| @@ -84,17 +84,21 class Issue < ActiveRecord::Base | |||
|
|
84 | 84 | # Returns a SQL conditions string used to find all issues visible by the specified user |
|
|
85 | 85 | def self.visible_condition(user, options={}) |
|
|
86 | 86 | Project.allowed_to_condition(user, :view_issues, options) do |role, user| |
|
|
87 | case role.issues_visibility | |
|
|
88 | when 'all' | |
|
|
89 |
|
|
|
|
90 | when 'default' | |
|
|
91 | user_ids = [user.id] + user.groups.map(&:id) | |
|
|
92 | "(#{table_name}.is_private = #{connection.quoted_false} OR #{table_name}.author_id = #{user.id} OR #{table_name}.assigned_to_id IN (#{user_ids.join(',')}))" | |
|
|
93 | when 'own' | |
|
|
94 | user_ids = [user.id] + user.groups.map(&:id) | |
|
|
95 | "(#{table_name}.author_id = #{user.id} OR #{table_name}.assigned_to_id IN (#{user_ids.join(',')}))" | |
|
|
87 | if user.logged? | |
|
|
88 | case role.issues_visibility | |
|
|
89 | when 'all' | |
|
|
90 | nil | |
|
|
91 | when 'default' | |
|
|
92 | user_ids = [user.id] + user.groups.map(&:id) | |
|
|
93 | "(#{table_name}.is_private = #{connection.quoted_false} OR #{table_name}.author_id = #{user.id} OR #{table_name}.assigned_to_id IN (#{user_ids.join(',')}))" | |
|
|
94 | when 'own' | |
|
|
95 | user_ids = [user.id] + user.groups.map(&:id) | |
|
|
96 | "(#{table_name}.author_id = #{user.id} OR #{table_name}.assigned_to_id IN (#{user_ids.join(',')}))" | |
|
|
97 | else | |
|
|
98 | '1=0' | |
|
|
99 | end | |
|
|
96 | 100 | else |
|
|
97 | '1=0' | |
|
|
101 | "(#{table_name}.is_private = #{connection.quoted_false})" | |
|
|
98 | 102 | end |
|
|
99 | 103 | end |
|
|
100 | 104 | end |
| @@ -102,15 +106,19 class Issue < ActiveRecord::Base | |||
|
|
102 | 106 | # Returns true if usr or current user is allowed to view the issue |
|
|
103 | 107 | def visible?(usr=nil) |
|
|
104 | 108 | (usr || User.current).allowed_to?(:view_issues, self.project) do |role, user| |
|
|
105 | case role.issues_visibility | |
|
|
106 | when 'all' | |
|
|
107 |
|
|
|
|
108 | when 'default' | |
|
|
109 | !self.is_private? || self.author == user || user.is_or_belongs_to?(assigned_to) | |
|
|
110 | when 'own' | |
|
|
111 | self.author == user || user.is_or_belongs_to?(assigned_to) | |
|
|
109 | if user.logged? | |
|
|
110 | case role.issues_visibility | |
|
|
111 | when 'all' | |
|
|
112 | true | |
|
|
113 | when 'default' | |
|
|
114 | !self.is_private? || (self.author == user || user.is_or_belongs_to?(assigned_to)) | |
|
|
115 | when 'own' | |
|
|
116 | self.author == user || user.is_or_belongs_to?(assigned_to) | |
|
|
117 | else | |
|
|
118 | false | |
|
|
119 | end | |
|
|
112 | 120 | else |
|
|
113 | false | |
|
|
121 | !self.is_private? | |
|
|
114 | 122 | end |
|
|
115 | 123 | end |
|
|
116 | 124 | end |
| @@ -133,6 +133,11 class Role < ActiveRecord::Base | |||
|
|
133 | 133 | self.builtin != 0 |
|
|
134 | 134 | end |
|
|
135 | 135 | |
|
|
136 | # Return true if the role is the anonymous role | |
|
|
137 | def anonymous? | |
|
|
138 | builtin == 2 | |
|
|
139 | end | |
|
|
140 | ||
|
|
136 | 141 | # Return true if the role is a project member role |
|
|
137 | 142 | def member? |
|
|
138 | 143 | !self.builtin? |
| @@ -1,5 +1,6 | |||
|
|
1 | 1 | <%= error_messages_for 'role' %> |
|
|
2 | 2 | |
|
|
3 | <% unless @role.anonymous? %> | |
|
|
3 | 4 | <div class="box tabular"> |
|
|
4 | 5 | <% unless @role.builtin? %> |
|
|
5 | 6 | <p><%= f.text_field :name, :required => true %></p> |
| @@ -11,6 +12,7 | |||
|
|
11 | 12 | <%= select_tag(:copy_workflow_from, content_tag("option") + options_from_collection_for_select(@roles, :id, :name, params[:copy_workflow_from] || @copy_from.try(:id))) %></p> |
|
|
12 | 13 | <% end %> |
|
|
13 | 14 | </div> |
|
|
15 | <% end %> | |
|
|
14 | 16 | |
|
|
15 | 17 | <h3><%= l(:label_permissions) %></h3> |
|
|
16 | 18 | <div class="box tabular" id="permissions"> |
| @@ -110,6 +110,14 class RolesControllerTest < ActionController::TestCase | |||
|
|
110 | 110 | assert_response :success |
|
|
111 | 111 | assert_template 'edit' |
|
|
112 | 112 | assert_equal Role.find(1), assigns(:role) |
|
|
113 | assert_select 'select[name=?]', 'role[issues_visibility]' | |
|
|
114 | end | |
|
|
115 | ||
|
|
116 | def test_edit_anonymous | |
|
|
117 | get :edit, :id => Role.anonymous.id | |
|
|
118 | assert_response :success | |
|
|
119 | assert_template 'edit' | |
|
|
120 | assert_select 'select[name=?]', 'role[issues_visibility]', 0 | |
|
|
113 | 121 | end |
|
|
114 | 122 | |
|
|
115 | 123 | def test_edit_invalid_should_respond_with_404 |
| @@ -25,7 +25,7 class IssueTest < ActiveSupport::TestCase | |||
|
|
25 | 25 | :versions, |
|
|
26 | 26 | :issue_statuses, :issue_categories, :issue_relations, :workflows, |
|
|
27 | 27 | :enumerations, |
|
|
28 | :issues, | |
|
|
28 | :issues, :journals, :journal_details, | |
|
|
29 | 29 | :custom_fields, :custom_fields_projects, :custom_fields_trackers, :custom_values, |
|
|
30 | 30 | :time_entries |
|
|
31 | 31 | |
| @@ -105,18 +105,6 class IssueTest < ActiveSupport::TestCase | |||
|
|
105 | 105 | assert_visibility_match User.anonymous, issues |
|
|
106 | 106 | end |
|
|
107 | 107 | |
|
|
108 | def test_visible_scope_for_anonymous_with_own_issues_visibility | |
|
|
109 | Role.anonymous.update_attribute :issues_visibility, 'own' | |
|
|
110 | Issue.create!(:project_id => 1, :tracker_id => 1, | |
|
|
111 | :author_id => User.anonymous.id, | |
|
|
112 | :subject => 'Issue by anonymous') | |
|
|
113 | ||
|
|
114 | issues = Issue.visible(User.anonymous).all | |
|
|
115 | assert issues.any? | |
|
|
116 | assert_nil issues.detect {|issue| issue.author != User.anonymous} | |
|
|
117 | assert_visibility_match User.anonymous, issues | |
|
|
118 | end | |
|
|
119 | ||
|
|
120 | 108 | def test_visible_scope_for_anonymous_without_view_issues_permissions |
|
|
121 | 109 | # Anonymous user should not see issues without permission |
|
|
122 | 110 | Role.anonymous.remove_permission!(:view_issues) |
| @@ -125,6 +113,20 class IssueTest < ActiveSupport::TestCase | |||
|
|
125 | 113 | assert_visibility_match User.anonymous, issues |
|
|
126 | 114 | end |
|
|
127 | 115 | |
|
|
116 | def test_anonymous_should_not_see_private_issues_with_issues_visibility_set_to_default | |
|
|
117 | assert Role.anonymous.update_attribute(:issues_visibility, 'default') | |
|
|
118 | issue = Issue.generate_for_project!(Project.find(1), :author => User.anonymous, :assigned_to => User.anonymous, :is_private => true) | |
|
|
119 | assert_nil Issue.where(:id => issue.id).visible(User.anonymous).first | |
|
|
120 | assert !issue.visible?(User.anonymous) | |
|
|
121 | end | |
|
|
122 | ||
|
|
123 | def test_anonymous_should_not_see_private_issues_with_issues_visibility_set_to_own | |
|
|
124 | assert Role.anonymous.update_attribute(:issues_visibility, 'own') | |
|
|
125 | issue = Issue.generate_for_project!(Project.find(1), :author => User.anonymous, :assigned_to => User.anonymous, :is_private => true) | |
|
|
126 | assert_nil Issue.where(:id => issue.id).visible(User.anonymous).first | |
|
|
127 | assert !issue.visible?(User.anonymous) | |
|
|
128 | end | |
|
|
129 | ||
|
|
128 | 130 | def test_visible_scope_for_non_member |
|
|
129 | 131 | user = User.find(9) |
|
|
130 | 132 | assert user.projects.empty? |
General Comments 0
You need to be logged in to leave comments.
Login now