jro_apps/redmine Commit - r1905:394fc9c10945

Fixed: cross-project issue list should not show issues of projects for which the issue tracking module was disabled....

Jean-Philippe Lang -

r1905:394fc9c10945

parent child

Context file:

r1905:394fc9c10945

Collapse all files

test/unit/lib/redmine/access_control_test.rb created 644 +49 0

@@ -0,0 +1,49
	1	# Redmine - project management software
	2	# Copyright (C) 2006-2008 Jean-Philippe Lang
	3	#
	4	# This program is free software; you can redistribute it and/or
	5	# modify it under the terms of the GNU General Public License
	6	# as published by the Free Software Foundation; either version 2
	7	# of the License, or (at your option) any later version.
	8	#
	9	# This program is distributed in the hope that it will be useful,
	10	# but WITHOUT ANY WARRANTY; without even the implied warranty of
	11	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	12	# GNU General Public License for more details.
	13	#
	14	# You should have received a copy of the GNU General Public License
	15	# along with this program; if not, write to the Free Software
	16	# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
	17
	18	require File.dirname(__FILE__) + '/../../../test_helper'
	19
	20	class Redmine::AccessControlTest < Test::Unit::TestCase
	21
	22	def setup
	23	@access_module = Redmine::AccessControl
	24	end
	25
	26	def test_permissions
	27	perms = @access_module.permissions
	28	assert perms.is_a?(Array)
	29	assert perms.first.is_a?(Redmine::AccessControl::Permission)
	30	end
	31
	32	def test_module_permission
	33	perm = @access_module.permission(:view_issues)
	34	assert perm.is_a?(Redmine::AccessControl::Permission)
	35	assert_equal :view_issues, perm.name
	36	assert_equal :issue_tracking, perm.project_module
	37	assert perm.actions.is_a?(Array)
	38	assert perm.actions.include?('issues/index')
	39	end
	40
	41	def test_no_module_permission
	42	perm = @access_module.permission(:edit_project)
	43	assert perm.is_a?(Redmine::AccessControl::Permission)
	44	assert_equal :edit_project, perm.name
	45	assert_nil perm.project_module
	46	assert perm.actions.is_a?(Array)
	47	assert perm.actions.include?('projects/settings')
	48	end
	49	end

app/models/project.rb +6 0

             # redMine - project management software
             # Copyright (C) 2006  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class Project < ActiveRecord::Base
               # Project statuses
               STATUS_ACTIVE     = 1
               STATUS_ARCHIVED   = 9
               has_many :members, :include => :user, :conditions => "#{User.table_name}.status=#{User::STATUS_ACTIVE}"
               has_many :users, :through => :members
               has_many :enabled_modules, :dependent => :delete_all
               has_and_belongs_to_many :trackers, :order => "#{Tracker.table_name}.position"
               has_many :issues, :dependent => :destroy, :order => "#{Issue.table_name}.created_on DESC", :include => [:status, :tracker]
               has_many :issue_changes, :through => :issues, :source => :journals
               has_many :versions, :dependent => :destroy, :order => "#{Version.table_name}.effective_date DESC, #{Version.table_name}.name DESC"
               has_many :time_entries, :dependent => :delete_all
               has_many :queries, :dependent => :delete_all
               has_many :documents, :dependent => :destroy
               has_many :news, :dependent => :delete_all, :include => :author
               has_many :issue_categories, :dependent => :delete_all, :order => "#{IssueCategory.table_name}.name"
               has_many :boards, :dependent => :destroy, :order => "position ASC"
               has_one :repository, :dependent => :destroy
               has_many :changesets, :through => :repository
               has_one :wiki, :dependent => :destroy
               # Custom field for the project issues
               has_and_belongs_to_many :issue_custom_fields,
                                       :class_name => 'IssueCustomField',
                                       :order => "#{CustomField.table_name}.position",
                                       :join_table => "#{table_name_prefix}custom_fields_projects#{table_name_suffix}",
                                       :association_foreign_key => 'custom_field_id'
               acts_as_tree :order => "name", :counter_cache => true
               acts_as_customizable
               acts_as_searchable :columns => ['name', 'description'], :project_key => 'id', :permission => nil
               acts_as_event :title => Proc.new {|o| "#{l(:label_project)}: #{o.name}"},
                             :url => Proc.new {|o| {:controller => 'projects', :action => 'show', :id => o.id}},
                             :author => nil
               attr_protected :status, :enabled_module_names
               validates_presence_of :name, :identifier
               validates_uniqueness_of :name, :identifier
               validates_associated :repository, :wiki
               validates_length_of :name, :maximum => 30
               validates_length_of :homepage, :maximum => 255
               validates_length_of :identifier, :in => 3..20
               validates_format_of :identifier, :with => /^[a-z0-9\-]*$/
               before_destroy :delete_all_members
               named_scope :has_module, lambda { |mod| { :conditions => ["#{Project.table_name}.id IN (SELECT em.project_id FROM #{EnabledModule.table_name} em WHERE em.name=?)", mod.to_s] } }
               def identifier=(identifier)
                 super unless identifier_frozen?
               end
               def identifier_frozen?
                 errors[:identifier].nil? && !(new_record? || identifier.blank?)
               end
               def issues_with_subprojects(include_subprojects=false)
                 conditions = nil
                 if include_subprojects
                   ids = [id] + child_ids
                   conditions = ["#{Project.table_name}.id IN (#{ids.join(',')}) AND #{Project.visible_by}"]
                 end
                 conditions ||= ["#{Project.table_name}.id = ?", id]
                 # Quick and dirty fix for Rails 2 compatibility
                 Issue.send(:with_scope, :find => { :conditions => conditions }) do
                   Version.send(:with_scope, :find => { :conditions => conditions }) do
                     yield
                   end
                 end
               end
               # returns latest created projects
               # non public projects will be returned only if user is a member of those
               def self.latest(user=nil, count=5)
                 find(:all, :limit => count, :conditions => visible_by(user), :order => "created_on DESC")
               end
               def self.visible_by(user=nil)
                 user ||= User.current
                 if user && user.admin?
                   return "#{Project.table_name}.status=#{Project::STATUS_ACTIVE}"
                 elsif user && user.memberships.any?
                   return "#{Project.table_name}.status=#{Project::STATUS_ACTIVE} AND (#{Project.table_name}.is_public = #{connection.quoted_true} or #{Project.table_name}.id IN (#{user.memberships.collect{|m| m.project_id}.join(',')}))"
                 else
                   return "#{Project.table_name}.status=#{Project::STATUS_ACTIVE} AND #{Project.table_name}.is_public = #{connection.quoted_true}"
                 end
               end
               def self.allowed_to_condition(user, permission, options={})
                 statements = []
                 base_statement = "#{Project.table_name}.status=#{Project::STATUS_ACTIVE}"
+                if perm = Redmine::AccessControl.permission(permission)
+                  unless perm.project_module.nil?
+                    # If the permission belongs to a project module, make sure the module is enabled
+                    base_statement << " AND EXISTS (SELECT em.id FROM #{EnabledModule.table_name} em WHERE em.name='#{perm.project_module}' AND em.project_id=#{Project.table_name}.id)"
+                  end
+                end
                 if options[:project]
                   project_statement = "#{Project.table_name}.id = #{options[:project].id}"
                   project_statement << " OR #{Project.table_name}.parent_id = #{options[:project].id}" if options[:with_subprojects]
                   base_statement = "(#{project_statement}) AND (#{base_statement})"
                 end
                 if user.admin?
                   # no restriction
                 else
                   statements << "1=0"
                   if user.logged?
                     statements << "#{Project.table_name}.is_public = #{connection.quoted_true}" if Role.non_member.allowed_to?(permission)
                     allowed_project_ids = user.memberships.select {|m| m.role.allowed_to?(permission)}.collect {|m| m.project_id}
                     statements << "#{Project.table_name}.id IN (#{allowed_project_ids.join(',')})" if allowed_project_ids.any?
                   elsif Role.anonymous.allowed_to?(permission)
                     # anonymous user allowed on public project
                     statements << "#{Project.table_name}.is_public = #{connection.quoted_true}"
                   else
                     # anonymous user is not authorized
                   end
                 end
                 statements.empty? ? base_statement : "((#{base_statement}) AND (#{statements.join(' OR ')}))"
               end
               def project_condition(with_subprojects)
                 cond = "#{Project.table_name}.id = #{id}"
                 cond = "(#{cond} OR #{Project.table_name}.parent_id = #{id})" if with_subprojects
                 cond
               end
               def self.find(*args)
                 if args.first && args.first.is_a?(String) && !args.first.match(/^\d*$/)
                   project = find_by_identifier(*args)
                   raise ActiveRecord::RecordNotFound, "Couldn't find Project with identifier=#{args.first}" if project.nil?
                   project
                 else
                   super
                 end
               end
               def to_param
                 # id is used for projects with a numeric identifier (compatibility)
                 @to_param ||= (identifier.to_s =~ %r{^\d*$} ? id : identifier)
               end
               def active?
                 self.status == STATUS_ACTIVE
               end
               def archive
                 # Archive subprojects if any
                 children.each do |subproject|
                   subproject.archive
                 end
                 update_attribute :status, STATUS_ARCHIVED
               end
               def unarchive
                 return false if parent && !parent.active?
                 update_attribute :status, STATUS_ACTIVE
               end
               def active_children
                 children.select {|child| child.active?}
               end
               # Returns an array of the trackers used by the project and its sub projects
               def rolled_up_trackers
                 @rolled_up_trackers ||=
                   Tracker.find(:all, :include => :projects,
                                      :select => "DISTINCT #{Tracker.table_name}.*",
                                      :conditions => ["#{Project.table_name}.id = ? OR #{Project.table_name}.parent_id = ?", id, id],
                                      :order => "#{Tracker.table_name}.position")
               end
               # Deletes all project's members
               def delete_all_members
                 Member.delete_all(['project_id = ?', id])
               end
               # Users issues can be assigned to
               def assignable_users
                 members.select {|m| m.role.assignable?}.collect {|m| m.user}.sort
               end
               # Returns the mail adresses of users that should be always notified on project events
               def recipients
                 members.select {|m| m.mail_notification? || m.user.mail_notification?}.collect {|m| m.user.mail}
               end
               # Returns an array of all custom fields enabled for project issues
               # (explictly associated custom fields and custom fields enabled for all projects)
               def all_issue_custom_fields
                 @all_issue_custom_fields ||= (IssueCustomField.for_all + issue_custom_fields).uniq.sort
               end
               def project
                 self
               end
               def <=>(project)
                 name.downcase <=> project.name.downcase
               end
               def to_s
                 name
               end
               # Returns a short description of the projects (first lines)
               def short_description(length = 255)
                 description.gsub(/^(.{#{length}}[^\n]*).*$/m, '\1').strip if description
               end
               def allows_to?(action)
                 if action.is_a? Hash
                   allowed_actions.include? "#{action[:controller]}/#{action[:action]}"
                 else
                   allowed_permissions.include? action
                 end
               end
               def module_enabled?(module_name)
                 module_name = module_name.to_s
                 enabled_modules.detect {|m| m.name == module_name}
               end
               def enabled_module_names=(module_names)
                 enabled_modules.clear
                 module_names = [] unless module_names && module_names.is_a?(Array)
                 module_names.each do |name|
                   enabled_modules << EnabledModule.new(:name => name.to_s)
                 end
               end
               # Returns an auto-generated project identifier based on the last identifier used
               def self.next_identifier
                 p = Project.find(:first, :order => 'created_on DESC')
                 p.nil? ? nil : p.identifier.to_s.succ
               end
             protected
               def validate
                 errors.add(parent_id, " must be a root project") if parent and parent.parent
                 errors.add_to_base("A project with subprojects can't be a subproject") if parent and children.size > 0
                 errors.add(:identifier, :activerecord_error_invalid) if !identifier.blank? && identifier.match(/^\d*$/)
               end
             private
               def allowed_permissions
                 @allowed_permissions ||= begin
                   module_names = enabled_modules.collect {|m| m.name}
                   Redmine::AccessControl.modules_permissions(module_names).collect {|p| p.name}
                 end
               end
               def allowed_actions
                 @actions_allowed ||= allowed_permissions.inject([]) { |actions, permission| actions += Redmine::AccessControl.allowed_actions(permission) }.flatten
               end
             end

app/models/query.rb +1 -1

             # Redmine - project management software
             # Copyright (C) 2006-2008  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class QueryColumn
               attr_accessor :name, :sortable, :default_order
               include GLoc
               def initialize(name, options={})
                 self.name = name
                 self.sortable = options[:sortable]
                 self.default_order = options[:default_order]
               end
               def caption
                 set_language_if_valid(User.current.language)
                 l("field_#{name}")
               end
             end
             class QueryCustomFieldColumn < QueryColumn
               def initialize(custom_field)
                 self.name = "cf_#{custom_field.id}".to_sym
                 self.sortable = false
                 @cf = custom_field
               end
               def caption
                 @cf.name
               end
               def custom_field
                 @cf
               end
             end
             class Query < ActiveRecord::Base
               belongs_to :project
               belongs_to :user
               serialize :filters
               serialize :column_names
               attr_protected :project_id, :user_id
               validates_presence_of :name, :on => :save
               validates_length_of :name, :maximum => 255
               @@operators = { "="   => :label_equals,
                               "!"   => :label_not_equals,
                               "o"   => :label_open_issues,
                               "c"   => :label_closed_issues,
                               "!*"  => :label_none,
                               "*"   => :label_all,
                               ">="   => '>=',
                               "<="   => '<=',
                               "<t+" => :label_in_less_than,
                               ">t+" => :label_in_more_than,
                               "t+"  => :label_in,
                               "t"   => :label_today,
                               "w"   => :label_this_week,
                               ">t-" => :label_less_than_ago,
                               "<t-" => :label_more_than_ago,
                               "t-"  => :label_ago,
                               "~"   => :label_contains,
                               "!~"  => :label_not_contains }
               cattr_reader :operators
               @@operators_by_filter_type = { :list => [ "=", "!" ],
                                              :list_status => [ "o", "=", "!", "c", "*" ],
                                              :list_optional => [ "=", "!", "!*", "*" ],
                                              :list_subprojects => [ "*", "!*", "=" ],
                                              :date => [ "<t+", ">t+", "t+", "t", "w", ">t-", "<t-", "t-" ],
                                              :date_past => [ ">t-", "<t-", "t-", "t", "w" ],
                                              :string => [ "=", "~", "!", "!~" ],
                                              :text => [  "~", "!~" ],
                                              :integer => [ "=", ">=", "<=", "!*", "*" ] }
               cattr_reader :operators_by_filter_type
               @@available_columns = [
                 QueryColumn.new(:tracker, :sortable => "#{Tracker.table_name}.position"),
                 QueryColumn.new(:status, :sortable => "#{IssueStatus.table_name}.position"),
                 QueryColumn.new(:priority, :sortable => "#{Enumeration.table_name}.position", :default_order => 'desc'),
                 QueryColumn.new(:subject, :sortable => "#{Issue.table_name}.subject"),
                 QueryColumn.new(:author),
                 QueryColumn.new(:assigned_to, :sortable => "#{User.table_name}.lastname"),
                 QueryColumn.new(:updated_on, :sortable => "#{Issue.table_name}.updated_on", :default_order => 'desc'),
                 QueryColumn.new(:category, :sortable => "#{IssueCategory.table_name}.name"),
                 QueryColumn.new(:fixed_version, :sortable => "#{Version.table_name}.effective_date", :default_order => 'desc'),
                 QueryColumn.new(:start_date, :sortable => "#{Issue.table_name}.start_date"),
                 QueryColumn.new(:due_date, :sortable => "#{Issue.table_name}.due_date"),
                 QueryColumn.new(:estimated_hours, :sortable => "#{Issue.table_name}.estimated_hours"),
                 QueryColumn.new(:done_ratio, :sortable => "#{Issue.table_name}.done_ratio"),
                 QueryColumn.new(:created_on, :sortable => "#{Issue.table_name}.created_on", :default_order => 'desc'),
               ]
               cattr_reader :available_columns
               def initialize(attributes = nil)
                 super attributes
                 self.filters ||= { 'status_id' => {:operator => "o", :values => [""]} }
                 set_language_if_valid(User.current.language)
               end
               def after_initialize
                 # Store the fact that project is nil (used in #editable_by?)
                 @is_for_all = project.nil?
               end
               def validate
                 filters.each_key do |field|
                   errors.add label_for(field), :activerecord_error_blank unless
                       # filter requires one or more values
                       (values_for(field) and !values_for(field).first.blank?) or
                       # filter doesn't require any value
                       ["o", "c", "!*", "*", "t", "w"].include? operator_for(field)
                 end if filters
               end
               def editable_by?(user)
                 return false unless user
                 # Admin can edit them all and regular users can edit their private queries
                 return true if user.admin? || (!is_public && self.user_id == user.id)
                 # Members can not edit public queries that are for all project (only admin is allowed to)
                 is_public && !@is_for_all && user.allowed_to?(:manage_public_queries, project)
               end
               def available_filters
                 return @available_filters if @available_filters
                 trackers = project.nil? ? Tracker.find(:all, :order => 'position') : project.rolled_up_trackers
                 @available_filters = { "status_id" => { :type => :list_status, :order => 1, :values => IssueStatus.find(:all, :order => 'position').collect{|s| [s.name, s.id.to_s] } },
                                        "tracker_id" => { :type => :list, :order => 2, :values => trackers.collect{|s| [s.name, s.id.to_s] } },
                                        "priority_id" => { :type => :list, :order => 3, :values => Enumeration.find(:all, :conditions => ['opt=?','IPRI'], :order => 'position').collect{|s| [s.name, s.id.to_s] } },
                                        "subject" => { :type => :text, :order => 8 },
                                        "created_on" => { :type => :date_past, :order => 9 },
                                        "updated_on" => { :type => :date_past, :order => 10 },
                                        "start_date" => { :type => :date, :order => 11 },
                                        "due_date" => { :type => :date, :order => 12 },
                                        "estimated_hours" => { :type => :integer, :order => 13 },
                                        "done_ratio" =>  { :type => :integer, :order => 14 }}
                 user_values = []
                 user_values << ["<< #{l(:label_me)} >>", "me"] if User.current.logged?
                 if project
                   user_values += project.users.sort.collect{|s| [s.name, s.id.to_s] }
                 else
                   # members of the user's projects
                   user_values += User.current.projects.collect(&:users).flatten.uniq.sort.collect{|s| [s.name, s.id.to_s] }
                 end
                 @available_filters["assigned_to_id"] = { :type => :list_optional, :order => 4, :values => user_values } unless user_values.empty?
                 @available_filters["author_id"] = { :type => :list, :order => 5, :values => user_values } unless user_values.empty?
                 if project
                   # project specific filters
                   unless @project.issue_categories.empty?
                     @available_filters["category_id"] = { :type => :list_optional, :order => 6, :values => @project.issue_categories.collect{|s| [s.name, s.id.to_s] } }
                   end
                   unless @project.versions.empty?
                     @available_filters["fixed_version_id"] = { :type => :list_optional, :order => 7, :values => @project.versions.sort.collect{|s| [s.name, s.id.to_s] } }
                   end
                   unless @project.active_children.empty?
                     @available_filters["subproject_id"] = { :type => :list_subprojects, :order => 13, :values => @project.active_children.collect{|s| [s.name, s.id.to_s] } }
                   end
                   add_custom_fields_filters(@project.all_issue_custom_fields)
                 else
                   # global filters for cross project issue list
                   add_custom_fields_filters(IssueCustomField.find(:all, :conditions => {:is_filter => true, :is_for_all => true}))
                 end
                 @available_filters
               end
               def add_filter(field, operator, values)
                 # values must be an array
                 return unless values and values.is_a? Array # and !values.first.empty?
                 # check if field is defined as an available filter
                 if available_filters.has_key? field
                   filter_options = available_filters[field]
                   # check if operator is allowed for that filter
                   #if @@operators_by_filter_type[filter_options[:type]].include? operator
                   #  allowed_values = values & ([""] + (filter_options[:values] || []).collect {|val| val[1]})
                   #  filters[field] = {:operator => operator, :values => allowed_values } if (allowed_values.first and !allowed_values.first.empty?) or ["o", "c", "!*", "*", "t"].include? operator
                   #end
                   filters[field] = {:operator => operator, :values => values }
                 end
               end
               def add_short_filter(field, expression)
                 return unless expression
                 parms = expression.scan(/^(o|c|\!|\*)?(.*)$/).first
                 add_filter field, (parms[0] || "="), [parms[1] || ""]
               end
               def has_filter?(field)
                 filters and filters[field]
               end
               def operator_for(field)
                 has_filter?(field) ? filters[field][:operator] : nil
               end
               def values_for(field)
                 has_filter?(field) ? filters[field][:values] : nil
               end
               def label_for(field)
                 label = available_filters[field][:name] if available_filters.has_key?(field)
                 label ||= field.gsub(/\_id$/, "")
               end
               def available_columns
                 return @available_columns if @available_columns
                 @available_columns = Query.available_columns
                 @available_columns += (project ?
                                         project.all_issue_custom_fields :
                                         IssueCustomField.find(:all, :conditions => {:is_for_all => true})
                                        ).collect {|cf| QueryCustomFieldColumn.new(cf) }
               end
               def columns
                 if has_default_columns?
                   available_columns.select {|c| Setting.issue_list_default_columns.include?(c.name.to_s) }
                 else
                   # preserve the column_names order
                   column_names.collect {|name| available_columns.find {|col| col.name == name}}.compact
                 end
               end
               def column_names=(names)
                 names = names.select {|n| n.is_a?(Symbol) || !n.blank? } if names
                 names = names.collect {|n| n.is_a?(Symbol) ? n : n.to_sym } if names
                 write_attribute(:column_names, names)
               end
               def has_column?(column)
                 column_names && column_names.include?(column.name)
               end
               def has_default_columns?
                 column_names.nil? || column_names.empty?
               end
               def project_statement
                 project_clauses = []
                 if project && !@project.active_children.empty?
                   ids = [project.id]
                   if has_filter?("subproject_id")
                     case operator_for("subproject_id")
                     when '='
                       # include the selected subprojects
                       ids += values_for("subproject_id").each(&:to_i)
                     when '!*'
                       # main project only
                     else
                       # all subprojects
                       ids += project.child_ids
                     end
                   elsif Setting.display_subprojects_issues?
                     ids += project.child_ids
                   end
                   project_clauses << "#{Project.table_name}.id IN (%s)" % ids.join(',')
                 elsif project
                   project_clauses << "#{Project.table_name}.id = %d" % project.id
                 end
-                project_clauses <<  Project.visible_by(User.current)
+                project_clauses <<  Project.allowed_to_condition(User.current, :view_issues)
                 project_clauses.join(' AND ')
               end
               def statement
                 # filters clauses
                 filters_clauses = []
                 filters.each_key do |field|
                   next if field == "subproject_id"
                   v = values_for(field).clone
                   next unless v and !v.empty?
                   sql = ''
                   is_custom_filter = false
                   if field =~ /^cf_(\d+)$/
                     # custom field
                     db_table = CustomValue.table_name
                     db_field = 'value'
                     is_custom_filter = true
                     sql << "#{Issue.table_name}.id IN (SELECT #{Issue.table_name}.id FROM #{Issue.table_name} LEFT OUTER JOIN #{db_table} ON #{db_table}.customized_type='Issue' AND #{db_table}.customized_id=#{Issue.table_name}.id AND #{db_table}.custom_field_id=#{$1} WHERE "
                   else
                     # regular field
                     db_table = Issue.table_name
                     db_field = field
                     sql << '('
                   end
                   # "me" value subsitution
                   if %w(assigned_to_id author_id).include?(field)
                     v.push(User.current.logged? ? User.current.id.to_s : "0") if v.delete("me")
                   end
                   case operator_for field
                   when "="
                     sql = sql + "#{db_table}.#{db_field} IN (" + v.collect{|val| "'#{connection.quote_string(val)}'"}.join(",") + ")"
                   when "!"
                     sql = sql + "(#{db_table}.#{db_field} IS NULL OR #{db_table}.#{db_field} NOT IN (" + v.collect{|val| "'#{connection.quote_string(val)}'"}.join(",") + "))"
                   when "!*"
                     sql = sql + "#{db_table}.#{db_field} IS NULL"
                     sql << " OR #{db_table}.#{db_field} = ''" if is_custom_filter
                   when "*"
                     sql = sql + "#{db_table}.#{db_field} IS NOT NULL"
                     sql << " AND #{db_table}.#{db_field} <> ''" if is_custom_filter
                   when ">="
                     sql = sql + "#{db_table}.#{db_field} >= #{v.first.to_i}"
                   when "<="
                     sql = sql + "#{db_table}.#{db_field} <= #{v.first.to_i}"
                   when "o"
                     sql = sql + "#{IssueStatus.table_name}.is_closed=#{connection.quoted_false}" if field == "status_id"
                   when "c"
                     sql = sql + "#{IssueStatus.table_name}.is_closed=#{connection.quoted_true}" if field == "status_id"
                   when ">t-"
                     sql = sql + "#{db_table}.#{db_field} BETWEEN '%s' AND '%s'" % [connection.quoted_date((Date.today - v.first.to_i).to_time), connection.quoted_date((Date.today + 1).to_time)]
                   when "<t-"
                     sql = sql + "#{db_table}.#{db_field} <= '%s'" % connection.quoted_date((Date.today - v.first.to_i).to_time)
                   when "t-"
                     sql = sql + "#{db_table}.#{db_field} BETWEEN '%s' AND '%s'" % [connection.quoted_date((Date.today - v.first.to_i).to_time), connection.quoted_date((Date.today - v.first.to_i + 1).to_time)]
                   when ">t+"
                     sql = sql + "#{db_table}.#{db_field} >= '%s'" % connection.quoted_date((Date.today + v.first.to_i).to_time)
                   when "<t+"
                     sql = sql + "#{db_table}.#{db_field} BETWEEN '%s' AND '%s'" % [connection.quoted_date(Date.today.to_time), connection.quoted_date((Date.today + v.first.to_i + 1).to_time)]
                   when "t+"
                     sql = sql + "#{db_table}.#{db_field} BETWEEN '%s' AND '%s'" % [connection.quoted_date((Date.today + v.first.to_i).to_time), connection.quoted_date((Date.today + v.first.to_i + 1).to_time)]
                   when "t"
                     sql = sql + "#{db_table}.#{db_field} BETWEEN '%s' AND '%s'" % [connection.quoted_date(Date.today.to_time), connection.quoted_date((Date.today+1).to_time)]
                   when "w"
                     from = l(:general_first_day_of_week) == '7' ?
                       # week starts on sunday
                       ((Date.today.cwday == 7) ? Time.now.at_beginning_of_day : Time.now.at_beginning_of_week - 1.day) :
                       # week starts on monday (Rails default)
                       Time.now.at_beginning_of_week
                     sql = sql + "#{db_table}.#{db_field} BETWEEN '%s' AND '%s'" % [connection.quoted_date(from), connection.quoted_date(from + 7.days)]
                   when "~"
                     sql = sql + "#{db_table}.#{db_field} LIKE '%#{connection.quote_string(v.first)}%'"
                   when "!~"
                     sql = sql + "#{db_table}.#{db_field} NOT LIKE '%#{connection.quote_string(v.first)}%'"
                   end
                   sql << ')'
                   filters_clauses << sql
                 end if filters and valid?
                 (filters_clauses << project_statement).join(' AND ')
               end
               private
               def add_custom_fields_filters(custom_fields)
                 @available_filters ||= {}
                 custom_fields.select(&:is_filter?).each do |field|
                   case field.field_format
                   when "text"
                     options = { :type => :text, :order => 20 }
                   when "list"
                     options = { :type => :list_optional, :values => field.possible_values, :order => 20}
                   when "date"
                     options = { :type => :date, :order => 20 }
                   when "bool"
                     options = { :type => :list, :values => [[l(:general_text_yes), "1"], [l(:general_text_no), "0"]], :order => 20 }
                   else
                     options = { :type => :string, :order => 20 }
                   end
                   @available_filters["cf_#{field.id}"] = options.merge({ :name => field.name })
                 end
               end
             end

lib/redmine/access_control.rb +9 -1

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             module Redmine
               module AccessControl
                 class << self
                   def map
                     mapper = Mapper.new
                     yield mapper
                     @permissions ||= []
                     @permissions += mapper.mapped_permissions
                   end
                   def permissions
                     @permissions
                   end
+                  # Returns the permission of given name or nil if it wasn't found
+                  # Argument should be a symbol
+                  def permission(name)
+                    permissions.detect {|p| p.name == name}
+                  end
+                  # Returns the actions that are allowed by the permission of given name
                   def allowed_actions(permission_name)
-                    perm = @permissions.detect {|p| p.name == permission_name}
+                    perm = permission(permission_name)
                     perm ? perm.actions : []
                   end
                   def public_permissions
                     @public_permissions ||= @permissions.select {|p| p.public?}
                   end
                   def members_only_permissions
                     @members_only_permissions ||= @permissions.select {|p| p.require_member?}
                   end
                   def loggedin_only_permissions
                     @loggedin_only_permissions ||= @permissions.select {|p| p.require_loggedin?}
                   end
                   def available_project_modules
                     @available_project_modules ||= @permissions.collect(&:project_module).uniq.compact
                   end
                   def modules_permissions(modules)
                     @permissions.select {|p| p.project_module.nil? || modules.include?(p.project_module.to_s)}
                   end
                 end
                 class Mapper
                   def initialize
                     @project_module = nil
                   end
                   def permission(name, hash, options={})
                     @permissions ||= []
                     options.merge!(:project_module => @project_module)
                     @permissions << Permission.new(name, hash, options)
                   end
                   def project_module(name, options={})
                     @project_module = name
                     yield self
                     @project_module = nil
                   end
                   def mapped_permissions
                     @permissions
                   end
                 end
                 class Permission
                   attr_reader :name, :actions, :project_module
                   def initialize(name, hash, options)
                     @name = name
                     @actions = []
                     @public = options[:public] || false
                     @require = options[:require]
                     @project_module = options[:project_module]
                     hash.each do |controller, actions|
                       if actions.is_a? Array
                         @actions << actions.collect {|action| "#{controller}/#{action}"}
                       else
                         @actions << "#{controller}/#{actions}"
                       end
                     end
+                    @actions.flatten!
                   end
                   def public?
                     @public
                   end
                   def require_member?
                     @require && @require == :member
                   end
                   def require_loggedin?
                     @require && (@require == :member || @require == :loggedin)
                   end
                 end
               end
             end

test/fixtures/enabled_modules.yml +12 0

             ---
             enabled_modules_001:
               name: issue_tracking
               project_id: 1
               id: 1
             enabled_modules_002:
               name: time_tracking
               project_id: 1
               id: 2
             enabled_modules_003:
               name: news
               project_id: 1
               id: 3
             enabled_modules_004:
               name: documents
               project_id: 1
               id: 4
             enabled_modules_005:
               name: files
               project_id: 1
               id: 5
             enabled_modules_006:
               name: wiki
               project_id: 1
               id: 6
             enabled_modules_007:
               name: repository
               project_id: 1
               id: 7
             enabled_modules_008:
               name: boards
               project_id: 1
               id: 8
             enabled_modules_009:
               name: repository
               project_id: 3
               id: 9
             enabled_modules_010:
               name: wiki
               project_id: 3
               id: 10
             enabled_modules_011:
               name: issue_tracking
               project_id: 2
               id: 11
+            enabled_modules_012:
+              name: time_tracking
+              project_id: 3
+              id: 12
+            enabled_modules_013:
+              name: issue_tracking
+              project_id: 3
+              id: 13
+            enabled_modules_014:
+              name: issue_tracking
+              project_id: 5
+              id: 14
   No newline at end of file

test/functional/issues_controller_test.rb +11 0

             # Redmine - project management software
             # Copyright (C) 2006-2008  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.dirname(__FILE__) + '/../test_helper'
             require 'issues_controller'
             # Re-raise errors caught by the controller.
             class IssuesController; def rescue_action(e) raise e end; end
             class IssuesControllerTest < Test::Unit::TestCase
               fixtures :projects,
                        :users,
                        :roles,
                        :members,
                        :issues,
                        :issue_statuses,
                        :versions,
                        :trackers,
                        :projects_trackers,
                        :issue_categories,
                        :enabled_modules,
                        :enumerations,
                        :attachments,
                        :workflows,
                        :custom_fields,
                        :custom_values,
                        :custom_fields_trackers,
                        :time_entries,
                        :journals,
                        :journal_details
               def setup
                 @controller = IssuesController.new
                 @request    = ActionController::TestRequest.new
                 @response   = ActionController::TestResponse.new
                 User.current = nil
               end
               def test_index
                 get :index
                 assert_response :success
                 assert_template 'index.rhtml'
                 assert_not_nil assigns(:issues)
                 assert_nil assigns(:project)
                 assert_tag :tag => 'a', :content => /Can't print recipes/
                 assert_tag :tag => 'a', :content => /Subproject issue/
                 # private projects hidden
                 assert_no_tag :tag => 'a', :content => /Issue of a private subproject/
                 assert_no_tag :tag => 'a', :content => /Issue on project 2/
               end
+              def test_index_should_not_list_issues_when_module_disabled
+                EnabledModule.delete_all("name = 'issue_tracking' AND project_id = 1")
+                get :index
+                assert_response :success
+                assert_template 'index.rhtml'
+                assert_not_nil assigns(:issues)
+                assert_nil assigns(:project)
+                assert_no_tag :tag => 'a', :content => /Can't print recipes/
+                assert_tag :tag => 'a', :content => /Subproject issue/
+              end
               def test_index_with_project
                 Setting.display_subprojects_issues = 0
                 get :index, :project_id => 1
                 assert_response :success
                 assert_template 'index.rhtml'
                 assert_not_nil assigns(:issues)
                 assert_tag :tag => 'a', :content => /Can't print recipes/
                 assert_no_tag :tag => 'a', :content => /Subproject issue/
               end
               def test_index_with_project_and_subprojects
                 Setting.display_subprojects_issues = 1
                 get :index, :project_id => 1
                 assert_response :success
                 assert_template 'index.rhtml'
                 assert_not_nil assigns(:issues)
                 assert_tag :tag => 'a', :content => /Can't print recipes/
                 assert_tag :tag => 'a', :content => /Subproject issue/
                 assert_no_tag :tag => 'a', :content => /Issue of a private subproject/
               end
               def test_index_with_project_and_subprojects_should_show_private_subprojects
                 @request.session[:user_id] = 2
                 Setting.display_subprojects_issues = 1
                 get :index, :project_id => 1
                 assert_response :success
                 assert_template 'index.rhtml'
                 assert_not_nil assigns(:issues)
                 assert_tag :tag => 'a', :content => /Can't print recipes/
                 assert_tag :tag => 'a', :content => /Subproject issue/
                 assert_tag :tag => 'a', :content => /Issue of a private subproject/
               end
               def test_index_with_project_and_filter
                 get :index, :project_id => 1, :set_filter => 1
                 assert_response :success
                 assert_template 'index.rhtml'
                 assert_not_nil assigns(:issues)
               end
               def test_index_csv_with_project
                 get :index, :format => 'csv'
                 assert_response :success
                 assert_not_nil assigns(:issues)
                 assert_equal 'text/csv', @response.content_type
                 get :index, :project_id => 1, :format => 'csv'
                 assert_response :success
                 assert_not_nil assigns(:issues)
                 assert_equal 'text/csv', @response.content_type
               end
               def test_index_pdf
                 get :index, :format => 'pdf'
                 assert_response :success
                 assert_not_nil assigns(:issues)
                 assert_equal 'application/pdf', @response.content_type
                 get :index, :project_id => 1, :format => 'pdf'
                 assert_response :success
                 assert_not_nil assigns(:issues)
                 assert_equal 'application/pdf', @response.content_type
               end
               def test_gantt
                 get :gantt, :project_id => 1
                 assert_response :success
                 assert_template 'gantt.rhtml'
                 assert_not_nil assigns(:gantt)
                 events = assigns(:gantt).events
                 assert_not_nil events
                 # Issue with start and due dates
                 i = Issue.find(1)
                 assert_not_nil i.due_date
                 assert events.include?(Issue.find(1))
                 # Issue with without due date but targeted to a version with date
                 i = Issue.find(2)
                 assert_nil i.due_date
                 assert events.include?(i)
               end
               def test_gantt_export_to_pdf
                 get :gantt, :project_id => 1, :format => 'pdf'
                 assert_response :success
                 assert_template 'gantt.rfpdf'
                 assert_equal 'application/pdf', @response.content_type
                 assert_not_nil assigns(:gantt)
               end
               if Object.const_defined?(:Magick)
                 def test_gantt_image
                   get :gantt, :project_id => 1, :format => 'png'
                   assert_response :success
                   assert_equal 'image/png', @response.content_type
                 end
               else
                 puts "RMagick not installed. Skipping tests !!!"
               end
               def test_calendar
                 get :calendar, :project_id => 1
                 assert_response :success
                 assert_template 'calendar'
                 assert_not_nil assigns(:calendar)
               end
               def test_changes
                 get :changes, :project_id => 1
                 assert_response :success
                 assert_not_nil assigns(:journals)
                 assert_equal 'application/atom+xml', @response.content_type
               end
               def test_show_by_anonymous
                 get :show, :id => 1
                 assert_response :success
                 assert_template 'show.rhtml'
                 assert_not_nil assigns(:issue)
                 assert_equal Issue.find(1), assigns(:issue)
                 # anonymous role is allowed to add a note
                 assert_tag :tag => 'form',
                            :descendant => { :tag => 'fieldset',
                                             :child => { :tag => 'legend',
                                                         :content => /Notes/ } }
               end
               def test_show_by_manager
                 @request.session[:user_id] = 2
                 get :show, :id => 1
                 assert_response :success
                 assert_tag :tag => 'form',
                            :descendant => { :tag => 'fieldset',
                                             :child => { :tag => 'legend',
                                                         :content => /Change properties/ } },
                            :descendant => { :tag => 'fieldset',
                                             :child => { :tag => 'legend',
                                                         :content => /Log time/ } },
                            :descendant => { :tag => 'fieldset',
                                             :child => { :tag => 'legend',
                                                         :content => /Notes/ } }
               end
               def test_get_new
                 @request.session[:user_id] = 2
                 get :new, :project_id => 1, :tracker_id => 1
                 assert_response :success
                 assert_template 'new'
                 assert_tag :tag => 'input', :attributes => { :name => 'issue[custom_field_values][2]',
                                                              :value => 'Default string' }
               end
               def test_get_new_without_tracker_id
                 @request.session[:user_id] = 2
                 get :new, :project_id => 1
                 assert_response :success
                 assert_template 'new'
                 issue = assigns(:issue)
                 assert_not_nil issue
                 assert_equal Project.find(1).trackers.first, issue.tracker
               end
               def test_update_new_form
                 @request.session[:user_id] = 2
                 xhr :post, :new, :project_id => 1,
                                  :issue => {:tracker_id => 2,
                                             :subject => 'This is the test_new issue',
                                             :description => 'This is the description',
                                             :priority_id => 5}
                 assert_response :success
                 assert_template 'new'
               end
               def test_post_new
                 @request.session[:user_id] = 2
                 post :new, :project_id => 1,
                            :issue => {:tracker_id => 3,
                                       :subject => 'This is the test_new issue',
                                       :description => 'This is the description',
                                       :priority_id => 5,
                                       :estimated_hours => '',
                                       :custom_field_values => {'2' => 'Value for field 2'}}
                 assert_redirected_to 'issues/show'
                 issue = Issue.find_by_subject('This is the test_new issue')
                 assert_not_nil issue
                 assert_equal 2, issue.author_id
                 assert_equal 3, issue.tracker_id
                 assert_nil issue.estimated_hours
                 v = issue.custom_values.find(:first, :conditions => {:custom_field_id => 2})
                 assert_not_nil v
                 assert_equal 'Value for field 2', v.value
               end
               def test_post_new_without_custom_fields_param
                 @request.session[:user_id] = 2
                 post :new, :project_id => 1,
                            :issue => {:tracker_id => 1,
                                       :subject => 'This is the test_new issue',
                                       :description => 'This is the description',
                                       :priority_id => 5}
                 assert_redirected_to 'issues/show'
               end
               def test_post_new_with_required_custom_field_and_without_custom_fields_param
                 field = IssueCustomField.find_by_name('Database')
                 field.update_attribute(:is_required, true)
                 @request.session[:user_id] = 2
                 post :new, :project_id => 1,
                            :issue => {:tracker_id => 1,
                                       :subject => 'This is the test_new issue',
                                       :description => 'This is the description',
                                       :priority_id => 5}
                 assert_response :success
                 assert_template 'new'
                 issue = assigns(:issue)
                 assert_not_nil issue
                 assert_equal 'activerecord_error_invalid', issue.errors.on(:custom_values)
               end
               def test_post_should_preserve_fields_values_on_validation_failure
                 @request.session[:user_id] = 2
                 post :new, :project_id => 1,
                            :issue => {:tracker_id => 1,
                                       :subject => 'This is the test_new issue',
                                       # empty description
                                       :description => '',
                                       :priority_id => 6,
                                       :custom_field_values => {'1' => 'Oracle', '2' => 'Value for field 2'}}
                 assert_response :success
                 assert_template 'new'
                 assert_tag :input, :attributes => { :name => 'issue[subject]',
                                                     :value => 'This is the test_new issue' }
                 assert_tag :select, :attributes => { :name => 'issue[priority_id]' },
                                     :child => { :tag => 'option', :attributes => { :selected => 'selected',
                                                                                    :value => '6' },
                                                                   :content => 'High' }
                 # Custom fields
                 assert_tag :select, :attributes => { :name => 'issue[custom_field_values][1]' },
                                     :child => { :tag => 'option', :attributes => { :selected => 'selected',
                                                                                    :value => 'Oracle' },
                                                                   :content => 'Oracle' }
                 assert_tag :input, :attributes => { :name => 'issue[custom_field_values][2]',
                                                     :value => 'Value for field 2'}
               end
               def test_copy_issue
                 @request.session[:user_id] = 2
                 get :new, :project_id => 1, :copy_from => 1
                 assert_template 'new'
                 assert_not_nil assigns(:issue)
                 orig = Issue.find(1)
                 assert_equal orig.subject, assigns(:issue).subject
               end
               def test_get_edit
                 @request.session[:user_id] = 2
                 get :edit, :id => 1
                 assert_response :success
                 assert_template 'edit'
                 assert_not_nil assigns(:issue)
                 assert_equal Issue.find(1), assigns(:issue)
               end
               def test_get_edit_with_params
                 @request.session[:user_id] = 2
                 get :edit, :id => 1, :issue => { :status_id => 5, :priority_id => 7 }
                 assert_response :success
                 assert_template 'edit'
                 issue = assigns(:issue)
                 assert_not_nil issue
                 assert_equal 5, issue.status_id
                 assert_tag :select, :attributes => { :name => 'issue[status_id]' },
                                     :child => { :tag => 'option',
                                                 :content => 'Closed',
                                                 :attributes => { :selected => 'selected' } }
                 assert_equal 7, issue.priority_id
                 assert_tag :select, :attributes => { :name => 'issue[priority_id]' },
                                     :child => { :tag => 'option',
                                                 :content => 'Urgent',
                                                 :attributes => { :selected => 'selected' } }
               end
               def test_reply_to_issue
                 @request.session[:user_id] = 2
                 get :reply, :id => 1
                 assert_response :success
                 assert_select_rjs :show, "update"
               end
               def test_reply_to_note
                 @request.session[:user_id] = 2
                 get :reply, :id => 1, :journal_id => 2
                 assert_response :success
                 assert_select_rjs :show, "update"
               end
               def test_post_edit_without_custom_fields_param
                 @request.session[:user_id] = 2
                 ActionMailer::Base.deliveries.clear
                 issue = Issue.find(1)
                 assert_equal '125', issue.custom_value_for(2).value
                 old_subject = issue.subject
                 new_subject = 'Subject modified by IssuesControllerTest#test_post_edit'
                 assert_difference('Journal.count') do
                   assert_difference('JournalDetail.count', 2) do
                     post :edit, :id => 1, :issue => {:subject => new_subject,
                                                      :priority_id => '6',
                                                      :category_id => '1' # no change
                                                     }
                   end
                 end
                 assert_redirected_to 'issues/show/1'
                 issue.reload
                 assert_equal new_subject, issue.subject
                 # Make sure custom fields were not cleared
                 assert_equal '125', issue.custom_value_for(2).value
                 mail = ActionMailer::Base.deliveries.last
                 assert_kind_of TMail::Mail, mail
                 assert mail.subject.starts_with?("[#{issue.project.name} - #{issue.tracker.name} ##{issue.id}]")
                 assert mail.body.include?("Subject changed from #{old_subject} to #{new_subject}")
               end
               def test_post_edit_with_custom_field_change
                 @request.session[:user_id] = 2
                 issue = Issue.find(1)
                 assert_equal '125', issue.custom_value_for(2).value
                 assert_difference('Journal.count') do
                   assert_difference('JournalDetail.count', 3) do
                     post :edit, :id => 1, :issue => {:subject => 'Custom field change',
                                                      :priority_id => '6',
                                                      :category_id => '1', # no change
                                                      :custom_field_values => { '2' => 'New custom value' }
                                                     }
                   end
                 end
                 assert_redirected_to 'issues/show/1'
                 issue.reload
                 assert_equal 'New custom value', issue.custom_value_for(2).value
                 mail = ActionMailer::Base.deliveries.last
                 assert_kind_of TMail::Mail, mail
                 assert mail.body.include?("Searchable field changed from 125 to New custom value")
               end
               def test_post_edit_with_status_and_assignee_change
                 issue = Issue.find(1)
                 assert_equal 1, issue.status_id
                 @request.session[:user_id] = 2
                 assert_difference('TimeEntry.count', 0) do
                   post :edit,
                        :id => 1,
                        :issue => { :status_id => 2, :assigned_to_id => 3 },
                        :notes => 'Assigned to dlopper',
                        :time_entry => { :hours => '', :comments => '', :activity_id => Enumeration.get_values('ACTI').first }
                 end
                 assert_redirected_to 'issues/show/1'
                 issue.reload
                 assert_equal 2, issue.status_id
                 j = issue.journals.find(:first, :order => 'id DESC')
                 assert_equal 'Assigned to dlopper', j.notes
                 assert_equal 2, j.details.size
                 mail = ActionMailer::Base.deliveries.last
                 assert mail.body.include?("Status changed from New to Assigned")
               end
               def test_post_edit_with_note_only
                 notes = 'Note added by IssuesControllerTest#test_update_with_note_only'
                 # anonymous user
                 post :edit,
                      :id => 1,
                      :notes => notes
                 assert_redirected_to 'issues/show/1'
                 j = Issue.find(1).journals.find(:first, :order => 'id DESC')
                 assert_equal notes, j.notes
                 assert_equal 0, j.details.size
                 assert_equal User.anonymous, j.user
                 mail = ActionMailer::Base.deliveries.last
                 assert mail.body.include?(notes)
               end
               def test_post_edit_with_note_and_spent_time
                 @request.session[:user_id] = 2
                 spent_hours_before = Issue.find(1).spent_hours
                 assert_difference('TimeEntry.count') do
                   post :edit,
                        :id => 1,
                        :notes => '2.5 hours added',
                        :time_entry => { :hours => '2.5', :comments => '', :activity_id => Enumeration.get_values('ACTI').first }
                 end
                 assert_redirected_to 'issues/show/1'
                 issue = Issue.find(1)
                 j = issue.journals.find(:first, :order => 'id DESC')
                 assert_equal '2.5 hours added', j.notes
                 assert_equal 0, j.details.size
                 t = issue.time_entries.find(:first, :order => 'id DESC')
                 assert_not_nil t
                 assert_equal 2.5, t.hours
                 assert_equal spent_hours_before + 2.5, issue.spent_hours
               end
               def test_post_edit_with_attachment_only
                 set_tmp_attachments_directory
                 # anonymous user
                 post :edit,
                      :id => 1,
                      :notes => '',
                      :attachments => {'1' => {'file' => test_uploaded_file('testfile.txt', 'text/plain')}}
                 assert_redirected_to 'issues/show/1'
                 j = Issue.find(1).journals.find(:first, :order => 'id DESC')
                 assert j.notes.blank?
                 assert_equal 1, j.details.size
                 assert_equal 'testfile.txt', j.details.first.value
                 assert_equal User.anonymous, j.user
                 mail = ActionMailer::Base.deliveries.last
                 assert mail.body.include?('testfile.txt')
               end
               def test_post_edit_with_no_change
                 issue = Issue.find(1)
                 issue.journals.clear
                 ActionMailer::Base.deliveries.clear
                 post :edit,
                      :id => 1,
                      :notes => ''
                 assert_redirected_to 'issues/show/1'
                 issue.reload
                 assert issue.journals.empty?
                 # No email should be sent
                 assert ActionMailer::Base.deliveries.empty?
               end
               def test_bulk_edit
                 @request.session[:user_id] = 2
                 # update issues priority
                 post :bulk_edit, :ids => [1, 2], :priority_id => 7, :notes => 'Bulk editing', :assigned_to_id => ''
                 assert_response 302
                 # check that the issues were updated
                 assert_equal [7, 7], Issue.find_all_by_id([1, 2]).collect {|i| i.priority.id}
                 assert_equal 'Bulk editing', Issue.find(1).journals.find(:first, :order => 'created_on DESC').notes
               end
               def test_bulk_unassign
                 assert_not_nil Issue.find(2).assigned_to
                 @request.session[:user_id] = 2
                 # unassign issues
                 post :bulk_edit, :ids => [1, 2], :notes => 'Bulk unassigning', :assigned_to_id => 'none'
                 assert_response 302
                 # check that the issues were updated
                 assert_nil Issue.find(2).assigned_to
               end
               def test_move_one_issue_to_another_project
                 @request.session[:user_id] = 1
                 post :move, :id => 1, :new_project_id => 2
                 assert_redirected_to 'projects/ecookbook/issues'
                 assert_equal 2, Issue.find(1).project_id
               end
               def test_bulk_move_to_another_project
                 @request.session[:user_id] = 1
                 post :move, :ids => [1, 2], :new_project_id => 2
                 assert_redirected_to 'projects/ecookbook/issues'
                 # Issues moved to project 2
                 assert_equal 2, Issue.find(1).project_id
                 assert_equal 2, Issue.find(2).project_id
                 # No tracker change
                 assert_equal 1, Issue.find(1).tracker_id
                 assert_equal 2, Issue.find(2).tracker_id
               end
               def test_bulk_move_to_another_tracker
                 @request.session[:user_id] = 1
                 post :move, :ids => [1, 2], :new_tracker_id => 2
                 assert_redirected_to 'projects/ecookbook/issues'
                 assert_equal 2, Issue.find(1).tracker_id
                 assert_equal 2, Issue.find(2).tracker_id
               end
               def test_context_menu_one_issue
                 @request.session[:user_id] = 2
                 get :context_menu, :ids => [1]
                 assert_response :success
                 assert_template 'context_menu'
                 assert_tag :tag => 'a', :content => 'Edit',
                                         :attributes => { :href => '/issues/edit/1',
                                                          :class => 'icon-edit' }
                 assert_tag :tag => 'a', :content => 'Closed',
                                         :attributes => { :href => '/issues/edit/1?issue%5Bstatus_id%5D=5',
                                                          :class => '' }
                 assert_tag :tag => 'a', :content => 'Immediate',
                                         :attributes => { :href => '/issues/bulk_edit?ids%5B%5D=1&amp;priority_id=8',
                                                          :class => '' }
                 assert_tag :tag => 'a', :content => 'Dave Lopper',
                                         :attributes => { :href => '/issues/bulk_edit?assigned_to_id=3&amp;ids%5B%5D=1',
                                                          :class => '' }
                 assert_tag :tag => 'a', :content => 'Copy',
                                         :attributes => { :href => '/projects/ecookbook/issues/new?copy_from=1',
                                                          :class => 'icon-copy' }
                 assert_tag :tag => 'a', :content => 'Move',
                                         :attributes => { :href => '/issues/move?ids%5B%5D=1',
                                                          :class => 'icon-move' }
                 assert_tag :tag => 'a', :content => 'Delete',
                                         :attributes => { :href => '/issues/destroy?ids%5B%5D=1',
                                                          :class => 'icon-del' }
               end
               def test_context_menu_one_issue_by_anonymous
                 get :context_menu, :ids => [1]
                 assert_response :success
                 assert_template 'context_menu'
                 assert_tag :tag => 'a', :content => 'Delete',
                                         :attributes => { :href => '#',
                                                          :class => 'icon-del disabled' }
               end
               def test_context_menu_multiple_issues_of_same_project
                 @request.session[:user_id] = 2
                 get :context_menu, :ids => [1, 2]
                 assert_response :success
                 assert_template 'context_menu'
                 assert_tag :tag => 'a', :content => 'Edit',
                                         :attributes => { :href => '/issues/bulk_edit?ids%5B%5D=1&amp;ids%5B%5D=2',
                                                          :class => 'icon-edit' }
                 assert_tag :tag => 'a', :content => 'Immediate',
                                         :attributes => { :href => '/issues/bulk_edit?ids%5B%5D=1&amp;ids%5B%5D=2&amp;priority_id=8',
                                                          :class => '' }
                 assert_tag :tag => 'a', :content => 'Dave Lopper',
                                         :attributes => { :href => '/issues/bulk_edit?assigned_to_id=3&amp;ids%5B%5D=1&amp;ids%5B%5D=2',
                                                          :class => '' }
                 assert_tag :tag => 'a', :content => 'Move',
                                         :attributes => { :href => '/issues/move?ids%5B%5D=1&amp;ids%5B%5D=2',
                                                          :class => 'icon-move' }
                 assert_tag :tag => 'a', :content => 'Delete',
                                         :attributes => { :href => '/issues/destroy?ids%5B%5D=1&amp;ids%5B%5D=2',
                                                          :class => 'icon-del' }
               end
               def test_context_menu_multiple_issues_of_different_project
                 @request.session[:user_id] = 2
                 get :context_menu, :ids => [1, 2, 4]
                 assert_response :success
                 assert_template 'context_menu'
                 assert_tag :tag => 'a', :content => 'Delete',
                                         :attributes => { :href => '#',
                                                          :class => 'icon-del disabled' }
               end
               def test_destroy_issue_with_no_time_entries
                 assert_nil TimeEntry.find_by_issue_id(2)
                 @request.session[:user_id] = 2
                 post :destroy, :id => 2
                 assert_redirected_to 'projects/ecookbook/issues'
                 assert_nil Issue.find_by_id(2)
               end
               def test_destroy_issues_with_time_entries
                 @request.session[:user_id] = 2
                 post :destroy, :ids => [1, 3]
                 assert_response :success
                 assert_template 'destroy'
                 assert_not_nil assigns(:hours)
                 assert Issue.find_by_id(1) && Issue.find_by_id(3)
               end
               def test_destroy_issues_and_destroy_time_entries
                 @request.session[:user_id] = 2
                 post :destroy, :ids => [1, 3], :todo => 'destroy'
                 assert_redirected_to 'projects/ecookbook/issues'
                 assert !(Issue.find_by_id(1) || Issue.find_by_id(3))
                 assert_nil TimeEntry.find_by_id([1, 2])
               end
               def test_destroy_issues_and_assign_time_entries_to_project
                 @request.session[:user_id] = 2
                 post :destroy, :ids => [1, 3], :todo => 'nullify'
                 assert_redirected_to 'projects/ecookbook/issues'
                 assert !(Issue.find_by_id(1) || Issue.find_by_id(3))
                 assert_nil TimeEntry.find(1).issue_id
                 assert_nil TimeEntry.find(2).issue_id
               end
               def test_destroy_issues_and_reassign_time_entries_to_another_issue
                 @request.session[:user_id] = 2
                 post :destroy, :ids => [1, 3], :todo => 'reassign', :reassign_to_id => 2
                 assert_redirected_to 'projects/ecookbook/issues'
                 assert !(Issue.find_by_id(1) || Issue.find_by_id(3))
                 assert_equal 2, TimeEntry.find(1).issue_id
                 assert_equal 2, TimeEntry.find(2).issue_id
               end
               def test_destroy_attachment
                 issue = Issue.find(3)
                 a = issue.attachments.size
                 @request.session[:user_id] = 2
                 post :destroy_attachment, :id => 3, :attachment_id => 1
                 assert_redirected_to 'issues/show/3'
                 assert_nil Attachment.find_by_id(1)
                 issue.reload
                 assert_equal((a-1), issue.attachments.size)
                 j = issue.journals.find(:first, :order => 'created_on DESC')
                 assert_equal 'attachment', j.details.first.property
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages