jro_apps/redmine Commit - r4329:3d6cb1435cdf

Accept key auth for ProjectsController#destroy (#6841)....

Jean-Philippe Lang -

r4329:3d6cb1435cdf

parent child

Context file:

r4329:3d6cb1435cdf

Collapse all files

app/controllers/projects_controller.rb +1 -1

             # Redmine - project management software
             # Copyright (C) 2006-2009  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class ProjectsController < ApplicationController
               menu_item :overview
               menu_item :roadmap, :only => :roadmap
               menu_item :settings, :only => :settings
               before_filter :find_project, :except => [ :index, :list, :new, :create, :copy ]
               before_filter :authorize, :except => [ :index, :list, :new, :create, :copy, :archive, :unarchive, :destroy]
               before_filter :authorize_global, :only => [:new, :create]
               before_filter :require_admin, :only => [ :copy, :archive, :unarchive, :destroy ]
-              accept_key_auth :index, :create, :update
+              accept_key_auth :index, :create, :update, :destroy
               after_filter :only => [:create, :edit, :update, :archive, :unarchive, :destroy] do |controller|
                 if controller.request.post?
                   controller.send :expire_action, :controller => 'welcome', :action => 'robots.txt'
                 end
               end
               # TODO: convert to PUT only
               verify :method => [:post, :put], :only => :update, :render => {:nothing => true, :status => :method_not_allowed }
               helper :sort
               include SortHelper
               helper :custom_fields
               include CustomFieldsHelper
               helper :issues
               helper :queries
               include QueriesHelper
               helper :repositories
               include RepositoriesHelper
               include ProjectsHelper
               # Lists visible projects
               def index
                 respond_to do |format|
                   format.html {
                     @projects = Project.visible.find(:all, :order => 'lft')
                   }
                   format.xml  {
                     @projects = Project.visible.find(:all, :order => 'lft')
                   }
                   format.atom {
                     projects = Project.visible.find(:all, :order => 'created_on DESC',
                                                           :limit => Setting.feeds_limit.to_i)
                     render_feed(projects, :title => "#{Setting.app_title}: #{l(:label_project_latest)}")
                   }
                 end
               end
               def new
                 @issue_custom_fields = IssueCustomField.find(:all, :order => "#{CustomField.table_name}.position")
                 @trackers = Tracker.all
                 @project = Project.new(params[:project])
                 @project.identifier = Project.next_identifier if Setting.sequential_project_identifiers?
                 @project.trackers = Tracker.all
                 @project.is_public = Setting.default_projects_public?
                 @project.enabled_module_names = Setting.default_projects_modules
               end
               def create
                 @issue_custom_fields = IssueCustomField.find(:all, :order => "#{CustomField.table_name}.position")
                 @trackers = Tracker.all
                 @project = Project.new(params[:project])
                 @project.enabled_module_names = params[:enabled_modules]
                 if validate_parent_id && @project.save
                   @project.set_allowed_parent!(params[:project]['parent_id']) if params[:project].has_key?('parent_id')
                   # Add current user as a project member if he is not admin
                   unless User.current.admin?
                     r = Role.givable.find_by_id(Setting.new_project_user_role_id.to_i) || Role.givable.first
                     m = Member.new(:user => User.current, :roles => [r])
                     @project.members << m
                   end
                   respond_to do |format|
                     format.html {
                       flash[:notice] = l(:notice_successful_create)
                       redirect_to :controller => 'projects', :action => 'settings', :id => @project
                     }
                     format.xml  { render :action => 'show', :status => :created, :location => url_for(:controller => 'projects', :action => 'show', :id => @project.id) }
                   end
                 else
                   respond_to do |format|
                     format.html { render :action => 'new' }
                     format.xml  { render :xml => @project.errors, :status => :unprocessable_entity }
                   end
                 end
               end
               def copy
                 @issue_custom_fields = IssueCustomField.find(:all, :order => "#{CustomField.table_name}.position")
                 @trackers = Tracker.all
                 @root_projects = Project.find(:all,
                                               :conditions => "parent_id IS NULL AND status = #{Project::STATUS_ACTIVE}",
                                               :order => 'name')
                 @source_project = Project.find(params[:id])
                 if request.get?
                   @project = Project.copy_from(@source_project)
                   if @project
                     @project.identifier = Project.next_identifier if Setting.sequential_project_identifiers?
                   else
                     redirect_to :controller => 'admin', :action => 'projects'
                   end
                 else
                   Mailer.with_deliveries(params[:notifications] == '1') do
                     @project = Project.new(params[:project])
                     @project.enabled_module_names = params[:enabled_modules]
                     if validate_parent_id && @project.copy(@source_project, :only => params[:only])
                       @project.set_allowed_parent!(params[:project]['parent_id']) if params[:project].has_key?('parent_id')
                       flash[:notice] = l(:notice_successful_create)
                       redirect_to :controller => 'projects', :action => 'settings'
                     elsif !@project.new_record?
                       # Project was created
                       # But some objects were not copied due to validation failures
                       # (eg. issues from disabled trackers)
                       # TODO: inform about that
                       redirect_to :controller => 'projects', :action => 'settings'
                     end
                   end
                 end
               rescue ActiveRecord::RecordNotFound
                 redirect_to :controller => 'admin', :action => 'projects'
               end
               # Show @project
               def show
                 if params[:jump]
                   # try to redirect to the requested menu item
                   redirect_to_project_menu_item(@project, params[:jump]) && return
                 end
                 @users_by_role = @project.users_by_role
                 @subprojects = @project.children.visible
                 @news = @project.news.find(:all, :limit => 5, :include => [ :author, :project ], :order => "#{News.table_name}.created_on DESC")
                 @trackers = @project.rolled_up_trackers
                 cond = @project.project_condition(Setting.display_subprojects_issues?)
                 @open_issues_by_tracker = Issue.visible.count(:group => :tracker,
                                                         :include => [:project, :status, :tracker],
                                                         :conditions => ["(#{cond}) AND #{IssueStatus.table_name}.is_closed=?", false])
                 @total_issues_by_tracker = Issue.visible.count(:group => :tracker,
                                                         :include => [:project, :status, :tracker],
                                                         :conditions => cond)
                 TimeEntry.visible_by(User.current) do
                   @total_hours = TimeEntry.sum(:hours,
                                                :include => :project,
                                                :conditions => cond).to_f
                 end
                 @key = User.current.rss_key
                 respond_to do |format|
                   format.html
                   format.xml
                 end
               end
               def settings
                 @issue_custom_fields = IssueCustomField.find(:all, :order => "#{CustomField.table_name}.position")
                 @issue_category ||= IssueCategory.new
                 @member ||= @project.members.new
                 @trackers = Tracker.all
                 @repository ||= @project.repository
                 @wiki ||= @project.wiki
               end
               def edit
               end
               def update
                 @project.attributes = params[:project]
                 if validate_parent_id && @project.save
                   @project.set_allowed_parent!(params[:project]['parent_id']) if params[:project].has_key?('parent_id')
                   respond_to do |format|
                     format.html {
                       flash[:notice] = l(:notice_successful_update)
                       redirect_to :action => 'settings', :id => @project
                     }
                     format.xml  { head :ok }
                   end
                 else
                   respond_to do |format|
                     format.html {
                       settings
                       render :action => 'settings'
                     }
                     format.xml  { render :xml => @project.errors, :status => :unprocessable_entity }
                   end
                 end
               end
               def modules
                 @project.enabled_module_names = params[:enabled_modules]
                 flash[:notice] = l(:notice_successful_update)
                 redirect_to :action => 'settings', :id => @project, :tab => 'modules'
               end
               def archive
                 if request.post?
                   unless @project.archive
                     flash[:error] = l(:error_can_not_archive_project)
                   end
                 end
                 redirect_to(url_for(:controller => 'admin', :action => 'projects', :status => params[:status]))
               end
               def unarchive
                 @project.unarchive if request.post? && !@project.active?
                 redirect_to(url_for(:controller => 'admin', :action => 'projects', :status => params[:status]))
               end
               # Delete @project
               def destroy
                 @project_to_destroy = @project
                 if request.get?
                   # display confirmation view
                 else
                   if params[:format] == 'xml' || params[:confirm]
                     @project_to_destroy.destroy
                     respond_to do |format|
                       format.html { redirect_to :controller => 'admin', :action => 'projects' }
                       format.xml  { head :ok }
                     end
                   end
                 end
                 # hide project in layout
                 @project = nil
               end
             private
               def find_optional_project
                 return true unless params[:id]
                 @project = Project.find(params[:id])
                 authorize
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               # Validates parent_id param according to user's permissions
               # TODO: move it to Project model in a validation that depends on User.current
               def validate_parent_id
                 return true if User.current.admin?
                 parent_id = params[:project] && params[:project][:parent_id]
                 if parent_id || @project.new_record?
                   parent = parent_id.blank? ? nil : Project.find_by_id(parent_id.to_i)
                   unless @project.allowed_parents.include?(parent)
                     @project.errors.add :parent_id, :invalid
                     return false
                   end
                 end
                 true
               end
             end

test/integration/api_test/projects_test.rb +14 -8

             # Redmine - project management software
             # Copyright (C) 2006-2010  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require "#{File.dirname(__FILE__)}/../../test_helper"
             class ApiTest::ProjectsTest < ActionController::IntegrationTest
               fixtures :projects, :versions, :users, :roles, :members, :member_roles, :issues, :journals, :journal_details,
                        :trackers, :projects_trackers, :issue_statuses, :enabled_modules, :enumerations, :boards, :messages,
                        :attachments, :custom_fields, :custom_values, :time_entries
               def setup
                 Setting.rest_api_enabled = '1'
               end
               def test_index
                 get '/projects.xml'
                 assert_response :success
                 assert_equal 'application/xml', @response.content_type
               end
               def test_show
                 get '/projects/1.xml'
                 assert_response :success
                 assert_equal 'application/xml', @response.content_type
                 assert_tag 'custom_field', :attributes => {:name => 'Development status'}, :content => 'Stable'
               end
               def test_show_should_not_display_hidden_custom_fields
                 ProjectCustomField.find_by_name('Development status').update_attribute :visible, false
                 get '/projects/1.xml'
                 assert_response :success
                 assert_equal 'application/xml', @response.content_type
                 assert_no_tag 'custom_field', :attributes => {:name => 'Development status'}
               end
               context "POST /projects.xml" do
                 should_allow_api_authentication(:post,
                                                 '/projects.xml',
                                                 {:project => {:name => 'API test', :identifier => 'api-test'}},
                                                 {:success_code => :created})
                 should "create a project with the attributes" do
                   assert_difference('Project.count') do
                     post '/projects.xml', {:project => {:name => 'API test', :identifier => 'api-test'}}, :authorization => credentials('admin')
                   end
                   project = Project.first(:order => 'id DESC')
                   assert_equal 'API test', project.name
                   assert_equal 'api-test', project.identifier
                   assert_response :created
                   assert_equal 'application/xml', @response.content_type
                   assert_tag 'project', :child => {:tag => 'id', :content => project.id.to_s}
                 end
               end
               def test_create_failure
                 attributes = {:name => 'API test'}
                 assert_no_difference 'Project.count' do
                   post '/projects.xml', {:project => attributes}, :authorization => credentials('admin')
                 end
                 assert_response :unprocessable_entity
                 assert_equal 'application/xml', @response.content_type
                 assert_tag :errors, :child => {:tag => 'error', :content => "Identifier can't be blank"}
               end
               context "PUT /projects/2.xml" do
                 should_allow_api_authentication(:put,
                                                 '/projects/2.xml',
                                                 {:project => {:name => 'API test'}},
                                                 {:success_code => :ok})
                 should "update the project" do
                   assert_no_difference 'Project.count' do
                     put '/projects/2.xml', {:project => {:name => 'API update'}}, :authorization => credentials('jsmith')
                   end
                   assert_response :ok
                   assert_equal 'application/xml', @response.content_type
                   project = Project.find(2)
                   assert_equal 'API update', project.name
                 end
               end
               def test_update_failure
                 attributes = {:name => ''}
                 assert_no_difference 'Project.count' do
                   put '/projects/1.xml', {:project => attributes}, :authorization => credentials('jsmith')
                 end
                 assert_response :unprocessable_entity
                 assert_equal 'application/xml', @response.content_type
                 assert_tag :errors, :child => {:tag => 'error', :content => "Name can't be blank"}
               end
-              def test_destroy
+              context "DELETE /projects/2.xml" do
-                assert_difference 'Project.count', -1 do
+                should_allow_api_authentication(:delete,
-                  delete '/projects/2.xml', {}, :authorization => credentials('admin')
+                                                '/projects/2.xml',
+                                                {},
+                                                {:success_code => :ok})
+                should "delete the project" do
+                  assert_difference('Project.count',-1) do
+                    delete '/projects/2.xml', {}, :authorization => credentials('admin')
+                  end
+                  assert_response :ok
+                  assert_nil Project.find_by_id(2)
                 end
-                assert_response :ok
-                assert_equal 'application/xml', @response.content_type
-                assert_nil Project.find_by_id(2)
               end
               def credentials(user, password=nil)
                 ActionController::HttpAuthentication::Basic.encode_credentials(user, password || user)
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages