jro_apps/redmine Commit - r1905:394fc9c10945

Fixed: cross-project issue list should not show issues of projects for which the issue tracking module was disabled....

Jean-Philippe Lang -

r1905:394fc9c10945

parent child

Context file:

r1905:394fc9c10945

Collapse all files

test/unit/lib/redmine/access_control_test.rb created 644 +49 0

@@ -0,0 +1,49
	1	# Redmine - project management software
	2	# Copyright (C) 2006-2008 Jean-Philippe Lang
	3	#
	4	# This program is free software; you can redistribute it and/or
	5	# modify it under the terms of the GNU General Public License
	6	# as published by the Free Software Foundation; either version 2
	7	# of the License, or (at your option) any later version.
	8	#
	9	# This program is distributed in the hope that it will be useful,
	10	# but WITHOUT ANY WARRANTY; without even the implied warranty of
	11	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	12	# GNU General Public License for more details.
	13	#
	14	# You should have received a copy of the GNU General Public License
	15	# along with this program; if not, write to the Free Software
	16	# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
	17
	18	require File.dirname(__FILE__) + '/../../../test_helper'
	19
	20	class Redmine::AccessControlTest < Test::Unit::TestCase
	21
	22	def setup
	23	@access_module = Redmine::AccessControl
	24	end
	25
	26	def test_permissions
	27	perms = @access_module.permissions
	28	assert perms.is_a?(Array)
	29	assert perms.first.is_a?(Redmine::AccessControl::Permission)
	30	end
	31
	32	def test_module_permission
	33	perm = @access_module.permission(:view_issues)
	34	assert perm.is_a?(Redmine::AccessControl::Permission)
	35	assert_equal :view_issues, perm.name
	36	assert_equal :issue_tracking, perm.project_module
	37	assert perm.actions.is_a?(Array)
	38	assert perm.actions.include?('issues/index')
	39	end
	40
	41	def test_no_module_permission
	42	perm = @access_module.permission(:edit_project)
	43	assert perm.is_a?(Redmine::AccessControl::Permission)
	44	assert_equal :edit_project, perm.name
	45	assert_nil perm.project_module
	46	assert perm.actions.is_a?(Array)
	47	assert perm.actions.include?('projects/settings')
	48	end
	49	end

app/models/project.rb +6 0

               def self.allowed_to_condition(user, permission, options={})
                 statements = []
                 base_statement = "#{Project.table_name}.status=#{Project::STATUS_ACTIVE}"
+                if perm = Redmine::AccessControl.permission(permission)
+                  unless perm.project_module.nil?
+                    # If the permission belongs to a project module, make sure the module is enabled
+                    base_statement << " AND EXISTS (SELECT em.id FROM #{EnabledModule.table_name} em WHERE em.name='#{perm.project_module}' AND em.project_id=#{Project.table_name}.id)"
+                  end
+                end
                 if options[:project]
                   project_statement = "#{Project.table_name}.id = #{options[:project].id}"
                   project_statement << " OR #{Project.table_name}.parent_id = #{options[:project].id}" if options[:with_subprojects]

app/models/query.rb +1 -1

                 elsif project
                   project_clauses << "#{Project.table_name}.id = %d" % project.id
                 end
-                project_clauses <<  Project.visible_by(User.current)
+                project_clauses <<  Project.allowed_to_condition(User.current, :view_issues)
                 project_clauses.join(' AND ')
               end

lib/redmine/access_control.rb +9 -1

                     @permissions
                   end
+                  # Returns the permission of given name or nil if it wasn't found
+                  # Argument should be a symbol
+                  def permission(name)
+                    permissions.detect {|p| p.name == name}
+                  end
+                  # Returns the actions that are allowed by the permission of given name
                   def allowed_actions(permission_name)
-                    perm = @permissions.detect {|p| p.name == permission_name}
+                    perm = permission(permission_name)
                     perm ? perm.actions : []
                   end
                         @actions << "#{controller}/#{actions}"
                       end
                     end
+                    @actions.flatten!
                   end
                   def public?

test/fixtures/enabled_modules.yml +12 0

@@ -43,4 +43,16 enabled_modules_011:
43	name: issue_tracking	43	name: issue_tracking
44	project_id: 2	44	project_id: 2
45	id: 11	45	id: 11
		46	enabled_modules_012:
		47	name: time_tracking
		48	project_id: 3
		49	id: 12
		50	enabled_modules_013:
		51	name: issue_tracking
		52	project_id: 3
		53	id: 13
		54	enabled_modules_014:
		55	name: issue_tracking
		56	project_id: 5
		57	id: 14
46	No newline at end of file	58

test/functional/issues_controller_test.rb +11 0

@@ -62,6 +62,17 class IssuesControllerTest < Test::Unit::TestCase
62	assert_no_tag :tag => 'a', :content => /Issue of a private subproject/	62	assert_no_tag :tag => 'a', :content => /Issue of a private subproject/
63	assert_no_tag :tag => 'a', :content => /Issue on project 2/	63	assert_no_tag :tag => 'a', :content => /Issue on project 2/
64	end	64	end
		65
		66	def test_index_should_not_list_issues_when_module_disabled
		67	EnabledModule.delete_all("name = 'issue_tracking' AND project_id = 1")
		68	get :index
		69	assert_response :success
		70	assert_template 'index.rhtml'
		71	assert_not_nil assigns(:issues)
		72	assert_nil assigns(:project)
		73	assert_no_tag :tag => 'a', :content => /Can't print recipes/
		74	assert_tag :tag => 'a', :content => /Subproject issue/
		75	end
65		76
66	def test_index_with_project	77	def test_index_with_project
67	Setting.display_subprojects_issues = 0	78	Setting.display_subprojects_issues = 0

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages