright (C) 2006-2012  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              class VersionsController < ApplicationController
                menu_item :roadmap
                model_object Version
                before_filter :find_model_object, :except => [:index, :new, :create, :close_completed]
                before_filter :find_project_from_association, :except => [:index, :new, :create, :close_completed]
                before_filter :find_project, :only => [:index, :new, :create, :close_completed]
                before_filter :authorize
                accept_api_auth :index, :show, :create, :update, :destroy
                helper :custom_fields
                helper :projects
                def index
                  respond_to do |format|
                    format.html {
                      @trackers = @project.trackers.find(:all, :order => 'position')
                      retrieve_selected_tracker_ids(@trackers, @trackers.select {|t| t.is_in_roadmap?})
                      @with_subprojects = params[:with_subprojects].nil? ? Setting.display_subprojects_issues? : (params[:with_subprojects] == '1')
                      project_ids = @with_subprojects ? @project.self_and_descendants.collect(&:id) : [@project.id]
                      @versions = @project.shared_versions || []
                      @versions += @project.rolled_up_versions.visible if @with_subprojects
                      @versions = @versions.uniq.sort
                      unless params[:completed]
                        @completed_versions = @versions.select {|version| version.closed? || version.completed? }
                        @versions -= @completed_versions
                      end
                      @issues_by_version = {}
                      if @selected_tracker_ids.any? && @versions.any?
                        issues = Issue.visible.all(
                          :include => [:project, :status, :tracker, :priority, :fixed_version],
                          :conditions => {:tracker_id => @selected_tracker_ids, :project_id => project_ids, :fixed_version_id => @versions.map(&:id)},
                          :order => "#{Project.table_name}.lft, #{Tracker.table_name}.position, #{Issue.table_name}.id"
                        )
                        @issues_by_version = issues.group_by(&:fixed_version)
                      end
                      @versions.reject! {|version| !project_ids.include?(version.project_id) && @issues_by_version[version].blank?}
                    }
                    format.api {
                      @versions = @project.shared_versions.all
                    }
                  end
                end
                def show
                  respond_to do |format|
                    format.html {
                      @issues = @version.fixed_issues.visible.find(:all,
                        :include => [:status, :tracker, :priority],
                        :order => "#{Tracker.table_name}.position, #{Issue.table_name}.id")
                    }
                    format.api
                  end
                end
                def new
                  @version = @project.versions.build
                  @version.safe_attributes = params[:version]
                  respond_to do |format|
                    format.html
                    format.js do
                      render :update do |page|
                        page.replace_html 'ajax-modal', :partial => 'versions/new_modal'
                        page << "showModal('ajax-modal', '600px');"
                        page << "Form.Element.focus('version_name');"
                      end
                    end
                  end
                end
                def create
                  @version = @project.versions.build
                  if params[:version]
                    attributes = params[:version].dup
                    attributes.delete('sharing') unless attributes.nil? || @version.allowed_sharings.include?(attributes['sharing'])
                    @version.safe_attributes = attributes
                  end
                  if request.post?
                    if @version.save
                      respond_to do |format|
                        format.html do
                          flash[:notice] = l(:notice_successful_create)
                          redirect_back_or_default :controller => 'projects', :action => 'settings', :tab => 'versions', :id => @project
                        end
                        format.js do
                          render(:update) {|page|
                            page << 'hideModal();'
                            # IE doesn't support the replace_html rjs method for select box options
                            page.replace "issue_fixed_version_id",
                              content_tag('select', content_tag('option') + version_options_for_select(@project.shared_versions.open, @version), :id => 'issue_fixed_version_id', :name => 'issue[fixed_version_id]')
                          }
                        end
                        format.api do
                          render :action => 'show', :status => :created, :location => version_url(@version)
                        end
                      end
                    else
                      respond_to do |format|
                        format.html { render :action => 'new' }
                        format.js do
                          render :update do |page|
                            page.replace_html 'ajax-modal', :partial => 'versions/new_modal'
                            page << "Form.Element.focus('version_name');"
                          end
                        end
                        format.api  { render_validation_errors(@version) }
                      end
                    end
                  end
                end
                def edit
                end
                def update
                  if request.put? && params[:version]
                    attributes = params[:version].dup
                    attributes.delete('sharing') unless @version.allowed_sharings.include?(attributes['sharing'])
                    @version.safe_attributes = attributes
                    if @version.save
                      respond_to do |format|
                        format.html {
                          flash[:notice] = l(:notice_successful_update)
                          redirect_back_or_default :controller => 'projects', :action => 'settings', :tab => 'versions', :id => @project
                        }
-                       format.api  { head :ok }
+                       format.api  { render_api_ok }
                      end
                    else
                      respond_to do |format|
                        format.html { render :action => 'edit' }
                        format.api  { render_validation_errors(@version) }
                      end
                    end
                  end
                end
                def close_completed
                  if request.put?
                    @project.close_completed_versions
                  end
                  redirect_to :controller => 'projects', :action => 'settings', :tab => 'versions', :id => @project
                end
                def destroy
                  if @version.fixed_issues.empty?
                    @version.destroy
                    respond_to do |format|
                      format.html { redirect_back_or_default :controller => 'projects', :action => 'settings', :tab => 'versions', :id => @project }
-                     format.api  { head :ok }
+                     format.api  { render_api_ok }
                    end
                  else
                    respond_to do |format|
                      format.html {
                        flash[:error] = l(:notice_unable_delete_version)
                        redirect_to :controller => 'projects', :action => 'settings', :tab => 'versions', :id => @project
                      }
                      format.api  { head :unprocessable_entity }
                    end
                  end
                end
                def status_by
                  respond_to do |format|
                    format.html { render :action => 'show' }
                    format.js { render(:update) {|page| page.replace_html 'status_by', render_issue_status_by(@version, params[:status_by])} }
                  end
                end
              private
                def find_project
                  @project = Project.find(params[:project_id])
                rescue ActiveRecord::RecordNotFound
                  render_404
                end
                def retrieve_selected_tracker_ids(selectable_trackers, default_trackers=nil)
                  if ids = params[:tracker_ids]
                    @selected_tracker_ids = (ids.is_a? Array) ? ids.collect { |id| id.to_i.to_s } : ids.split('/').collect { |id| id.to_i.to_s }
                  else
                    @selected_tracker_ids = (default_trackers || selectable_trackers).collect {|t| t.id.to_s }
                  end
                end
              end

test/integration/api_test/groups_test.rb +4 0

              # Redmine - project management software
              # Copyright (C) 2006-2012  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              require File.expand_path('../../../test_helper', __FILE__)
              class ApiTest::GroupsTest < ActionController::IntegrationTest
                fixtures :users, :groups_users
                def setup
                  Setting.rest_api_enabled = '1'
                end
                context "GET /groups" do
                  context ".xml" do
                    should "require authentication" do
                      get '/groups.xml'
                      assert_response 401
                    end
                    should "return groups" do
                      get '/groups.xml', {}, credentials('admin')
                      assert_response :success
                      assert_equal 'application/xml', response.content_type
                      assert_select 'groups' do
                        assert_select 'group' do
                          assert_select 'name', :text => 'A Team'
                          assert_select 'id', :text => '10'
                        end
                      end
                    end
                  end
                  context ".json" do
                    should "require authentication" do
                      get '/groups.json'
                      assert_response 401
                    end
                    should "return groups" do
                      get '/groups.json', {}, credentials('admin')
                      assert_response :success
                      assert_equal 'application/json', response.content_type
                      json = MultiJson.load(response.body)
                      groups = json['groups']
                      assert_kind_of Array, groups
                      group = groups.detect {|g| g['name'] == 'A Team'}
                      assert_not_nil group
                      assert_equal({'id' => 10, 'name' => 'A Team'}, group)
                    end
                  end
                end
                context "GET /groups/:id" do
                  context ".xml" do
                    should "return the group with its users" do
                      get '/groups/10.xml', {}, credentials('admin')
                      assert_response :success
                      assert_equal 'application/xml', response.content_type
                      assert_select 'group' do
                        assert_select 'name', :text => 'A Team'
                        assert_select 'id', :text => '10'
                      end
                    end
                    should "include users if requested" do
                      get '/groups/10.xml?include=users', {}, credentials('admin')
                      assert_response :success
                      assert_equal 'application/xml', response.content_type
                      assert_select 'group' do
                        assert_select 'users' do
                          assert_select 'user', Group.find(10).users.count
                          assert_select 'user[id=8]'
                        end
                      end
                    end
                    should "include memberships if requested" do
                      get '/groups/10.xml?include=memberships', {}, credentials('admin')
                      assert_response :success
                      assert_equal 'application/xml', response.content_type
                      assert_select 'group' do
                        assert_select 'memberships'
                      end
                    end
                  end
                end
                context "POST /groups" do
                  context "with valid parameters" do
                    context ".xml" do
                      should "create groups" do
                        assert_difference('Group.count') do
                          post '/groups.xml', {:group => {:name => 'Test', :user_ids => [2, 3]}}, credentials('admin')
                          assert_response :created
                          assert_equal 'application/xml', response.content_type
                        end
                        group = Group.order('id DESC').first
                        assert_equal 'Test', group.name
                        assert_equal [2, 3], group.users.map(&:id).sort
                        assert_select 'group' do
                          assert_select 'name', :text => 'Test'
                        end
                      end
                    end
                  end
                  context "with invalid parameters" do
                    context ".xml" do
                      should "return errors" do
                        assert_no_difference('Group.count') do
                          post '/groups.xml', {:group => {:name => ''}}, credentials('admin')
                        end
                        assert_response :unprocessable_entity
                        assert_equal 'application/xml', response.content_type
                        assert_select 'errors' do
                          assert_select 'error', :text => /Name can't be blank/
                        end
                      end
                    end
                  end
                end
                context "PUT /groups/:id" do
                  context "with valid parameters" do
                    context ".xml" do
                      should "update the group" do
                        put '/groups/10.xml', {:group => {:name => 'New name', :user_ids => [2, 3]}}, credentials('admin')
                        assert_response :ok
+                       assert_equal '', @response.body
                        group = Group.find(10)
                        assert_equal 'New name', group.name
                        assert_equal [2, 3], group.users.map(&:id).sort
                      end
                    end
                  end
                  context "with invalid parameters" do
                    context ".xml" do
                      should "return errors" do
                        put '/groups/10.xml', {:group => {:name => ''}}, credentials('admin')
                        assert_response :unprocessable_entity
                        assert_equal 'application/xml', response.content_type
                        assert_select 'errors' do
                          assert_select 'error', :text => /Name can't be blank/
                        end
                      end
                    end
                  end
                end
                context "DELETE /groups/:id" do
                  context ".xml" do
                    should "delete the group" do
                      assert_difference 'Group.count', -1 do
                        delete '/groups/10.xml', {}, credentials('admin')
                        assert_response :ok
+                       assert_equal '', @response.body
                      end
                    end
                  end
                end
                context "POST /groups/:id/users" do
                  context ".xml" do
                    should "add user to the group" do
                      assert_difference 'Group.find(10).users.count' do
                        post '/groups/10/users.xml', {:user_id => 5}, credentials('admin')
                        assert_response :ok
+                       assert_equal '', @response.body
                      end
                      assert_include User.find(5), Group.find(10).users
                    end
                  end
                end
                context "DELETE /groups/:id/users/:user_id" do
                  context ".xml" do
                    should "remove user from the group" do
                      assert_difference 'Group.find(10).users.count', -1 do
                        delete '/groups/10/users/8.xml', {}, credentials('admin')
                        assert_response :ok
+                       assert_equal '', @response.body
                      end
                      assert_not_include User.find(8), Group.find(10).users
                    end
                  end
                end
              end

test/integration/api_test/issue_categories_test.rb +3 0

              # Redmine - project management software
              # Copyright (C) 2006-2012  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              require File.expand_path('../../../test_helper', __FILE__)
              class ApiTest::IssueCategoriesTest < ActionController::IntegrationTest
                fixtures :projects, :users, :issue_categories, :issues,
                         :roles,
                         :member_roles,
                         :members,
                         :enabled_modules
                def setup
                  Setting.rest_api_enabled = '1'
                end
                context "GET /projects/:project_id/issue_categories.xml" do
                  should "return issue categories" do
                    get '/projects/1/issue_categories.xml', {}, credentials('jsmith')
                    assert_response :success
                    assert_equal 'application/xml', @response.content_type
                    assert_tag :tag => 'issue_categories',
                      :child => {:tag => 'issue_category', :child => {:tag => 'id', :content => '2'}}
                  end
                end
                context "GET /issue_categories/2.xml" do
                  should "return requested issue category" do
                    get '/issue_categories/2.xml', {}, credentials('jsmith')
                    assert_response :success
                    assert_equal 'application/xml', @response.content_type
                    assert_tag :tag => 'issue_category',
                      :child => {:tag => 'id', :content => '2'}
                  end
                end
                context "POST /projects/:project_id/issue_categories.xml" do
                  should "return create issue category" do
                    assert_difference 'IssueCategory.count' do
                      post '/projects/1/issue_categories.xml', {:issue_category => {:name => 'API'}}, credentials('jsmith')
                    end
                    assert_response :created
                    assert_equal 'application/xml', @response.content_type
                    category = IssueCategory.first(:order => 'id DESC')
                    assert_equal 'API', category.name
                    assert_equal 1, category.project_id
                  end
                  context "with invalid parameters" do
                    should "return errors" do
                      assert_no_difference 'IssueCategory.count' do
                        post '/projects/1/issue_categories.xml', {:issue_category => {:name => ''}}, credentials('jsmith')
                      end
                      assert_response :unprocessable_entity
                      assert_equal 'application/xml', @response.content_type
                      assert_tag 'errors', :child => {:tag => 'error', :content => "Name can't be blank"}
                    end
                  end
                end
                context "PUT /issue_categories/2.xml" do
                  context "with valid parameters" do
                    should "update issue category" do
                      assert_no_difference 'IssueCategory.count' do
                        put '/issue_categories/2.xml', {:issue_category => {:name => 'API Update'}}, credentials('jsmith')
                      end
                      assert_response :ok
+                     assert_equal '', @response.body
                      assert_equal 'API Update', IssueCategory.find(2).name
                    end
                  end
                  context "with invalid parameters" do
                    should "return errors" do
                      assert_no_difference 'IssueCategory.count' do
                        put '/issue_categories/2.xml', {:issue_category => {:name => ''}}, credentials('jsmith')
                      end
                      assert_response :unprocessable_entity
                      assert_equal 'application/xml', @response.content_type
                      assert_tag 'errors', :child => {:tag => 'error', :content => "Name can't be blank"}
                    end
                  end
                end
                context "DELETE /issue_categories/1.xml" do
                  should "destroy issue categories" do
                    assert_difference 'IssueCategory.count', -1 do
                      delete '/issue_categories/1.xml', {}, credentials('jsmith')
                    end
                    assert_response :ok
+                   assert_equal '', @response.body
                    assert_nil IssueCategory.find_by_id(1)
                  end
                  should "reassign issues with :reassign_to_id param" do
                    issue_count = Issue.count(:conditions => {:category_id => 1})
                    assert issue_count > 0
                    assert_difference 'IssueCategory.count', -1 do
                      assert_difference 'Issue.count(:conditions => {:category_id => 2})', 3 do
                        delete '/issue_categories/1.xml', {:reassign_to_id => 2}, credentials('jsmith')
                      end
                    end
                    assert_response :ok
+                   assert_equal '', @response.body
                    assert_nil IssueCategory.find_by_id(1)
                  end
                end
              end

test/integration/api_test/issue_relations_test.rb +1 0

              # Redmine - project management software
              # Copyright (C) 2006-2012  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              require File.expand_path('../../../test_helper', __FILE__)
              class ApiTest::IssueRelationsTest < ActionController::IntegrationTest
                fixtures :projects, :trackers, :issue_statuses, :issues,
                         :enumerations, :users, :issue_categories,
                         :projects_trackers,
                         :roles,
                         :member_roles,
                         :members,
                         :enabled_modules,
                         :workflows,
                         :issue_relations
                def setup
                  Setting.rest_api_enabled = '1'
                end
                context "/issues/:issue_id/relations" do
                  context "GET" do
                    should "return issue relations" do
                      get '/issues/9/relations.xml', {}, credentials('jsmith')
                      assert_response :success
                      assert_equal 'application/xml', @response.content_type
                      assert_tag :tag => 'relations',
                        :attributes => { :type => 'array' },
                        :child => {
                          :tag => 'relation',
                          :child => {
                            :tag => 'id',
                            :content => '1'
                          }
                        }
                    end
                  end
                  context "POST" do
                    should "create a relation" do
                      assert_difference('IssueRelation.count') do
                        post '/issues/2/relations.xml', {:relation => {:issue_to_id => 7, :relation_type => 'relates'}}, credentials('jsmith')
                      end
                      relation = IssueRelation.first(:order => 'id DESC')
                      assert_equal 2, relation.issue_from_id
                      assert_equal 7, relation.issue_to_id
                      assert_equal 'relates', relation.relation_type
                      assert_response :created
                      assert_equal 'application/xml', @response.content_type
                      assert_tag 'relation', :child => {:tag => 'id', :content => relation.id.to_s}
                    end
                    context "with failure" do
                      should "return the errors" do
                        assert_no_difference('IssueRelation.count') do
                          post '/issues/2/relations.xml', {:relation => {:issue_to_id => 7, :relation_type => 'foo'}}, credentials('jsmith')
                        end
                        assert_response :unprocessable_entity
                        assert_tag :errors, :child => {:tag => 'error', :content => /relation_type is not included in the list/}
                      end
                    end
                  end
                end
                context "/relations/:id" do
                  context "GET" do
                    should "return the relation" do
                      get '/relations/2.xml', {}, credentials('jsmith')
                      assert_response :success
                      assert_equal 'application/xml', @response.content_type
                      assert_tag 'relation', :child => {:tag => 'id', :content => '2'}
                    end
                  end
                  context "DELETE" do
                    should "delete the relation" do
                      assert_difference('IssueRelation.count', -1) do
                        delete '/relations/2.xml', {}, credentials('jsmith')
                      end
                      assert_response :ok
+                     assert_equal '', @response.body
                      assert_nil IssueRelation.find_by_id(2)
                    end
                  end
                end
              end

test/integration/api_test/issues_test.rb +1 0

              # Redmine - project management software
              # Copyright (C) 2006-2012  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              require File.expand_path('../../../test_helper', __FILE__)
              class ApiTest::IssuesTest < ActionController::IntegrationTest
                fixtures :projects,
                  :users,
                  :roles,
                  :members,
                  :member_roles,
                  :issues,
                  :issue_statuses,
                  :versions,
                  :trackers,
                  :projects_trackers,
                  :issue_categories,
                  :enabled_modules,
                  :enumerations,
                  :attachments,
                  :workflows,
                  :custom_fields,
                  :custom_values,
                  :custom_fields_projects,
                  :custom_fields_trackers,
                  :time_entries,
                  :journals,
                  :journal_details,
                  :queries,
                  :attachments
                def setup
                  Setting.rest_api_enabled = '1'
                end
                context "/issues" do
                  # Use a private project to make sure auth is really working and not just
                  # only showing public issues.
                  should_allow_api_authentication(:get, "/projects/private-child/issues.xml")
                  should "contain metadata" do
                    get '/issues.xml'
                    assert_tag :tag => 'issues',
                      :attributes => {
                        :type => 'array',
                        :total_count => assigns(:issue_count),
                        :limit => 25,
                        :offset => 0
                      }
                  end
                  context "with offset and limit" do
                    should "use the params" do
                      get '/issues.xml?offset=2&limit=3'
                      assert_equal 3, assigns(:limit)
                      assert_equal 2, assigns(:offset)
                      assert_tag :tag => 'issues', :children => {:count => 3, :only => {:tag => 'issue'}}
                    end
                  end
                  context "with nometa param" do
                    should "not contain metadata" do
                      get '/issues.xml?nometa=1'
                      assert_tag :tag => 'issues',
                        :attributes => {
                          :type => 'array',
                          :total_count => nil,
                          :limit => nil,
                          :offset => nil
                        }
                    end
                  end
                  context "with nometa header" do
                    should "not contain metadata" do
                      get '/issues.xml', {}, {'X-Redmine-Nometa' => '1'}
                      assert_tag :tag => 'issues',
                        :attributes => {
                          :type => 'array',
                          :total_count => nil,
                          :limit => nil,
                          :offset => nil
                        }
                    end
                  end
                  context "with relations" do
                    should "display relations" do
                      get '/issues.xml?include=relations'
                      assert_response :success
                      assert_equal 'application/xml', @response.content_type
                      assert_tag 'relations',
                        :parent => {:tag => 'issue', :child => {:tag => 'id', :content => '3'}},
                        :children => {:count => 1},
                        :child => {
                          :tag => 'relation',
                          :attributes => {:id => '2', :issue_id => '2', :issue_to_id => '3', :relation_type => 'relates'}
                        }
                      assert_tag 'relations',
                        :parent => {:tag => 'issue', :child => {:tag => 'id', :content => '1'}},
                        :children => {:count => 0}
                    end
                  end
                  context "with invalid query params" do
                    should "return errors" do
                      get '/issues.xml', {:f => ['start_date'], :op => {:start_date => '='}}
                      assert_response :unprocessable_entity
                      assert_equal 'application/xml', @response.content_type
                      assert_tag 'errors', :child => {:tag => 'error', :content => "Start date can't be blank"}
                    end
                  end
                  context "with custom field filter" do
                    should "show only issues with the custom field value" do
                      get '/issues.xml', { :set_filter => 1, :f => ['cf_1'], :op => {:cf_1 => '='}, :v => {:cf_1 => ['MySQL']}}
                      expected_ids = Issue.visible.all(
                          :include => :custom_values,
                          :conditions => {:custom_values => {:custom_field_id => 1, :value => 'MySQL'}}).map(&:id)
                      assert_select 'issues > issue > id', :count => expected_ids.count do |ids|
                         ids.each { |id| assert expected_ids.delete(id.children.first.content.to_i) }
                      end
                    end
                  end
                  context "with custom field filter (shorthand method)" do
                    should "show only issues with the custom field value" do
                      get '/issues.xml', { :cf_1 => 'MySQL' }
                      expected_ids = Issue.visible.all(
                          :include => :custom_values,
                          :conditions => {:custom_values => {:custom_field_id => 1, :value => 'MySQL'}}).map(&:id)
                      assert_select 'issues > issue > id', :count => expected_ids.count do |ids|
                        ids.each { |id| assert expected_ids.delete(id.children.first.content.to_i) }
                      end
                    end
                  end
                end
                context "/index.json" do
                  should_allow_api_authentication(:get, "/projects/private-child/issues.json")
                end
                context "/index.xml with filter" do
                  should "show only issues with the status_id" do
                    get '/issues.xml?status_id=5'
                    expected_ids = Issue.visible.all(:conditions => {:status_id => 5}).map(&:id)
                    assert_select 'issues > issue > id', :count => expected_ids.count do |ids|
                       ids.each { |id| assert expected_ids.delete(id.children.first.content.to_i) }
                    end
                  end
                end
                context "/index.json with filter" do
                  should "show only issues with the status_id" do
                    get '/issues.json?status_id=5'
                    json = ActiveSupport::JSON.decode(response.body)
                    status_ids_used = json['issues'].collect {|j| j['status']['id'] }
                    assert_equal 3, status_ids_used.length
                    assert status_ids_used.all? {|id| id == 5 }
                  end
                end
                # Issue 6 is on a private project
                context "/issues/6.xml" do
                  should_allow_api_authentication(:get, "/issues/6.xml")
                end
                context "/issues/6.json" do
                  should_allow_api_authentication(:get, "/issues/6.json")
                end
                context "GET /issues/:id" do
                  context "with journals" do
                    context ".xml" do
                      should "display journals" do
                        get '/issues/1.xml?include=journals'
                        assert_tag :tag => 'issue',
                          :child => {
                            :tag => 'journals',
                            :attributes => { :type => 'array' },
                            :child => {
                              :tag => 'journal',
                              :attributes => { :id => '1'},
                              :child => {
                                :tag => 'details',
                                :attributes => { :type => 'array' },
                                :child => {
                                  :tag => 'detail',
                                  :attributes => { :name => 'status_id' },
                                  :child => {
                                    :tag => 'old_value',
                                    :content => '1',
                                    :sibling => {
                                      :tag => 'new_value',
                                      :content => '2'
                                    }
                                  }
                                }
                              }
                            }
                          }
                      end
                    end
                  end
                  context "with custom fields" do
                    context ".xml" do
                      should "display custom fields" do
                        get '/issues/3.xml'
                        assert_tag :tag => 'issue',
                          :child => {
                            :tag => 'custom_fields',
                            :attributes => { :type => 'array' },
                            :child => {
                              :tag => 'custom_field',
                              :attributes => { :id => '1'},
                              :child => {
                                :tag => 'value',
                                :content => 'MySQL'
                              }
                            }
                          }
                        assert_nothing_raised do
                          Hash.from_xml(response.body).to_xml
                        end
                      end
                    end
                  end
                  context "with multi custom fields" do
                    setup do
                      field = CustomField.find(1)
                      field.update_attribute :multiple, true
                      issue = Issue.find(3)
                      issue.custom_field_values = {1 => ['MySQL', 'Oracle']}
                      issue.save!
                    end
                    context ".xml" do
                      should "display custom fields" do
                        get '/issues/3.xml'
                        assert_response :success
                        assert_tag :tag => 'issue',
                          :child => {
                            :tag => 'custom_fields',
                            :attributes => { :type => 'array' },
                            :child => {
                              :tag => 'custom_field',
                              :attributes => { :id => '1'},
                              :child => {
                                :tag => 'value',
                                :attributes => { :type => 'array' },
                                :children => { :count => 2 }
                              }
                            }
                          }
                        xml = Hash.from_xml(response.body)
                        custom_fields = xml['issue']['custom_fields']
                        assert_kind_of Array, custom_fields
                        field = custom_fields.detect {|f| f['id'] == '1'}
                        assert_kind_of Hash, field
                        assert_equal ['MySQL', 'Oracle'], field['value'].sort
                      end
                    end
                    context ".json" do
                      should "display custom fields" do
                        get '/issues/3.json'
                        assert_response :success
                        json = ActiveSupport::JSON.decode(response.body)
                        custom_fields = json['issue']['custom_fields']
                        assert_kind_of Array, custom_fields
                        field = custom_fields.detect {|f| f['id'] == 1}
                        assert_kind_of Hash, field
                        assert_equal ['MySQL', 'Oracle'], field['value'].sort
                      end
                    end
                  end
                  context "with empty value for multi custom field" do
                    setup do
                      field = CustomField.find(1)
                      field.update_attribute :multiple, true
                      issue = Issue.find(3)
                      issue.custom_field_values = {1 => ['']}
                      issue.save!
                    end
                    context ".xml" do
                      should "display custom fields" do
                        get '/issues/3.xml'
                        assert_response :success
                        assert_tag :tag => 'issue',
                          :child => {
                            :tag => 'custom_fields',
                            :attributes => { :type => 'array' },
                            :child => {
                              :tag => 'custom_field',
                              :attributes => { :id => '1'},
                              :child => {
                                :tag => 'value',
                                :attributes => { :type => 'array' },
                                :children => { :count => 0 }
                              }
                            }
                          }
                        xml = Hash.from_xml(response.body)
                        custom_fields = xml['issue']['custom_fields']
                        assert_kind_of Array, custom_fields
                        field = custom_fields.detect {|f| f['id'] == '1'}
                        assert_kind_of Hash, field
                        assert_equal [], field['value']
                      end
                    end
                    context ".json" do
                      should "display custom fields" do
                        get '/issues/3.json'
                        assert_response :success
                        json = ActiveSupport::JSON.decode(response.body)
                        custom_fields = json['issue']['custom_fields']
                        assert_kind_of Array, custom_fields
                        field = custom_fields.detect {|f| f['id'] == 1}
                        assert_kind_of Hash, field
                        assert_equal [], field['value'].sort
                      end
                    end
                  end
                  context "with attachments" do
                    context ".xml" do
                      should "display attachments" do
                        get '/issues/3.xml?include=attachments'
                        assert_tag :tag => 'issue',
                          :child => {
                            :tag => 'attachments',
                            :children => {:count => 5},
                            :child => {
                              :tag => 'attachment',
                              :child => {
                                :tag => 'filename',
                                :content => 'source.rb',
                                :sibling => {
                                  :tag => 'content_url',
                                  :content => 'http://www.example.com/attachments/download/4/source.rb'
                                }
                              }
                            }
                          }
                      end
                    end
                  end
                  context "with subtasks" do
                    setup do
                      @c1 = Issue.create!(:status_id => 1, :subject => "child c1", :tracker_id => 1, :project_id => 1, :author_id => 1, :parent_issue_id => 1)
                      @c2 = Issue.create!(:status_id => 1, :subject => "child c2", :tracker_id => 1, :project_id => 1, :author_id => 1, :parent_issue_id => 1)
                      @c3 = Issue.create!(:status_id => 1, :subject => "child c3", :tracker_id => 1, :project_id => 1, :author_id => 1, :parent_issue_id => @c1.id)
                    end
                    context ".xml" do
                      should "display children" do
                        get '/issues/1.xml?include=children'
                        assert_tag :tag => 'issue',
                          :child => {
                            :tag => 'children',
                            :children => {:count => 2},
                            :child => {
                              :tag => 'issue',
                              :attributes => {:id => @c1.id.to_s},
                              :child => {
                                :tag => 'subject',
                                :content => 'child c1',
                                :sibling => {
                                  :tag => 'children',
                                  :children => {:count => 1},
                                  :child => {
                                    :tag => 'issue',
                                    :attributes => {:id => @c3.id.to_s}
                                  }
                                }
                              }
                            }
                          }
                      end
                      context ".json" do
                        should "display children" do
                          get '/issues/1.json?include=children'
                          json = ActiveSupport::JSON.decode(response.body)
                          assert_equal([
                            {
                              'id' => @c1.id, 'subject' => 'child c1', 'tracker' => {'id' => 1, 'name' => 'Bug'},
                              'children' => [{ 'id' => @c3.id, 'subject' => 'child c3', 'tracker' => {'id' => 1, 'name' => 'Bug'} }]
                            },
                            { 'id' => @c2.id, 'subject' => 'child c2', 'tracker' => {'id' => 1, 'name' => 'Bug'} }
                            ],
                            json['issue']['children'])
                        end
                      end
                    end
                  end
                end
                context "POST /issues.xml" do
                  should_allow_api_authentication(:post,
                                                  '/issues.xml',
                                                  {:issue => {:project_id => 1, :subject => 'API test', :tracker_id => 2, :status_id => 3}},
                                                  {:success_code => :created})
                  should "create an issue with the attributes" do
                    assert_difference('Issue.count') do
                      post '/issues.xml', {:issue => {:project_id => 1, :subject => 'API test', :tracker_id => 2, :status_id => 3}}, credentials('jsmith')
                    end
                    issue = Issue.first(:order => 'id DESC')
                    assert_equal 1, issue.project_id
                    assert_equal 2, issue.tracker_id
                    assert_equal 3, issue.status_id
                    assert_equal 'API test', issue.subject
                    assert_response :created
                    assert_equal 'application/xml', @response.content_type
                    assert_tag 'issue', :child => {:tag => 'id', :content => issue.id.to_s}
                  end
                end
                context "POST /issues.xml with failure" do
                  should "have an errors tag" do
                    assert_no_difference('Issue.count') do
                      post '/issues.xml', {:issue => {:project_id => 1}}, credentials('jsmith')
                    end
                    assert_tag :errors, :child => {:tag => 'error', :content => "Subject can't be blank"}
                  end
                end
                context "POST /issues.json" do
                  should_allow_api_authentication(:post,
                                                  '/issues.json',
                                                  {:issue => {:project_id => 1, :subject => 'API test', :tracker_id => 2, :status_id => 3}},
                                                  {:success_code => :created})
                  should "create an issue with the attributes" do
                    assert_difference('Issue.count') do
                      post '/issues.json', {:issue => {:project_id => 1, :subject => 'API test', :tracker_id => 2, :status_id => 3}}, credentials('jsmith')
                    end
                    issue = Issue.first(:order => 'id DESC')
                    assert_equal 1, issue.project_id
                    assert_equal 2, issue.tracker_id
                    assert_equal 3, issue.status_id
                    assert_equal 'API test', issue.subject
                  end
                end
                context "POST /issues.json with failure" do
                  should "have an errors element" do
                    assert_no_difference('Issue.count') do
                      post '/issues.json', {:issue => {:project_id => 1}}, credentials('jsmith')
                    end
                    json = ActiveSupport::JSON.decode(response.body)
                    assert json['errors'].include?("Subject can't be blank")
                  end
                end
                # Issue 6 is on a private project
                context "PUT /issues/6.xml" do
                  setup do
                    @parameters = {:issue => {:subject => 'API update', :notes => 'A new note'}}
                  end
                  should_allow_api_authentication(:put,
                                                  '/issues/6.xml',
                                                  {:issue => {:subject => 'API update', :notes => 'A new note'}},
                                                  {:success_code => :ok})
                  should "not create a new issue" do
                    assert_no_difference('Issue.count') do
                      put '/issues/6.xml', @parameters, credentials('jsmith')
                    end
                  end
                  should "create a new journal" do
                    assert_difference('Journal.count') do
                      put '/issues/6.xml', @parameters, credentials('jsmith')
                    end
                  end
                  should "add the note to the journal" do
                    put '/issues/6.xml', @parameters, credentials('jsmith')
                    journal = Journal.last
                    assert_equal "A new note", journal.notes
                  end
                  should "update the issue" do
                    put '/issues/6.xml', @parameters, credentials('jsmith')
                    issue = Issue.find(6)
                    assert_equal "API update", issue.subject
                  end
                end
                context "PUT /issues/3.xml with custom fields" do
                  setup do
                    @parameters = {:issue => {:custom_fields => [{'id' => '1', 'value' => 'PostgreSQL' }, {'id' => '2', 'value' => '150'}]}}
                  end
                  should "update custom fields" do
                    assert_no_difference('Issue.count') do
                      put '/issues/3.xml', @parameters, credentials('jsmith')
                    end
                    issue = Issue.find(3)
                    assert_equal '150', issue.custom_value_for(2).value
                    assert_equal 'PostgreSQL', issue.custom_value_for(1).value
                  end
                end
                context "PUT /issues/3.xml with multi custom fields" do
                  setup do
                    field = CustomField.find(1)
                    field.update_attribute :multiple, true
                    @parameters = {:issue => {:custom_fields => [{'id' => '1', 'value' => ['MySQL', 'PostgreSQL'] }, {'id' => '2', 'value' => '150'}]}}
                  end
                  should "update custom fields" do
                    assert_no_difference('Issue.count') do
                      put '/issues/3.xml', @parameters, credentials('jsmith')
                    end
                    issue = Issue.find(3)
                    assert_equal '150', issue.custom_value_for(2).value
                    assert_equal ['MySQL', 'PostgreSQL'], issue.custom_field_value(1).sort
                  end
                end
                context "PUT /issues/3.xml with project change" do
                  setup do
                    @parameters = {:issue => {:project_id => 2, :subject => 'Project changed'}}
                  end
                  should "update project" do
                    assert_no_difference('Issue.count') do
                      put '/issues/3.xml', @parameters, credentials('jsmith')
                    end
                    issue = Issue.find(3)
                    assert_equal 2, issue.project_id
                    assert_equal 'Project changed', issue.subject
                  end
                end
                context "PUT /issues/6.xml with failed update" do
                  setup do
                    @parameters = {:issue => {:subject => ''}}
                  end
                  should "not create a new issue" do
                    assert_no_difference('Issue.count') do
                      put '/issues/6.xml', @parameters, credentials('jsmith')
                    end
                  end
                  should "not create a new journal" do
                    assert_no_difference('Journal.count') do
                      put '/issues/6.xml', @parameters, credentials('jsmith')
                    end
                  end
                  should "have an errors tag" do
                    put '/issues/6.xml', @parameters, credentials('jsmith')
                    assert_tag :errors, :child => {:tag => 'error', :content => "Subject can't be blank"}
                  end
                end
                context "PUT /issues/6.json" do
                  setup do
                    @parameters = {:issue => {:subject => 'API update', :notes => 'A new note'}}
                  end
                  should_allow_api_authentication(:put,
                                                  '/issues/6.json',
                                                  {:issue => {:subject => 'API update', :notes => 'A new note'}},
                                                  {:success_code => :ok})
                  should "not create a new issue" do
                    assert_no_difference('Issue.count') do
                      put '/issues/6.json', @parameters, credentials('jsmith')
                    end
                  end
                  should "create a new journal" do
                    assert_difference('Journal.count') do
                      put '/issues/6.json', @parameters, credentials('jsmith')
                    end
                  end
                  should "add the note to the journal" do
                    put '/issues/6.json', @parameters, credentials('jsmith')
                    journal = Journal.last
                    assert_equal "A new note", journal.notes
                  end
                  should "update the issue" do
                    put '/issues/6.json', @parameters, credentials('jsmith')
                    issue = Issue.find(6)
                    assert_equal "API update", issue.subject
                  end
                end
                context "PUT /issues/6.json with failed update" do
                  setup do
                    @parameters = {:issue => {:subject => ''}}
                  end
                  should "not create a new issue" do
                    assert_no_difference('Issue.count') do
                      put '/issues/6.json', @parameters, credentials('jsmith')
                    end
                  end
                  should "not create a new journal" do
                    assert_no_difference('Journal.count') do
                      put '/issues/6.json', @parameters, credentials('jsmith')
                    end
                  end
                  should "have an errors attribute" do
                    put '/issues/6.json', @parameters, credentials('jsmith')
                    json = ActiveSupport::JSON.decode(response.body)
                    assert json['errors'].include?("Subject can't be blank")
                  end
                end
                context "DELETE /issues/1.xml" do
                  should_allow_api_authentication(:delete,
                                                  '/issues/6.xml',
                                                  {},
                                                  {:success_code => :ok})
                  should "delete the issue" do
                    assert_difference('Issue.count',-1) do
                      delete '/issues/6.xml', {}, credentials('jsmith')
                    end
                    assert_nil Issue.find_by_id(6)
                  end
                end
                context "DELETE /issues/1.json" do
                  should_allow_api_authentication(:delete,
                                                  '/issues/6.json',
                                                  {},
                                                  {:success_code => :ok})
                  should "delete the issue" do
                    assert_difference('Issue.count',-1) do
                      delete '/issues/6.json', {}, credentials('jsmith')
                    end
                    assert_nil Issue.find_by_id(6)
                  end
                end
                def test_create_issue_with_uploaded_file
                  set_tmp_attachments_directory
                  # upload the file
                  assert_difference 'Attachment.count' do
                    post '/uploads.xml', 'test_create_with_upload', {"CONTENT_TYPE" => 'application/octet-stream'}.merge(credentials('jsmith'))
                    assert_response :created
                  end
                  xml = Hash.from_xml(response.body)
                  token = xml['upload']['token']
                  attachment = Attachment.first(:order => 'id DESC')
                  # create the issue with the upload's token
                  assert_difference 'Issue.count' do
                    post '/issues.xml',
                      {:issue => {:project_id => 1, :subject => 'Uploaded file', :uploads => [{:token => token, :filename => 'test.txt', :content_type => 'text/plain'}]}},
                      credentials('jsmith')
                    assert_response :created
                  end
                  issue = Issue.first(:order => 'id DESC')
                  assert_equal 1, issue.attachments.count
                  assert_equal attachment, issue.attachments.first
                  attachment.reload
                  assert_equal 'test.txt', attachment.filename
                  assert_equal 'text/plain', attachment.content_type
                  assert_equal 'test_create_with_upload'.size, attachment.filesize
                  assert_equal 2, attachment.author_id
                  # get the issue with its attachments
                  get "/issues/#{issue.id}.xml", :include => 'attachments'
                  assert_response :success
                  xml = Hash.from_xml(response.body)
                  attachments = xml['issue']['attachments']
                  assert_kind_of Array, attachments
                  assert_equal 1, attachments.size
                  url = attachments.first['content_url']
                  assert_not_nil url
                  # download the attachment
                  get url
                  assert_response :success
                end
                def test_update_issue_with_uploaded_file
                  set_tmp_attachments_directory
                  # upload the file
                  assert_difference 'Attachment.count' do
                    post '/uploads.xml', 'test_upload_with_upload', {"CONTENT_TYPE" => 'application/octet-stream'}.merge(credentials('jsmith'))
                    assert_response :created
                  end
                  xml = Hash.from_xml(response.body)
                  token = xml['upload']['token']
                  attachment = Attachment.first(:order => 'id DESC')
                  # update the issue with the upload's token
                  assert_difference 'Journal.count' do
                    put '/issues/1.xml',
                      {:issue => {:notes => 'Attachment added', :uploads => [{:token => token, :filename => 'test.txt', :content_type => 'text/plain'}]}},
                      credentials('jsmith')
                    assert_response :ok
+                   assert_equal '', @response.body
                  end
                  issue = Issue.find(1)
                  assert_include attachment, issue.attachments
                end
              end

test/integration/api_test/memberships_test.rb +2 0

              # Redmine - project management software
              # Copyright (C) 2006-2012  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              require File.expand_path('../../../test_helper', __FILE__)
              class ApiTest::MembershipsTest < ActionController::IntegrationTest
                fixtures :projects, :users, :roles, :members, :member_roles
                def setup
                  Setting.rest_api_enabled = '1'
                end
                context "/projects/:project_id/memberships" do
                  context "GET" do
                    context "xml" do
                      should "return memberships" do
                        get '/projects/1/memberships.xml', {}, credentials('jsmith')
                        assert_response :success
                        assert_equal 'application/xml', @response.content_type
                        assert_tag :tag => 'memberships',
                          :attributes => {:type => 'array'},
                          :child => {
                            :tag => 'membership',
                            :child => {
                              :tag => 'id',
                              :content => '2',
                              :sibling => {
                                :tag => 'user',
                                :attributes => {:id => '3', :name => 'Dave Lopper'},
                                :sibling => {
                                  :tag => 'roles',
                                  :child => {
                                    :tag => 'role',
                                    :attributes => {:id => '2', :name => 'Developer'}
                                  }
                                }
                              }
                            }
                          }
                      end
                    end
                    context "json" do
                      should "return memberships" do
                        get '/projects/1/memberships.json', {}, credentials('jsmith')
                        assert_response :success
                        assert_equal 'application/json', @response.content_type
                        json = ActiveSupport::JSON.decode(response.body)
                        assert_equal({
                          "memberships" =>
                            [{"id"=>1,
                              "project" => {"name"=>"eCookbook", "id"=>1},
                              "roles" => [{"name"=>"Manager", "id"=>1}],
                              "user" => {"name"=>"John Smith", "id"=>2}},
                             {"id"=>2,
                              "project" => {"name"=>"eCookbook", "id"=>1},
                              "roles" => [{"name"=>"Developer", "id"=>2}],
                              "user" => {"name"=>"Dave Lopper", "id"=>3}}],
                         "limit" => 25,
                         "total_count" => 2,
                         "offset" => 0},
                         json)
                      end
                    end
                  end
                  context "POST" do
                    context "xml" do
                      should "create membership" do
                        assert_difference 'Member.count' do
                          post '/projects/1/memberships.xml', {:membership => {:user_id => 7, :role_ids => [2,3]}}, credentials('jsmith')
                          assert_response :created
                        end
                      end
                      should "return errors on failure" do
                        assert_no_difference 'Member.count' do
                          post '/projects/1/memberships.xml', {:membership => {:role_ids => [2,3]}}, credentials('jsmith')
                          assert_response :unprocessable_entity
                          assert_equal 'application/xml', @response.content_type
                          assert_tag 'errors', :child => {:tag => 'error', :content => "Principal can't be blank"}
                        end
                      end
                    end
                  end
                end
                context "/memberships/:id" do
                  context "GET" do
                    context "xml" do
                      should "return the membership" do
                        get '/memberships/2.xml', {}, credentials('jsmith')
                        assert_response :success
                        assert_equal 'application/xml', @response.content_type
                        assert_tag :tag => 'membership',
                          :child => {
                            :tag => 'id',
                            :content => '2',
                            :sibling => {
                              :tag => 'user',
                              :attributes => {:id => '3', :name => 'Dave Lopper'},
                              :sibling => {
                                :tag => 'roles',
                                :child => {
                                  :tag => 'role',
                                  :attributes => {:id => '2', :name => 'Developer'}
                                }
                              }
                            }
                          }
                      end
                    end
                    context "json" do
                      should "return the membership" do
                        get '/memberships/2.json', {}, credentials('jsmith')
                        assert_response :success
                        assert_equal 'application/json', @response.content_type
                        json = ActiveSupport::JSON.decode(response.body)
                        assert_equal(
                          {"membership" => {
                            "id" => 2,
                            "project" => {"name"=>"eCookbook", "id"=>1},
                            "roles" => [{"name"=>"Developer", "id"=>2}],
                            "user" => {"name"=>"Dave Lopper", "id"=>3}}
                          },
                          json)
                      end
                    end
                  end
                  context "PUT" do
                    context "xml" do
                      should "update membership" do
                        assert_not_equal [1,2], Member.find(2).role_ids.sort
                        assert_no_difference 'Member.count' do
                          put '/memberships/2.xml', {:membership => {:user_id => 3, :role_ids => [1,2]}}, credentials('jsmith')
                          assert_response :ok
+                         assert_equal '', @response.body
                        end
                        member = Member.find(2)
                        assert_equal [1,2], member.role_ids.sort
                      end
                      should "return errors on failure" do
                        put '/memberships/2.xml', {:membership => {:user_id => 3, :role_ids => [99]}}, credentials('jsmith')
                        assert_response :unprocessable_entity
                        assert_equal 'application/xml', @response.content_type
                        assert_tag 'errors', :child => {:tag => 'error', :content => /member_roles is invalid/}
                      end
                    end
                  end
                  context "DELETE" do
                    context "xml" do
                      should "destroy membership" do
                        assert_difference 'Member.count', -1 do
                          delete '/memberships/2.xml', {}, credentials('jsmith')
                          assert_response :ok
+                         assert_equal '', @response.body
                        end
                        assert_nil Member.find_by_id(2)
                      end
                      should "respond with 422 on failure" do
                        assert_no_difference 'Member.count' do
                          # A membership with an inherited role can't be deleted
                          Member.find(2).member_roles.first.update_attribute :inherited_from, 99
                          delete '/memberships/2.xml', {}, credentials('jsmith')
                          assert_response :unprocessable_entity
                        end
                      end
                    end
                  end
                end
              end

test/integration/api_test/projects_test.rb +4 0

              # Redmine - project management software
              # Copyright (C) 2006-2012  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              require File.expand_path('../../../test_helper', __FILE__)
              class ApiTest::ProjectsTest < ActionController::IntegrationTest
                fixtures :projects, :versions, :users, :roles, :members, :member_roles, :issues, :journals, :journal_details,
                         :trackers, :projects_trackers, :issue_statuses, :enabled_modules, :enumerations, :boards, :messages,
                         :attachments, :custom_fields, :custom_values, :time_entries, :issue_categories
                def setup
                  Setting.rest_api_enabled = '1'
                  set_tmp_attachments_directory
                end
                context "GET /projects" do
                  context ".xml" do
                    should "return projects" do
                      get '/projects.xml'
                      assert_response :success
                      assert_equal 'application/xml', @response.content_type
                      assert_tag :tag => 'projects',
                        :child => {:tag => 'project', :child => {:tag => 'id', :content => '1'}}
                    end
                  end
                  context ".json" do
                    should "return projects" do
                      get '/projects.json'
                      assert_response :success
                      assert_equal 'application/json', @response.content_type
                      json = ActiveSupport::JSON.decode(response.body)
                      assert_kind_of Hash, json
                      assert_kind_of Array, json['projects']
                      assert_kind_of Hash, json['projects'].first
                      assert json['projects'].first.has_key?('id')
                    end
                  end
                end
                context "GET /projects/:id" do
                  context ".xml" do
                    # TODO: A private project is needed because should_allow_api_authentication
                    # actually tests that authentication is *required*, not just allowed
                    should_allow_api_authentication(:get, "/projects/2.xml")
                    should "return requested project" do
                      get '/projects/1.xml'
                      assert_response :success
                      assert_equal 'application/xml', @response.content_type
                      assert_tag :tag => 'project',
                        :child => {:tag => 'id', :content => '1'}
                      assert_tag :tag => 'custom_field',
                        :attributes => {:name => 'Development status'}, :content => 'Stable'
                      assert_no_tag 'trackers'
                      assert_no_tag 'issue_categories'
                    end
                    context "with hidden custom fields" do
                      setup do
                        ProjectCustomField.find_by_name('Development status').update_attribute :visible, false
                      end
                      should "not display hidden custom fields" do
                        get '/projects/1.xml'
                        assert_response :success
                        assert_equal 'application/xml', @response.content_type
                        assert_no_tag 'custom_field',
                          :attributes => {:name => 'Development status'}
                      end
                    end
                    should "return categories with include=issue_categories" do
                      get '/projects/1.xml?include=issue_categories'
                      assert_response :success
                      assert_equal 'application/xml', @response.content_type
                      assert_tag 'issue_categories',
                        :attributes => {:type => 'array'},
                        :child => {
                          :tag => 'issue_category',
                          :attributes => {
                            :id => '2',
                            :name => 'Recipes'
                          }
                        }
                    end
                    should "return trackers with include=trackers" do
                      get '/projects/1.xml?include=trackers'
                      assert_response :success
                      assert_equal 'application/xml', @response.content_type
                      assert_tag 'trackers',
                        :attributes => {:type => 'array'},
                        :child => {
                          :tag => 'tracker',
                          :attributes => {
                            :id => '2',
                            :name => 'Feature request'
                          }
                        }
                    end
                  end
                  context ".json" do
                    should_allow_api_authentication(:get, "/projects/2.json")
                    should "return requested project" do
                      get '/projects/1.json'
                      json = ActiveSupport::JSON.decode(response.body)
                      assert_kind_of Hash, json
                      assert_kind_of Hash, json['project']
                      assert_equal 1, json['project']['id']
                    end
                  end
                end
                context "POST /projects" do
                  context "with valid parameters" do
                    setup do
                      Setting.default_projects_modules = ['issue_tracking', 'repository']
                      @parameters = {:project => {:name => 'API test', :identifier => 'api-test'}}
                    end
                    context ".xml" do
                      should_allow_api_authentication(:post,
                                                      '/projects.xml',
                                                      {:project => {:name => 'API test', :identifier => 'api-test'}},
                                                      {:success_code => :created})
                      should "create a project with the attributes" do
                        assert_difference('Project.count') do
                          post '/projects.xml', @parameters, credentials('admin')
                        end
                        project = Project.first(:order => 'id DESC')
                        assert_equal 'API test', project.name
                        assert_equal 'api-test', project.identifier
                        assert_equal ['issue_tracking', 'repository'], project.enabled_module_names.sort
                        assert_equal Tracker.all.size, project.trackers.size
                        assert_response :created
                        assert_equal 'application/xml', @response.content_type
                        assert_tag 'project', :child => {:tag => 'id', :content => project.id.to_s}
                      end
                      should "accept enabled_module_names attribute" do
                        @parameters[:project].merge!({:enabled_module_names => ['issue_tracking', 'news', 'time_tracking']})
                        assert_difference('Project.count') do
                          post '/projects.xml', @parameters, credentials('admin')
                        end
                        project = Project.first(:order => 'id DESC')
                        assert_equal ['issue_tracking', 'news', 'time_tracking'], project.enabled_module_names.sort
                      end
                      should "accept tracker_ids attribute" do
                        @parameters[:project].merge!({:tracker_ids => [1, 3]})
                        assert_difference('Project.count') do
                          post '/projects.xml', @parameters, credentials('admin')
                        end
                        project = Project.first(:order => 'id DESC')
                        assert_equal [1, 3], project.trackers.map(&:id).sort
                      end
                    end
                  end
                  context "with invalid parameters" do
                    setup do
                      @parameters = {:project => {:name => 'API test'}}
                    end
                    context ".xml" do
                      should "return errors" do
                        assert_no_difference('Project.count') do
                          post '/projects.xml', @parameters, credentials('admin')
                        end
                        assert_response :unprocessable_entity
                        assert_equal 'application/xml', @response.content_type
                        assert_tag 'errors', :child => {:tag => 'error', :content => "Identifier can't be blank"}
                      end
                    end
                  end
                end
                context "PUT /projects/:id" do
                  context "with valid parameters" do
                    setup do
                      @parameters = {:project => {:name => 'API update'}}
                    end
                    context ".xml" do
                      should_allow_api_authentication(:put,
                                                      '/projects/2.xml',
                                                      {:project => {:name => 'API update'}},
                                                      {:success_code => :ok})
                      should "update the project" do
                        assert_no_difference 'Project.count' do
                          put '/projects/2.xml', @parameters, credentials('jsmith')
                        end
                        assert_response :ok
+                       assert_equal '', @response.body
                        assert_equal 'application/xml', @response.content_type
                        project = Project.find(2)
                        assert_equal 'API update', project.name
                      end
                      should "accept enabled_module_names attribute" do
                        @parameters[:project].merge!({:enabled_module_names => ['issue_tracking', 'news', 'time_tracking']})
                        assert_no_difference 'Project.count' do
                          put '/projects/2.xml', @parameters, credentials('admin')
                        end
                        assert_response :ok
+                       assert_equal '', @response.body
                        project = Project.find(2)
                        assert_equal ['issue_tracking', 'news', 'time_tracking'], project.enabled_module_names.sort
                      end
                      should "accept tracker_ids attribute" do
                        @parameters[:project].merge!({:tracker_ids => [1, 3]})
                        assert_no_difference 'Project.count' do
                          put '/projects/2.xml', @parameters, credentials('admin')
                        end
                        assert_response :ok
+                       assert_equal '', @response.body
                        project = Project.find(2)
                        assert_equal [1, 3], project.trackers.map(&:id).sort
                      end
                    end
                  end
                  context "with invalid parameters" do
                    setup do
                      @parameters = {:project => {:name => ''}}
                    end
                    context ".xml" do
                      should "return errors" do
                        assert_no_difference('Project.count') do
                          put '/projects/2.xml', @parameters, credentials('admin')
                        end
                        assert_response :unprocessable_entity
                        assert_equal 'application/xml', @response.content_type
                        assert_tag 'errors', :child => {:tag => 'error', :content => "Name can't be blank"}
                      end
                    end
                  end
                end
                context "DELETE /projects/:id" do
                  context ".xml" do
                    should_allow_api_authentication(:delete,
                                                    '/projects/2.xml',
                                                    {},
                                                    {:success_code => :ok})
                    should "delete the project" do
                      assert_difference('Project.count',-1) do
                        delete '/projects/2.xml', {}, credentials('admin')
                      end
                      assert_response :ok
+                     assert_equal '', @response.body
                      assert_nil Project.find_by_id(2)
                    end
                  end
                end
              end

test/integration/api_test/time_entries_test.rb +2 0

              # Redmine - project management software
              # Copyright (C) 2006-2012  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              require File.expand_path('../../../test_helper', __FILE__)
              class ApiTest::TimeEntriesTest < ActionController::IntegrationTest
                fixtures :projects, :trackers, :issue_statuses, :issues,
                         :enumerations, :users, :issue_categories,
                         :projects_trackers,
                         :roles,
                         :member_roles,
                         :members,
                         :enabled_modules,
                         :workflows,
                         :time_entries
                def setup
                  Setting.rest_api_enabled = '1'
                end
                context "GET /time_entries.xml" do
                  should "return time entries" do
                    get '/time_entries.xml', {}, credentials('jsmith')
                    assert_response :success
                    assert_equal 'application/xml', @response.content_type
                    assert_tag :tag => 'time_entries',
                      :child => {:tag => 'time_entry', :child => {:tag => 'id', :content => '2'}}
                  end
                  context "with limit" do
                    should "return limited results" do
                      get '/time_entries.xml?limit=2', {}, credentials('jsmith')
                      assert_response :success
                      assert_equal 'application/xml', @response.content_type
                      assert_tag :tag => 'time_entries',
                        :children => {:count => 2}
                    end
                  end
                end
                context "GET /time_entries/2.xml" do
                  should "return requested time entry" do
                    get '/time_entries/2.xml', {}, credentials('jsmith')
                    assert_response :success
                    assert_equal 'application/xml', @response.content_type
                    assert_tag :tag => 'time_entry',
                      :child => {:tag => 'id', :content => '2'}
                  end
                end
                context "POST /time_entries.xml" do
                  context "with issue_id" do
                    should "return create time entry" do
                      assert_difference 'TimeEntry.count' do
                        post '/time_entries.xml', {:time_entry => {:issue_id => '1', :spent_on => '2010-12-02', :hours => '3.5', :activity_id => '11'}}, credentials('jsmith')
                      end
                      assert_response :created
                      assert_equal 'application/xml', @response.content_type
                      entry = TimeEntry.first(:order => 'id DESC')
                      assert_equal 'jsmith', entry.user.login
                      assert_equal Issue.find(1), entry.issue
                      assert_equal Project.find(1), entry.project
                      assert_equal Date.parse('2010-12-02'), entry.spent_on
                      assert_equal 3.5, entry.hours
                      assert_equal TimeEntryActivity.find(11), entry.activity
                    end
                    should "accept custom fields" do
                      field = TimeEntryCustomField.create!(:name => 'Test', :field_format => 'string')
                      assert_difference 'TimeEntry.count' do
                        post '/time_entries.xml', {:time_entry => {
                          :issue_id => '1', :spent_on => '2010-12-02', :hours => '3.5', :activity_id => '11', :custom_fields => [{:id => field.id.to_s, :value => 'accepted'}]
                        }}, credentials('jsmith')
                      end
                      assert_response :created
                      assert_equal 'application/xml', @response.content_type
                      entry = TimeEntry.first(:order => 'id DESC')
                      assert_equal 'accepted', entry.custom_field_value(field)
                    end
                  end
                  context "with project_id" do
                    should "return create time entry" do
                      assert_difference 'TimeEntry.count' do
                        post '/time_entries.xml', {:time_entry => {:project_id => '1', :spent_on => '2010-12-02', :hours => '3.5', :activity_id => '11'}}, credentials('jsmith')
                      end
                      assert_response :created
                      assert_equal 'application/xml', @response.content_type
                      entry = TimeEntry.first(:order => 'id DESC')
                      assert_equal 'jsmith', entry.user.login
                      assert_nil entry.issue
                      assert_equal Project.find(1), entry.project
                      assert_equal Date.parse('2010-12-02'), entry.spent_on
                      assert_equal 3.5, entry.hours
                      assert_equal TimeEntryActivity.find(11), entry.activity
                    end
                  end
                  context "with invalid parameters" do
                    should "return errors" do
                      assert_no_difference 'TimeEntry.count' do
                        post '/time_entries.xml', {:time_entry => {:project_id => '1', :spent_on => '2010-12-02', :activity_id => '11'}}, credentials('jsmith')
                      end
                      assert_response :unprocessable_entity
                      assert_equal 'application/xml', @response.content_type
                      assert_tag 'errors', :child => {:tag => 'error', :content => "Hours can't be blank"}
                    end
                  end
                end
                context "PUT /time_entries/2.xml" do
                  context "with valid parameters" do
                    should "update time entry" do
                      assert_no_difference 'TimeEntry.count' do
                        put '/time_entries/2.xml', {:time_entry => {:comments => 'API Update'}}, credentials('jsmith')
                      end
                      assert_response :ok
+                     assert_equal '', @response.body
                      assert_equal 'API Update', TimeEntry.find(2).comments
                    end
                  end
                  context "with invalid parameters" do
                    should "return errors" do
                      assert_no_difference 'TimeEntry.count' do
                        put '/time_entries/2.xml', {:time_entry => {:hours => '', :comments => 'API Update'}}, credentials('jsmith')
                      end
                      assert_response :unprocessable_entity
                      assert_equal 'application/xml', @response.content_type
                      assert_tag 'errors', :child => {:tag => 'error', :content => "Hours can't be blank"}
                    end
                  end
                end
                context "DELETE /time_entries/2.xml" do
                  should "destroy time entry" do
                    assert_difference 'TimeEntry.count', -1 do
                      delete '/time_entries/2.xml', {}, credentials('jsmith')
                    end
                    assert_response :ok
+                   assert_equal '', @response.body
                    assert_nil TimeEntry.find_by_id(2)
                  end
                end
              end

test/integration/api_test/users_test.rb +4 0

              # Redmine - project management software
              # Copyright (C) 2006-2012  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              require File.expand_path('../../../test_helper', __FILE__)
              require 'pp'
              class ApiTest::UsersTest < ActionController::IntegrationTest
                fixtures :users
                def setup
                  Setting.rest_api_enabled = '1'
                end
                context "GET /users" do
                  should_allow_api_authentication(:get, "/users.xml")
                  should_allow_api_authentication(:get, "/users.json")
                end
                context "GET /users/2" do
                  context ".xml" do
                    should "return requested user" do
                      get '/users/2.xml'
                      assert_response :success
                      assert_tag :tag => 'user',
                        :child => {:tag => 'id', :content => '2'}
                    end
                    context "with include=memberships" do
                      should "include memberships" do
                        get '/users/2.xml?include=memberships'
                        assert_response :success
                        assert_tag :tag => 'memberships',
                          :parent => {:tag => 'user'},
                          :children => {:count => 1}
                      end
                    end
                  end
                  context ".json" do
                    should "return requested user" do
                      get '/users/2.json'
                      assert_response :success
                      json = ActiveSupport::JSON.decode(response.body)
                      assert_kind_of Hash, json
                      assert_kind_of Hash, json['user']
                      assert_equal 2, json['user']['id']
                    end
                    context "with include=memberships" do
                      should "include memberships" do
                        get '/users/2.json?include=memberships'
                        assert_response :success
                        json = ActiveSupport::JSON.decode(response.body)
                        assert_kind_of Array, json['user']['memberships']
                        assert_equal [{
                          "id"=>1,
                          "project"=>{"name"=>"eCookbook", "id"=>1},
                          "roles"=>[{"name"=>"Manager", "id"=>1}]
                        }], json['user']['memberships']
                      end
                    end
                  end
                end
                context "GET /users/current" do
                  context ".xml" do
                    should "require authentication" do
                      get '/users/current.xml'
                      assert_response 401
                    end
                    should "return current user" do
                      get '/users/current.xml', {}, credentials('jsmith')
                      assert_tag :tag => 'user',
                        :child => {:tag => 'id', :content => '2'}
                    end
                  end
                end
                context "POST /users" do
                  context "with valid parameters" do
                    setup do
                      @parameters = {
                        :user => {
                           :login => 'foo', :firstname => 'Firstname', :lastname => 'Lastname',
                           :mail => 'foo@example.net', :password => 'secret',
                           :mail_notification => 'only_assigned'
                        }
                      }
                    end
                    context ".xml" do
                      should_allow_api_authentication(:post,
                        '/users.xml',
                         {:user => {
                            :login => 'foo', :firstname => 'Firstname', :lastname => 'Lastname',
                            :mail => 'foo@example.net', :password => 'secret'
                          }},
                        {:success_code => :created})
                      should "create a user with the attributes" do
                        assert_difference('User.count') do
                          post '/users.xml', @parameters, credentials('admin')
                        end
                        user = User.first(:order => 'id DESC')
                        assert_equal 'foo', user.login
                        assert_equal 'Firstname', user.firstname
                        assert_equal 'Lastname', user.lastname
                        assert_equal 'foo@example.net', user.mail
                        assert_equal 'only_assigned', user.mail_notification
                        assert !user.admin?
                        assert user.check_password?('secret')
                        assert_response :created
                        assert_equal 'application/xml', @response.content_type
                        assert_tag 'user', :child => {:tag => 'id', :content => user.id.to_s}
                      end
                    end
                    context ".json" do
                      should_allow_api_authentication(:post,
                        '/users.json',
                        {:user => {
                           :login => 'foo', :firstname => 'Firstname', :lastname => 'Lastname',
                           :mail => 'foo@example.net'
                        }},
                        {:success_code => :created})
                      should "create a user with the attributes" do
                        assert_difference('User.count') do
                          post '/users.json', @parameters, credentials('admin')
                        end
                        user = User.first(:order => 'id DESC')
                        assert_equal 'foo', user.login
                        assert_equal 'Firstname', user.firstname
                        assert_equal 'Lastname', user.lastname
                        assert_equal 'foo@example.net', user.mail
                        assert !user.admin?
                        assert_response :created
                        assert_equal 'application/json', @response.content_type
                        json = ActiveSupport::JSON.decode(response.body)
                        assert_kind_of Hash, json
                        assert_kind_of Hash, json['user']
                        assert_equal user.id, json['user']['id']
                      end
                    end
                  end
                  context "with invalid parameters" do
                    setup do
                      @parameters = {:user => {:login => 'foo', :lastname => 'Lastname', :mail => 'foo'}}
                    end
                    context ".xml" do
                      should "return errors" do
                        assert_no_difference('User.count') do
                          post '/users.xml', @parameters, credentials('admin')
                        end
                        assert_response :unprocessable_entity
                        assert_equal 'application/xml', @response.content_type
                        assert_tag 'errors', :child => {
                                               :tag => 'error',
                                               :content => "First name can't be blank"
                                             }
                      end
                    end
                    context ".json" do
                      should "return errors" do
                        assert_no_difference('User.count') do
                          post '/users.json', @parameters, credentials('admin')
                        end
                        assert_response :unprocessable_entity
                        assert_equal 'application/json', @response.content_type
                        json = ActiveSupport::JSON.decode(response.body)
                        assert_kind_of Hash, json
                        assert json.has_key?('errors')
                        assert_kind_of Array, json['errors']
                      end
                    end
                  end
                end
                context "PUT /users/2" do
                  context "with valid parameters" do
                    setup do
                      @parameters = {
                        :user => {
                          :login => 'jsmith', :firstname => 'John', :lastname => 'Renamed',
                          :mail => 'jsmith@somenet.foo'
                        }
                      }
                    end
                    context ".xml" do
                      should_allow_api_authentication(:put,
                        '/users/2.xml',
                        {:user => {
                            :login => 'jsmith', :firstname => 'John', :lastname => 'Renamed',
                            :mail => 'jsmith@somenet.foo'
                        }},
                        {:success_code => :ok})
                      should "update user with the attributes" do
                        assert_no_difference('User.count') do
                          put '/users/2.xml', @parameters, credentials('admin')
                        end
                        user = User.find(2)
                        assert_equal 'jsmith', user.login
                        assert_equal 'John', user.firstname
                        assert_equal 'Renamed', user.lastname
                        assert_equal 'jsmith@somenet.foo', user.mail
                        assert !user.admin?
                        assert_response :ok
+                       assert_equal '', @response.body
                      end
                    end
                    context ".json" do
                      should_allow_api_authentication(:put,
                        '/users/2.json',
                        {:user => {
                            :login => 'jsmith', :firstname => 'John', :lastname => 'Renamed',
                            :mail => 'jsmith@somenet.foo'
                        }},
                        {:success_code => :ok})
                      should "update user with the attributes" do
                        assert_no_difference('User.count') do
                          put '/users/2.json', @parameters, credentials('admin')
                        end
                        user = User.find(2)
                        assert_equal 'jsmith', user.login
                        assert_equal 'John', user.firstname
                        assert_equal 'Renamed', user.lastname
                        assert_equal 'jsmith@somenet.foo', user.mail
                        assert !user.admin?
                        assert_response :ok
+                       assert_equal '', @response.body
                      end
                    end
                  end
                  context "with invalid parameters" do
                    setup do
                      @parameters = {
                        :user => {
                          :login => 'jsmith', :firstname => '', :lastname => 'Lastname',
                          :mail => 'foo'
                        }
                      }
                    end
                    context ".xml" do
                      should "return errors" do
                        assert_no_difference('User.count') do
                          put '/users/2.xml', @parameters, credentials('admin')
                        end
                        assert_response :unprocessable_entity
                        assert_equal 'application/xml', @response.content_type
                        assert_tag 'errors', :child => {
                                               :tag => 'error',
                                               :content => "First name can't be blank"
                                              }
                      end
                    end
                    context ".json" do
                      should "return errors" do
                        assert_no_difference('User.count') do
                          put '/users/2.json', @parameters, credentials('admin')
                        end
                        assert_response :unprocessable_entity
                        assert_equal 'application/json', @response.content_type
                        json = ActiveSupport::JSON.decode(response.body)
                        assert_kind_of Hash, json
                        assert json.has_key?('errors')
                        assert_kind_of Array, json['errors']
                      end
                    end
                  end
                end
                context "DELETE /users/2" do
                  context ".xml" do
                    should_allow_api_authentication(:delete,
                      '/users/2.xml',
                      {},
                      {:success_code => :ok})
                    should "delete user" do
                      assert_difference('User.count', -1) do
                        delete '/users/2.xml', {}, credentials('admin')
                      end
                      assert_response :ok
+                     assert_equal '', @response.body
                    end
                  end
                  context ".json" do
                    should_allow_api_authentication(:delete,
                      '/users/2.xml',
                      {},
                      {:success_code => :ok})
                    should "delete user" do
                      assert_difference('User.count', -1) do
                        delete '/users/2.json', {}, credentials('admin')
                      end
                      assert_response :ok
+                     assert_equal '', @response.body
                    end
                  end
                end
              end

test/integration/api_test/versions_test.rb +2 0

              # Redmine - project management software
              # Copyright (C) 2006-2012  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              require File.expand_path('../../../test_helper', __FILE__)
              class ApiTest::VersionsTest < ActionController::IntegrationTest
                fixtures :projects, :trackers, :issue_statuses, :issues,
                         :enumerations, :users, :issue_categories,
                         :projects_trackers,
                         :roles,
                         :member_roles,
                         :members,
                         :enabled_modules,
                         :workflows,
                         :versions
                def setup
                  Setting.rest_api_enabled = '1'
                end
                context "/projects/:project_id/versions" do
                  context "GET" do
                    should "return project versions" do
                      get '/projects/1/versions.xml'
                      assert_response :success
                      assert_equal 'application/xml', @response.content_type
                      assert_tag :tag => 'versions',
                        :attributes => {:type => 'array'},
                        :child => {
                          :tag => 'version',
                          :child => {
                            :tag => 'id',
                            :content => '2',
                            :sibling => {
                              :tag => 'name',
                              :content => '1.0'
                            }
                          }
                        }
                    end
                  end
                  context "POST" do
                    should "create the version" do
                      assert_difference 'Version.count' do
                        post '/projects/1/versions.xml', {:version => {:name => 'API test'}}, credentials('jsmith')
                      end
                      version = Version.first(:order => 'id DESC')
                      assert_equal 'API test', version.name
                      assert_response :created
                      assert_equal 'application/xml', @response.content_type
                      assert_tag 'version', :child => {:tag => 'id', :content => version.id.to_s}
                    end
                    should "create the version with due date" do
                      assert_difference 'Version.count' do
                        post '/projects/1/versions.xml', {:version => {:name => 'API test', :due_date => '2012-01-24'}}, credentials('jsmith')
                      end
                      version = Version.first(:order => 'id DESC')
                      assert_equal 'API test', version.name
                      assert_equal Date.parse('2012-01-24'), version.due_date
                      assert_response :created
                      assert_equal 'application/xml', @response.content_type
                      assert_tag 'version', :child => {:tag => 'id', :content => version.id.to_s}
                    end
                    context "with failure" do
                      should "return the errors" do
                        assert_no_difference('Version.count') do
                          post '/projects/1/versions.xml', {:version => {:name => ''}}, credentials('jsmith')
                        end
                        assert_response :unprocessable_entity
                        assert_tag :errors, :child => {:tag => 'error', :content => "Name can't be blank"}
                      end
                    end
                  end
                end
                context "/versions/:id" do
                  context "GET" do
                    should "return the version" do
                      get '/versions/2.xml'
                      assert_response :success
                      assert_equal 'application/xml', @response.content_type
                      assert_tag 'version',
                        :child => {
                          :tag => 'id',
                          :content => '2',
                          :sibling => {
                            :tag => 'name',
                            :content => '1.0'
                          }
                        }
                    end
                  end
                  context "PUT" do
                    should "update the version" do
                      put '/versions/2.xml', {:version => {:name => 'API update'}}, credentials('jsmith')
                      assert_response :ok
+                     assert_equal '', @response.body
                      assert_equal 'API update', Version.find(2).name
                    end
                  end
                  context "DELETE" do
                    should "destroy the version" do
                      assert_difference 'Version.count', -1 do
                        delete '/versions/3.xml', {}, credentials('jsmith')
                      end
                      assert_response :ok
+                     assert_equal '', @response.body
                      assert_nil Version.find_by_id(3)
                    end
                  end
                end
              end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages