jro_apps/redmine Commit - r8433:2a55d3761971

Check project assignment on issue copy/move....

Jean-Philippe Lang -

r8433:2a55d3761971

parent child

Context file:

r8433:2a55d3761971

Collapse all files

app/models/issue.rb +14 -4

               # Should be called from controllers instead of #attributes=
               # attr_accessible is too rough because we still want things like
               # Issue.new(:project => foo) to work
-              # TODO: move workflow/permission checks from controllers to here
               def safe_attributes=(attrs, user=User.current)
                 return unless attrs.is_a?(Hash)
                 # Project and Tracker must be set before since new_statuses_allowed_to depends on it.
                 if p = attrs.delete('project_id')
-                  self.project_id = p
+                  if allowed_target_projects(user).collect(&:id).include?(p.to_i)
+                    self.project_id = p
+                  end
                 end
                 if t = attrs.delete('tracker_id')
                   self.tracker_id = t
                 end
               end
               # End ReportsController extraction
-              # Returns an array of projects that current user can move issues to
+              # Returns an array of projects that user can assign the issue to
+              def allowed_target_projects(user=User.current)
+                if new_record?
+                  Project.all(:conditions => Project.allowed_to_condition(user, :add_issues))
+                else
+                  self.class.allowed_target_projects_on_move(user)
+                end
+              end
+              # Returns an array of projects that user can move issues to
               def self.allowed_target_projects_on_move(user=User.current)
                 projects = []
                 if user.admin?

app/views/issues/_form.html.erb +1 -1

             <% end %>
             <% if @issue.safe_attribute? 'project_id' %>
-            <p><%= f.select :project_id, project_tree_options_for_select(Issue.allowed_target_projects_on_move, :selected => @issue.project), :required => true %></p>
+            <p><%= f.select :project_id, project_tree_options_for_select(@issue.allowed_target_projects, :selected => @issue.project), :required => true %></p>
             <%= observe_field :issue_project_id, :url => project_issue_form_path(@project, :id => @issue, :project_change => '1'),
                                                  :with => "Form.serialize('issue-form')" %>
             <% end %>

test/functional/issues_controller_test.rb +12 0

@@ -1630,6 +1630,18 class IssuesControllerTest < ActionController::TestCase
1630	assert_tag 'input', :attributes => {:name => 'copy_from', :value => '1'}	1630	assert_tag 'input', :attributes => {:name => 'copy_from', :value => '1'}
1631	end	1631	end
1632		1632
		1633	def test_create_as_copy_on_project_without_permission_should_ignore_target_project
		1634	@request.session[:user_id] = 2
		1635	assert !User.find(2).member_of?(Project.find(4))
		1636
		1637	assert_difference 'Issue.count' do
		1638	post :create, :project_id => 1, :copy_from => 1,
		1639	:issue => {:project_id => '4', :tracker_id => '3', :status_id => '1', :subject => 'Copy'}
		1640	end
		1641	issue = Issue.first(:order => 'id DESC')
		1642	assert_equal 1, issue.project_id
		1643	end
		1644
1633	def test_get_edit	1645	def test_get_edit
1634	@request.session[:user_id] = 2	1646	@request.session[:user_id] = 2
1635	get :edit, :id => 1	1647	get :edit, :id => 1

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages