jro_apps/redmine Commit - r8433:2a55d3761971

Check project assignment on issue copy/move....

Jean-Philippe Lang -

r8433:2a55d3761971

parent child

Context file:

r8433:2a55d3761971

Collapse all files

app/models/issue.rb +12 -2

                # Should be called from controllers instead of #attributes=
                # attr_accessible is too rough because we still want things like
                # Issue.new(:project => foo) to work
-               # TODO: move workflow/permission checks from controllers to here
                def safe_attributes=(attrs, user=User.current)
                  return unless attrs.is_a?(Hash)
                  # Project and Tracker must be set before since new_statuses_allowed_to depends on it.
                  if p = attrs.delete('project_id')
+                   if allowed_target_projects(user).collect(&:id).include?(p.to_i)
                    self.project_id = p
                  end
+                 end
                  if t = attrs.delete('tracker_id')
                    self.tracker_id = t
                end
                # End ReportsController extraction
-               # Returns an array of projects that current user can move issues to
+               # Returns an array of projects that user can assign the issue to
+               def allowed_target_projects(user=User.current)
+                 if new_record?
+                   Project.all(:conditions => Project.allowed_to_condition(user, :add_issues))
+                 else
+                   self.class.allowed_target_projects_on_move(user)
+                 end
+               end
+               # Returns an array of projects that user can move issues to
                def self.allowed_target_projects_on_move(user=User.current)
                  projects = []
                  if user.admin?

app/views/issues/_form.html.erb +1 -1

              <% end %>
              <% if @issue.safe_attribute? 'project_id' %>
-             <p><%= f.select :project_id, project_tree_options_for_select(Issue.allowed_target_projects_on_move, :selected => @issue.project), :required => true %></p>
+             <p><%= f.select :project_id, project_tree_options_for_select(@issue.allowed_target_projects, :selected => @issue.project), :required => true %></p>
              <%= observe_field :issue_project_id, :url => project_issue_form_path(@project, :id => @issue, :project_change => '1'),
                                                   :with => "Form.serialize('issue-form')" %>
              <% end %>

test/functional/issues_controller_test.rb +12 0

                  assert_tag 'input', :attributes => {:name => 'copy_from', :value => '1'}
                end
+               def test_create_as_copy_on_project_without_permission_should_ignore_target_project
+                 @request.session[:user_id] = 2
+                 assert !User.find(2).member_of?(Project.find(4))
+                 assert_difference 'Issue.count' do
+                   post :create, :project_id => 1, :copy_from => 1,
+                     :issue => {:project_id => '4', :tracker_id => '3', :status_id => '1', :subject => 'Copy'}
+                 end
+                 issue = Issue.first(:order => 'id DESC')
+                 assert_equal 1, issue.project_id
+               end
                def test_get_edit
                  @request.session[:user_id] = 2
                  get :edit, :id => 1

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages