jro_apps/redmine Commit - r2945:534ce51154c5

Allow non admin users to add subprojects (#2963)....

Jean-Philippe Lang -

r2945:534ce51154c5

parent child

Context file:

r2945:534ce51154c5

Collapse all files

app/controllers/projects_controller.rb +3 -3

                 else
                   @project.enabled_module_names = params[:enabled_modules]
                   if @project.save
-                    @project.set_parent!(params[:project]['parent_id']) if User.current.admin? && params[:project].has_key?('parent_id')
+                    @project.set_allowed_parent!(params[:project]['parent_id']) if params[:project].has_key?('parent_id')
                     # Add current user as a project member if he is not admin
                     unless User.current.admin?
                       r = Role.givable.find_by_id(Setting.new_project_user_role_id.to_i) || Role.givable.first
                   @project = Project.new(params[:project])
                   @project.enabled_module_names = params[:enabled_modules]
                   if @project.copy(@source_project, :only => params[:only])
-                    @project.set_parent!(params[:project]['parent_id']) if User.current.admin? && params[:project].has_key?('parent_id')
+                    @project.set_allowed_parent!(params[:project]['parent_id']) if params[:project].has_key?('parent_id')
                     flash[:notice] = l(:notice_successful_create)
                     redirect_to :controller => 'admin', :action => 'projects'
                   end
                 if request.post?
                   @project.attributes = params[:project]
                   if @project.save
-                    @project.set_parent!(params[:project]['parent_id']) if User.current.admin? && params[:project].has_key?('parent_id')
+                    @project.set_allowed_parent!(params[:project]['parent_id']) if params[:project].has_key?('parent_id')
                     flash[:notice] = l(:notice_successful_update)
                     redirect_to :action => 'settings', :id => @project
                   else

app/helpers/projects_helper.rb +1 -1

               end
               def parent_project_select_tag(project)
-                options = '<option></option>' + project_tree_options_for_select(project.possible_parents, :selected => project.parent)
+                options = '<option></option>' + project_tree_options_for_select(project.allowed_parents, :selected => project.parent)
                 content_tag('select', options, :name => 'project[parent_id]')
               end

app/models/project.rb +35 -7

@@ -148,14 +148,16 class Project < ActiveRecord::Base
148	else	148	else
149	statements << "1=0"	149	statements << "1=0"
150	if user.logged?	150	if user.logged?
151	statements << "#{Project.table_name}.is_public = #{connection.quoted_true}" if Role.non_member.allowed_to?(permission)	151	if Role.non_member.allowed_to?(permission) && !options[:member]
		152	statements << "#{Project.table_name}.is_public = #{connection.quoted_true}"
		153	end
152	allowed_project_ids = user.memberships.select {\|m\| m.roles.detect {\|role\| role.allowed_to?(permission)}}.collect {\|m\| m.project_id}	154	allowed_project_ids = user.memberships.select {\|m\| m.roles.detect {\|role\| role.allowed_to?(permission)}}.collect {\|m\| m.project_id}
153	statements << "#{Project.table_name}.id IN (#{allowed_project_ids.join(',')})" if allowed_project_ids.any?	155	statements << "#{Project.table_name}.id IN (#{allowed_project_ids.join(',')})" if allowed_project_ids.any?
154	elsif Role.anonymous.allowed_to?(permission)
155	# anonymous user allowed on public project
156	statements << "#{Project.table_name}.is_public = #{connection.quoted_true}"
157	else	156	else
158	# anonymous user is not authorized	157	if Role.anonymous.allowed_to?(permission) && !options[:member]
		158	# anonymous user allowed on public project
		159	statements << "#{Project.table_name}.is_public = #{connection.quoted_true}"
		160	end
159	end	161	end
160	end	162	end
161	statements.empty? ? base_statement : "((#{base_statement}) AND (#{statements.join(' OR ')}))"	163	statements.empty? ? base_statement : "((#{base_statement}) AND (#{statements.join(' OR ')}))"
@@ -253,8 +255,34 class Project < ActiveRecord::Base
253	end	255	end
254		256
255	# Returns an array of projects the project can be moved to	257	# Returns an array of projects the project can be moved to
256	def possible_parents	258	# by the current user
257	@possible_parents \|\|= (Project.active.find(:all) - self_and_descendants)	259	def allowed_parents
		260	return @allowed_parents if @allowed_parents
		261	@allowed_parents = (Project.find(:all, :conditions => Project.allowed_to_condition(User.current, :add_project, :member => true)) - self_and_descendants)
		262	unless parent.nil? \|\| @allowed_parents.empty? \|\| @allowed_parents.include?(parent)
		263	@allowed_parents << parent
		264	end
		265	@allowed_parents
		266	end
		267
		268	# Sets the parent of the project with authorization check
		269	def set_allowed_parent!(p)
		270	unless p.nil? \|\| p.is_a?(Project)
		271	if p.to_s.blank?
		272	p = nil
		273	else
		274	p = Project.find_by_id(p)
		275	return false unless p
		276	end
		277	end
		278	if p.nil?
		279	if !new_record? && allowed_parents.empty?
		280	return false
		281	end
		282	elsif !allowed_parents.include?(p)
		283	return false
		284	end
		285	set_parent!(p)
258	end	286	end
259		287
260	# Sets the parent of the project	288	# Sets the parent of the project

app/views/projects/_form.rhtml +1 -1

             <!--[form:project]-->
             <p><%= f.text_field :name, :required => true %><br /><em><%= l(:text_caracters_maximum, 30) %></em></p>
-            <% if User.current.admin? && !@project.possible_parents.empty? %>
+            <% unless @project.allowed_parents.empty? %>
                 <p><label><%= l(:field_parent) %></label><%= parent_project_select_tag(@project) %></p>
             <% end %>

test/functional/projects_controller_test.rb +17 0

@@ -117,6 +117,23 class ProjectsControllerTest < ActionController::TestCase
117	assert_kind_of Project, project	117	assert_kind_of Project, project
118	assert_equal 'weblog', project.description	118	assert_equal 'weblog', project.description
119	assert_equal true, project.is_public?	119	assert_equal true, project.is_public?
		120	assert_nil project.parent
		121	end
		122
		123	def test_post_add_subproject
		124	@request.session[:user_id] = 1
		125	post :add, :project => { :name => "blog",
		126	:description => "weblog",
		127	:identifier => "blog",
		128	:is_public => 1,
		129	:custom_field_values => { '3' => 'Beta' },
		130	:parent_id => 1
		131	}
		132	assert_redirected_to '/projects/blog/settings'
		133
		134	project = Project.find_by_name('blog')
		135	assert_kind_of Project, project
		136	assert_equal Project.find(1), project.parent
120	end	137	end
121		138
122	def test_post_add_by_non_admin	139	def test_post_add_by_non_admin

test/unit/project_test.rb +9 0

               def setup
                 @ecookbook = Project.find(1)
                 @ecookbook_sub1 = Project.find(3)
+                User.current = nil
               end
               should_validate_presence_of :name
                 assert_equal [5, 6, 3, 4], d.collect(&:id)
               end
+              def test_allowed_parents_should_be_empty_for_non_member_user
+                Role.non_member.add_permission!(:add_project)
+                user = User.find(9)
+                assert user.memberships.empty?
+                User.current = user
+                assert Project.new.allowed_parents.empty?
+              end
               def test_users_by_role
                 users_by_role = Project.find(1).users_by_role
                 assert_kind_of Hash, users_by_role

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages