jro_apps/redmine Commit - r9032:5475e0dcc5d3

1

# Redmine - project management software

1

# Redmine - project management software

2

3

#

3

#

4

# This program is free software; you can redistribute it and/or

4

# This program is free software; you can redistribute it and/or

5

# modify it under the terms of the GNU General Public License

5

# modify it under the terms of the GNU General Public License

6

# as published by the Free Software Foundation; either version 2

6

# as published by the Free Software Foundation; either version 2

7

# of the License, or (at your option) any later version.

7

# of the License, or (at your option) any later version.

8

#

8

#

9

# This program is distributed in the hope that it will be useful,

9

# This program is distributed in the hope that it will be useful,

10

# but WITHOUT ANY WARRANTY; without even the implied warranty of

10

# but WITHOUT ANY WARRANTY; without even the implied warranty of

11

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

11

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

12

# GNU General Public License for more details.

12

# GNU General Public License for more details.

13

#

13

#

14

# You should have received a copy of the GNU General Public License

14

# You should have received a copy of the GNU General Public License

15

# along with this program; if not, write to the Free Software

15

# along with this program; if not, write to the Free Software

16

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

16

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

17

18

class TimelogController < ApplicationController

18

class TimelogController < ApplicationController

19

menu_item :issues

19

menu_item :issues

20

before_filter :find_project, :only => [:new, :create]

20

before_filter :find_project, :only => [:new, :create]

21

before_filter :find_time_entry, :only => [:show, :edit, :update]

21

before_filter :find_time_entry, :only => [:show, :edit, :update]

22

before_filter :find_time_entries, :only => [:bulk_edit, :bulk_update, :destroy]

22

before_filter :find_time_entries, :only => [:bulk_edit, :bulk_update, :destroy]

23

before_filter :authorize, :except => [:index]

23

before_filter :authorize, :except => [:index]

24

before_filter :find_optional_project, :only => [:index]

24

before_filter :find_optional_project, :only => [:index]

25

accept_rss_auth :index

25

accept_rss_auth :index

26

accept_api_auth :index, :show, :create, :update, :destroy

26

accept_api_auth :index, :show, :create, :update, :destroy

27

28

helper :sort

28

helper :sort

29

include SortHelper

29

include SortHelper

30

helper :issues

30

helper :issues

31

include TimelogHelper

31

include TimelogHelper

32

helper :custom_fields

32

helper :custom_fields

33

include CustomFieldsHelper

33

include CustomFieldsHelper

34

35

def index

35

def index

36

sort_init 'spent_on', 'desc'

36

sort_init 'spent_on', 'desc'

37

sort_update 'spent_on' => 'spent_on',

37

sort_update 'spent_on' => 'spent_on',

38

'user' => 'user_id',

38

'user' => 'user_id',

39

'activity' => 'activity_id',

39

'activity' => 'activity_id',

40

'project' => "#{Project.table_name}.name",

40

'project' => "#{Project.table_name}.name",

41

'issue' => 'issue_id',

41

'issue' => 'issue_id',

42

'hours' => 'hours'

42

'hours' => 'hours'

43

44

cond = ARCondition.new

44

cond = ARCondition.new

45

if @issue

45

if @issue

46

cond << "#{Issue.table_name}.root_id = #{@issue.root_id} AND #{Issue.table_name}.lft >= #{@issue.lft} AND #{Issue.table_name}.rgt <= #{@issue.rgt}"

46

cond << "#{Issue.table_name}.root_id = #{@issue.root_id} AND #{Issue.table_name}.lft >= #{@issue.lft} AND #{Issue.table_name}.rgt <= #{@issue.rgt}"

47

elsif @project

47

elsif @project

48

cond << @project.project_condition(Setting.display_subprojects_issues?)

48

cond << @project.project_condition(Setting.display_subprojects_issues?)

49

end

49

end

50

51

retrieve_date_range

51

retrieve_date_range

52

cond << ['spent_on BETWEEN ? AND ?', @from, @to]

52

cond << ['spent_on BETWEEN ? AND ?', @from, @to]

53

54

respond_to do |format|

54

respond_to do |format|

55

format.html {

55

format.html {

56

# Paginate results

56

# Paginate results

57

@entry_count = TimeEntry.visible.count(:include => [:project, :issue], :conditions => cond.conditions)

57

@entry_count = TimeEntry.visible.count(:include => [:project, :issue], :conditions => cond.conditions)

58

@entry_pages = Paginator.new self, @entry_count, per_page_option, params['page']

58

@entry_pages = Paginator.new self, @entry_count, per_page_option, params['page']

59

@entries = TimeEntry.visible.find(:all,

59

@entries = TimeEntry.visible.find(:all,

60

:include => [:project, :activity, :user, {:issue => :tracker}],

60

:include => [:project, :activity, :user, {:issue => :tracker}],

61

:conditions => cond.conditions,

61

:conditions => cond.conditions,

62

:order => sort_clause,

62

:order => sort_clause,

63

:limit => @entry_pages.items_per_page,

63

:limit => @entry_pages.items_per_page,

64

:offset => @entry_pages.current.offset)

64

:offset => @entry_pages.current.offset)

65

@total_hours = TimeEntry.visible.sum(:hours, :include => [:project, :issue], :conditions => cond.conditions).to_f

65

@total_hours = TimeEntry.visible.sum(:hours, :include => [:project, :issue], :conditions => cond.conditions).to_f

66

67

render :layout => !request.xhr?

67

render :layout => !request.xhr?

68

}

68

}

69

format.api {

69

format.api {

70

@entry_count = TimeEntry.visible.count(:include => [:project, :issue], :conditions => cond.conditions)

70

@entry_count = TimeEntry.visible.count(:include => [:project, :issue], :conditions => cond.conditions)

71

@offset, @limit = api_offset_and_limit

71

@offset, @limit = api_offset_and_limit

72

@entries = TimeEntry.visible.find(:all,

72

@entries = TimeEntry.visible.find(:all,

73

:include => [:project, :activity, :user, {:issue => :tracker}],

73

:include => [:project, :activity, :user, {:issue => :tracker}],

74

:conditions => cond.conditions,

74

:conditions => cond.conditions,

75

:order => sort_clause,

75

:order => sort_clause,

76

:limit => @limit,

76

:limit => @limit,

77

:offset => @offset)

77

:offset => @offset)

78

}

78

}

79

format.atom {

79

format.atom {

80

entries = TimeEntry.visible.find(:all,

80

entries = TimeEntry.visible.find(:all,

81

:include => [:project, :activity, :user, {:issue => :tracker}],

81

:include => [:project, :activity, :user, {:issue => :tracker}],

82

:conditions => cond.conditions,

82

:conditions => cond.conditions,

83

:order => "#{TimeEntry.table_name}.created_on DESC",

83

:order => "#{TimeEntry.table_name}.created_on DESC",

84

:limit => Setting.feeds_limit.to_i)

84

:limit => Setting.feeds_limit.to_i)

85

render_feed(entries, :title => l(:label_spent_time))

85

render_feed(entries, :title => l(:label_spent_time))

86

}

86

}

87

format.csv {

87

format.csv {

88

# Export all entries

88

# Export all entries

89

@entries = TimeEntry.visible.find(:all,

89

@entries = TimeEntry.visible.find(:all,

90

:include => [:project, :activity, :user, {:issue => [:tracker, :assigned_to, :priority]}],

90

:include => [:project, :activity, :user, {:issue => [:tracker, :assigned_to, :priority]}],

91

:conditions => cond.conditions,

91

:conditions => cond.conditions,

92

:order => sort_clause)

92

:order => sort_clause)

93

send_data(entries_to_csv(@entries), :type => 'text/csv; header=present', :filename => 'timelog.csv')

93

send_data(entries_to_csv(@entries), :type => 'text/csv; header=present', :filename => 'timelog.csv')

94

}

94

}

95

end

95

end

96

end

96

end

97

98

def show

98

def show

99

respond_to do |format|

99

respond_to do |format|

100

# TODO: Implement html response

100

# TODO: Implement html response

101

format.html { render :nothing => true, :status => 406 }

101

format.html { render :nothing => true, :status => 406 }

102

format.api

102

format.api

103

end

103

end

104

end

104

end

105

106

def new

106

def new

107

@time_entry ||= TimeEntry.new(:project => @project, :issue => @issue, :user => User.current, :spent_on => User.current.today)

107

@time_entry ||= TimeEntry.new(:project => @project, :issue => @issue, :user => User.current, :spent_on => User.current.today)

108

@time_entry.attributes = params[:time_entry]

108

@time_entry.safe_attributes = params[:time_entry]

109

110

call_hook(:controller_timelog_edit_before_save, { :params => params, :time_entry => @time_entry })

110

call_hook(:controller_timelog_edit_before_save, { :params => params, :time_entry => @time_entry })

111

render :action => 'edit'

111

render :action => 'edit'

112

end

112

end

113

114

verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }

114

verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }

115

def create

115

def create

116

@time_entry ||= TimeEntry.new(:project => @project, :issue => @issue, :user => User.current, :spent_on => User.current.today)

116

@time_entry ||= TimeEntry.new(:project => @project, :issue => @issue, :user => User.current, :spent_on => User.current.today)

117

@time_entry.attributes = params[:time_entry]

117

@time_entry.safe_attributes = params[:time_entry]

118

119

call_hook(:controller_timelog_edit_before_save, { :params => params, :time_entry => @time_entry })

119

call_hook(:controller_timelog_edit_before_save, { :params => params, :time_entry => @time_entry })

120

121

if @time_entry.save

121

if @time_entry.save

122

respond_to do |format|

122

respond_to do |format|

123

format.html {

123

format.html {

124

flash[:notice] = l(:notice_successful_update)

124

flash[:notice] = l(:notice_successful_update)

125

redirect_back_or_default :action => 'index', :project_id => @time_entry.project

125

redirect_back_or_default :action => 'index', :project_id => @time_entry.project

126

}

126

}

127

format.api { render :action => 'show', :status => :created, :location => time_entry_url(@time_entry) }

127

format.api { render :action => 'show', :status => :created, :location => time_entry_url(@time_entry) }

128

end

128

end

129

else

129

else

130

respond_to do |format|

130

respond_to do |format|

131

format.html { render :action => 'edit' }

131

format.html { render :action => 'edit' }

132

format.api { render_validation_errors(@time_entry) }

132

format.api { render_validation_errors(@time_entry) }

133

end

133

end

134

end

134

end

135

end

135

end

136

137

def edit

137

def edit

138

@time_entry.attributes = params[:time_entry]

138

@time_entry.safe_attributes = params[:time_entry]

139

140

call_hook(:controller_timelog_edit_before_save, { :params => params, :time_entry => @time_entry })

140

call_hook(:controller_timelog_edit_before_save, { :params => params, :time_entry => @time_entry })

141

end

141

end

142

143

verify :method => :put, :only => :update, :render => {:nothing => true, :status => :method_not_allowed }

143

verify :method => :put, :only => :update, :render => {:nothing => true, :status => :method_not_allowed }

144

def update

144

def update

145

@time_entry.attributes = params[:time_entry]

145

@time_entry.safe_attributes = params[:time_entry]

146

147

call_hook(:controller_timelog_edit_before_save, { :params => params, :time_entry => @time_entry })

147

call_hook(:controller_timelog_edit_before_save, { :params => params, :time_entry => @time_entry })

148

149

if @time_entry.save

149

if @time_entry.save

150

respond_to do |format|

150

respond_to do |format|

151

format.html {

151

format.html {

152

flash[:notice] = l(:notice_successful_update)

152

flash[:notice] = l(:notice_successful_update)

153

redirect_back_or_default :action => 'index', :project_id => @time_entry.project

153

redirect_back_or_default :action => 'index', :project_id => @time_entry.project

154

}

154

}

155

format.api { head :ok }

155

format.api { head :ok }

156

end

156

end

157

else

157

else

158

respond_to do |format|

158

respond_to do |format|

159

format.html { render :action => 'edit' }

159

format.html { render :action => 'edit' }

160

format.api { render_validation_errors(@time_entry) }

160

format.api { render_validation_errors(@time_entry) }

161

end

161

end

162

end

162

end

163

end

163

end

164

165

def bulk_edit

165

def bulk_edit

166

@available_activities = TimeEntryActivity.shared.active

166

@available_activities = TimeEntryActivity.shared.active

167

@custom_fields = TimeEntry.first.available_custom_fields

167

@custom_fields = TimeEntry.first.available_custom_fields

168

end

168

end

169

170

def bulk_update

170

def bulk_update

171

attributes = parse_params_for_bulk_time_entry_attributes(params)

171

attributes = parse_params_for_bulk_time_entry_attributes(params)

172

173

unsaved_time_entry_ids = []

173

unsaved_time_entry_ids = []

174

@time_entries.each do |time_entry|

174

@time_entries.each do |time_entry|

175

time_entry.reload

175

time_entry.reload

176

time_entry.attributes = attributes

176

time_entry.safe_attributes = attributes

177

call_hook(:controller_time_entries_bulk_edit_before_save, { :params => params, :time_entry => time_entry })

177

call_hook(:controller_time_entries_bulk_edit_before_save, { :params => params, :time_entry => time_entry })

178

unless time_entry.save

178

unless time_entry.save

179

# Keep unsaved time_entry ids to display them in flash error

179

# Keep unsaved time_entry ids to display them in flash error

180

unsaved_time_entry_ids << time_entry.id

180

unsaved_time_entry_ids << time_entry.id

181

end

181

end

182

end

182

end

183

set_flash_from_bulk_time_entry_save(@time_entries, unsaved_time_entry_ids)

183

set_flash_from_bulk_time_entry_save(@time_entries, unsaved_time_entry_ids)

184

redirect_back_or_default({:controller => 'timelog', :action => 'index', :project_id => @projects.first})

184

redirect_back_or_default({:controller => 'timelog', :action => 'index', :project_id => @projects.first})

185

end

185

end

186

187

verify :method => :delete, :only => :destroy, :render => {:nothing => true, :status => :method_not_allowed }

187

verify :method => :delete, :only => :destroy, :render => {:nothing => true, :status => :method_not_allowed }

188

def destroy

188

def destroy

189

@time_entries.each do |t|

189

@time_entries.each do |t|

190

begin

190

begin

191

unless t.destroy && t.destroyed?

191

unless t.destroy && t.destroyed?

192

respond_to do |format|

192

respond_to do |format|

193

format.html {

193

format.html {

194

flash[:error] = l(:notice_unable_delete_time_entry)

194

flash[:error] = l(:notice_unable_delete_time_entry)

195

redirect_to :back

195

redirect_to :back

196

}

196

}

197

format.api { render_validation_errors(t) }

197

format.api { render_validation_errors(t) }

198

end

198

end

199

return

199

return

200

end

200

end

201

rescue ::ActionController::RedirectBackError

201

rescue ::ActionController::RedirectBackError

202

redirect_to :action => 'index', :project_id => @projects.first

202

redirect_to :action => 'index', :project_id => @projects.first

203

return

203

return

204

end

204

end

205

end

205

end

206

207

respond_to do |format|

207

respond_to do |format|

208

format.html {

208

format.html {

209

flash[:notice] = l(:notice_successful_delete)

209

flash[:notice] = l(:notice_successful_delete)

210

redirect_back_or_default(:action => 'index', :project_id => @projects.first)

210

redirect_back_or_default(:action => 'index', :project_id => @projects.first)

211

}

211

}

212

format.api { head :ok }

212

format.api { head :ok }

213

end

213

end

214

end

214

end

215

216

private

216

private

217

def find_time_entry

217

def find_time_entry

218

@time_entry = TimeEntry.find(params[:id])

218

@time_entry = TimeEntry.find(params[:id])

219

unless @time_entry.editable_by?(User.current)

219

unless @time_entry.editable_by?(User.current)

220

render_403

220

render_403

221

return false

221

return false

222

end

222

end

223

@project = @time_entry.project

223

@project = @time_entry.project

224

rescue ActiveRecord::RecordNotFound

224

rescue ActiveRecord::RecordNotFound

225

render_404

225

render_404

226

end

226

end

227

228

def find_time_entries

228

def find_time_entries

229

@time_entries = TimeEntry.find_all_by_id(params[:id] || params[:ids])

229

@time_entries = TimeEntry.find_all_by_id(params[:id] || params[:ids])

230

raise ActiveRecord::RecordNotFound if @time_entries.empty?

230

raise ActiveRecord::RecordNotFound if @time_entries.empty?

231

@projects = @time_entries.collect(&:project).compact.uniq

231

@projects = @time_entries.collect(&:project).compact.uniq

232

@project = @projects.first if @projects.size == 1

232

@project = @projects.first if @projects.size == 1

233

rescue ActiveRecord::RecordNotFound

233

rescue ActiveRecord::RecordNotFound

234

render_404

234

render_404

235

end

235

end

236

237

def set_flash_from_bulk_time_entry_save(time_entries, unsaved_time_entry_ids)

237

def set_flash_from_bulk_time_entry_save(time_entries, unsaved_time_entry_ids)

238

if unsaved_time_entry_ids.empty?

238

if unsaved_time_entry_ids.empty?

239

flash[:notice] = l(:notice_successful_update) unless time_entries.empty?

239

flash[:notice] = l(:notice_successful_update) unless time_entries.empty?

240

else

240

else

241

flash[:error] = l(:notice_failed_to_save_time_entries,

241

flash[:error] = l(:notice_failed_to_save_time_entries,

242

:count => unsaved_time_entry_ids.size,

242

:count => unsaved_time_entry_ids.size,

243

:total => time_entries.size,

243

:total => time_entries.size,

244

:ids => '#' + unsaved_time_entry_ids.join(', #'))

244

:ids => '#' + unsaved_time_entry_ids.join(', #'))

245

end

245

end

246

end

246

end

247

248

def find_project

248

def find_project

249

if (issue_id = (params[:issue_id] || params[:time_entry] && params[:time_entry][:issue_id])).present?

249

if (issue_id = (params[:issue_id] || params[:time_entry] && params[:time_entry][:issue_id])).present?

250

@issue = Issue.find(issue_id)

250

@issue = Issue.find(issue_id)

251

@project = @issue.project

251

@project = @issue.project

252

elsif (project_id = (params[:project_id] || params[:time_entry] && params[:time_entry][:project_id])).present?

252

elsif (project_id = (params[:project_id] || params[:time_entry] && params[:time_entry][:project_id])).present?

253

@project = Project.find(project_id)

253

@project = Project.find(project_id)

254

else

254

else

255

render_404

255

render_404

256

return false

256

return false

257

end

257

end

258

rescue ActiveRecord::RecordNotFound

258

rescue ActiveRecord::RecordNotFound

259

render_404

259

render_404

260

end

260

end

261

262

def find_optional_project

262

def find_optional_project

263

if !params[:issue_id].blank?

263

if !params[:issue_id].blank?

264

@issue = Issue.find(params[:issue_id])

264

@issue = Issue.find(params[:issue_id])

265

@project = @issue.project

265

@project = @issue.project

266

elsif !params[:project_id].blank?

266

elsif !params[:project_id].blank?

267

@project = Project.find(params[:project_id])

267

@project = Project.find(params[:project_id])

268

end

268

end

269

deny_access unless User.current.allowed_to?(:view_time_entries, @project, :global => true)

269

deny_access unless User.current.allowed_to?(:view_time_entries, @project, :global => true)

270

end

270

end

271

272

# Retrieves the date range based on predefined ranges or specific from/to param dates

272

# Retrieves the date range based on predefined ranges or specific from/to param dates

273

def retrieve_date_range

273

def retrieve_date_range

274

@free_period = false

274

@free_period = false

275

@from, @to = nil, nil

275

@from, @to = nil, nil

276

277

if params[:period_type] == '1' || (params[:period_type].nil? && !params[:period].nil?)

277

if params[:period_type] == '1' || (params[:period_type].nil? && !params[:period].nil?)

278

case params[:period].to_s

278

case params[:period].to_s

279

when 'today'

279

when 'today'

280

@from = @to = Date.today

280

@from = @to = Date.today

281

when 'yesterday'

281

when 'yesterday'

282

@from = @to = Date.today - 1

282

@from = @to = Date.today - 1

283

when 'current_week'

283

when 'current_week'

284

@from = Date.today - (Date.today.cwday - 1)%7

284

@from = Date.today - (Date.today.cwday - 1)%7

285

@to = @from + 6

285

@to = @from + 6

286

when 'last_week'

286

when 'last_week'

287

@from = Date.today - 7 - (Date.today.cwday - 1)%7

287

@from = Date.today - 7 - (Date.today.cwday - 1)%7

288

@to = @from + 6

288

@to = @from + 6

289

when '7_days'

289

when '7_days'

290

@from = Date.today - 7

290

@from = Date.today - 7

291

@to = Date.today

291

@to = Date.today

292

when 'current_month'

292

when 'current_month'

293

@from = Date.civil(Date.today.year, Date.today.month, 1)

293

@from = Date.civil(Date.today.year, Date.today.month, 1)

294

@to = (@from >> 1) - 1

294

@to = (@from >> 1) - 1

295

when 'last_month'

295

when 'last_month'

296

@from = Date.civil(Date.today.year, Date.today.month, 1) << 1

296

@from = Date.civil(Date.today.year, Date.today.month, 1) << 1

297

@to = (@from >> 1) - 1

297

@to = (@from >> 1) - 1

298

when '30_days'

298

when '30_days'

299

@from = Date.today - 30

299

@from = Date.today - 30

300

@to = Date.today

300

@to = Date.today

301

when 'current_year'

301

when 'current_year'

302

@from = Date.civil(Date.today.year, 1, 1)

302

@from = Date.civil(Date.today.year, 1, 1)

303

@to = Date.civil(Date.today.year, 12, 31)

303

@to = Date.civil(Date.today.year, 12, 31)

304

end

304

end

305

elsif params[:period_type] == '2' || (params[:period_type].nil? && (!params[:from].nil? || !params[:to].nil?))

305

elsif params[:period_type] == '2' || (params[:period_type].nil? && (!params[:from].nil? || !params[:to].nil?))

306

begin; @from = params[:from].to_s.to_date unless params[:from].blank?; rescue; end

306

begin; @from = params[:from].to_s.to_date unless params[:from].blank?; rescue; end

307

begin; @to = params[:to].to_s.to_date unless params[:to].blank?; rescue; end

307

begin; @to = params[:to].to_s.to_date unless params[:to].blank?; rescue; end

308

@free_period = true

308

@free_period = true

309

else

309

else

310

# default

310

# default

311

end

311

end

312

313

@from, @to = @to, @from if @from && @to && @from > @to

313

@from, @to = @to, @from if @from && @to && @from > @to

314

@from ||= (TimeEntry.earilest_date_for_project(@project) || Date.today)

314

@from ||= (TimeEntry.earilest_date_for_project(@project) || Date.today)

315

@to ||= (TimeEntry.latest_date_for_project(@project) || Date.today)

315

@to ||= (TimeEntry.latest_date_for_project(@project) || Date.today)

316

end

316

end

317

318

def parse_params_for_bulk_time_entry_attributes(params)

318

def parse_params_for_bulk_time_entry_attributes(params)

319

attributes = (params[:time_entry] || {}).reject {|k,v| v.blank?}

319

attributes = (params[:time_entry] || {}).reject {|k,v| v.blank?}

320

attributes.keys.each {|k| attributes[k] = '' if attributes[k] == 'none'}

320

attributes.keys.each {|k| attributes[k] = '' if attributes[k] == 'none'}

321

attributes[:custom_field_values].reject! {|k,v| v.blank?} if attributes[:custom_field_values]

321

attributes[:custom_field_values].reject! {|k,v| v.blank?} if attributes[:custom_field_values]

322

attributes

322

attributes

323

end

323

end

324

end

324

end

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages

             # Redmine - project management software
             # Copyright (C) 2006-2011  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class TimelogController < ApplicationController
               menu_item :issues
               before_filter :find_project, :only => [:new, :create]
               before_filter :find_time_entry, :only => [:show, :edit, :update]
               before_filter :find_time_entries, :only => [:bulk_edit, :bulk_update, :destroy]
               before_filter :authorize, :except => [:index]
               before_filter :find_optional_project, :only => [:index]
               accept_rss_auth :index
               accept_api_auth :index, :show, :create, :update, :destroy
               helper :sort
               include SortHelper
               helper :issues
               include TimelogHelper
               helper :custom_fields
               include CustomFieldsHelper
               def index
                 sort_init 'spent_on', 'desc'
                 sort_update 'spent_on' => 'spent_on',
                             'user' => 'user_id',
                             'activity' => 'activity_id',
                             'project' => "#{Project.table_name}.name",
                             'issue' => 'issue_id',
                             'hours' => 'hours'
                 cond = ARCondition.new
                 if @issue
                   cond << "#{Issue.table_name}.root_id = #{@issue.root_id} AND #{Issue.table_name}.lft >= #{@issue.lft} AND #{Issue.table_name}.rgt <= #{@issue.rgt}"
                 elsif @project
                   cond << @project.project_condition(Setting.display_subprojects_issues?)
                 end
                 retrieve_date_range
                 cond << ['spent_on BETWEEN ? AND ?', @from, @to]
                 respond_to do |format|
                   format.html {
                     # Paginate results
                     @entry_count = TimeEntry.visible.count(:include => [:project, :issue], :conditions => cond.conditions)
                     @entry_pages = Paginator.new self, @entry_count, per_page_option, params['page']
                     @entries = TimeEntry.visible.find(:all,
                                               :include => [:project, :activity, :user, {:issue => :tracker}],
                                               :conditions => cond.conditions,
                                               :order => sort_clause,
                                               :limit  =>  @entry_pages.items_per_page,
                                               :offset =>  @entry_pages.current.offset)
                     @total_hours = TimeEntry.visible.sum(:hours, :include => [:project, :issue], :conditions => cond.conditions).to_f
                     render :layout => !request.xhr?
                   }
                   format.api  {
                     @entry_count = TimeEntry.visible.count(:include => [:project, :issue], :conditions => cond.conditions)
                     @offset, @limit = api_offset_and_limit
                     @entries = TimeEntry.visible.find(:all,
                                               :include => [:project, :activity, :user, {:issue => :tracker}],
                                               :conditions => cond.conditions,
                                               :order => sort_clause,
                                               :limit  => @limit,
                                               :offset => @offset)
                   }
                   format.atom {
                     entries = TimeEntry.visible.find(:all,
                                              :include => [:project, :activity, :user, {:issue => :tracker}],
                                              :conditions => cond.conditions,
                                              :order => "#{TimeEntry.table_name}.created_on DESC",
                                              :limit => Setting.feeds_limit.to_i)
                     render_feed(entries, :title => l(:label_spent_time))
                   }
                   format.csv {
                     # Export all entries
                     @entries = TimeEntry.visible.find(:all,
                                               :include => [:project, :activity, :user, {:issue => [:tracker, :assigned_to, :priority]}],
                                               :conditions => cond.conditions,
                                               :order => sort_clause)
                     send_data(entries_to_csv(@entries), :type => 'text/csv; header=present', :filename => 'timelog.csv')
                   }
                 end
               end
               def show
                 respond_to do |format|
                   # TODO: Implement html response
                   format.html { render :nothing => true, :status => 406 }
                   format.api
                 end
               end
               def new
                 @time_entry ||= TimeEntry.new(:project => @project, :issue => @issue, :user => User.current, :spent_on => User.current.today)
-                @time_entry.attributes = params[:time_entry]
+                @time_entry.safe_attributes = params[:time_entry]
                 call_hook(:controller_timelog_edit_before_save, { :params => params, :time_entry => @time_entry })
                 render :action => 'edit'
               end
               verify :method => :post, :only => :create, :render => {:nothing => true, :status => :method_not_allowed }
               def create
                 @time_entry ||= TimeEntry.new(:project => @project, :issue => @issue, :user => User.current, :spent_on => User.current.today)
-                @time_entry.attributes = params[:time_entry]
+                @time_entry.safe_attributes = params[:time_entry]
                 call_hook(:controller_timelog_edit_before_save, { :params => params, :time_entry => @time_entry })
                 if @time_entry.save
                   respond_to do |format|
                     format.html {
                       flash[:notice] = l(:notice_successful_update)
                       redirect_back_or_default :action => 'index', :project_id => @time_entry.project
                     }
                     format.api  { render :action => 'show', :status => :created, :location => time_entry_url(@time_entry) }
                   end
                 else
                   respond_to do |format|
                     format.html { render :action => 'edit' }
                     format.api  { render_validation_errors(@time_entry) }
                   end
                 end
               end
               def edit
-                @time_entry.attributes = params[:time_entry]
+                @time_entry.safe_attributes = params[:time_entry]
                 call_hook(:controller_timelog_edit_before_save, { :params => params, :time_entry => @time_entry })
               end
               verify :method => :put, :only => :update, :render => {:nothing => true, :status => :method_not_allowed }
               def update
-                @time_entry.attributes = params[:time_entry]
+                @time_entry.safe_attributes = params[:time_entry]
                 call_hook(:controller_timelog_edit_before_save, { :params => params, :time_entry => @time_entry })
                 if @time_entry.save
                   respond_to do |format|
                     format.html {
                       flash[:notice] = l(:notice_successful_update)
                       redirect_back_or_default :action => 'index', :project_id => @time_entry.project
                     }
                     format.api  { head :ok }
                   end
                 else
                   respond_to do |format|
                     format.html { render :action => 'edit' }
                     format.api  { render_validation_errors(@time_entry) }
                   end
                 end
               end
               def bulk_edit
                 @available_activities = TimeEntryActivity.shared.active
                 @custom_fields = TimeEntry.first.available_custom_fields
               end
               def bulk_update
                 attributes = parse_params_for_bulk_time_entry_attributes(params)
                 unsaved_time_entry_ids = []
                 @time_entries.each do |time_entry|
                   time_entry.reload
-                  time_entry.attributes = attributes
+                  time_entry.safe_attributes = attributes
                   call_hook(:controller_time_entries_bulk_edit_before_save, { :params => params, :time_entry => time_entry })
                   unless time_entry.save
                     # Keep unsaved time_entry ids to display them in flash error
                     unsaved_time_entry_ids << time_entry.id
                   end
                 end
                 set_flash_from_bulk_time_entry_save(@time_entries, unsaved_time_entry_ids)
                 redirect_back_or_default({:controller => 'timelog', :action => 'index', :project_id => @projects.first})
               end
               verify :method => :delete, :only => :destroy, :render => {:nothing => true, :status => :method_not_allowed }
               def destroy
                 @time_entries.each do |t|
                   begin
                     unless t.destroy && t.destroyed?
                       respond_to do |format|
                         format.html {
                           flash[:error] = l(:notice_unable_delete_time_entry)
                           redirect_to :back
                         }
                         format.api  { render_validation_errors(t) }
                       end
                       return
                     end
                   rescue ::ActionController::RedirectBackError
                     redirect_to :action => 'index', :project_id => @projects.first
                     return
                   end
                 end
                 respond_to do |format|
                   format.html {
                     flash[:notice] = l(:notice_successful_delete)
                     redirect_back_or_default(:action => 'index', :project_id => @projects.first)
                   }
                   format.api  { head :ok }
                 end
               end
             private
               def find_time_entry
                 @time_entry = TimeEntry.find(params[:id])
                 unless @time_entry.editable_by?(User.current)
                   render_403
                   return false
                 end
                 @project = @time_entry.project
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               def find_time_entries
                 @time_entries = TimeEntry.find_all_by_id(params[:id] || params[:ids])
                 raise ActiveRecord::RecordNotFound if @time_entries.empty?
                 @projects = @time_entries.collect(&:project).compact.uniq
                 @project = @projects.first if @projects.size == 1
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               def set_flash_from_bulk_time_entry_save(time_entries, unsaved_time_entry_ids)
                 if unsaved_time_entry_ids.empty?
                   flash[:notice] = l(:notice_successful_update) unless time_entries.empty?
                 else
                   flash[:error] = l(:notice_failed_to_save_time_entries,
                                     :count => unsaved_time_entry_ids.size,
                                     :total => time_entries.size,
                                     :ids => '#' + unsaved_time_entry_ids.join(', #'))
                 end
               end
               def find_project
                 if (issue_id = (params[:issue_id] || params[:time_entry] && params[:time_entry][:issue_id])).present?
                   @issue = Issue.find(issue_id)
                   @project = @issue.project
                 elsif (project_id = (params[:project_id] || params[:time_entry] && params[:time_entry][:project_id])).present?
                   @project = Project.find(project_id)
                 else
                   render_404
                   return false
                 end
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               def find_optional_project
                 if !params[:issue_id].blank?
                   @issue = Issue.find(params[:issue_id])
                   @project = @issue.project
                 elsif !params[:project_id].blank?
                   @project = Project.find(params[:project_id])
                 end
                 deny_access unless User.current.allowed_to?(:view_time_entries, @project, :global => true)
               end
               # Retrieves the date range based on predefined ranges or specific from/to param dates
               def retrieve_date_range
                 @free_period = false
                 @from, @to = nil, nil
                 if params[:period_type] == '1' || (params[:period_type].nil? && !params[:period].nil?)
                   case params[:period].to_s
                   when 'today'
                     @from = @to = Date.today
                   when 'yesterday'
                     @from = @to = Date.today - 1
                   when 'current_week'
                     @from = Date.today - (Date.today.cwday - 1)%7
                     @to = @from + 6
                   when 'last_week'
                     @from = Date.today - 7 - (Date.today.cwday - 1)%7
                     @to = @from + 6
                   when '7_days'
                     @from = Date.today - 7
                     @to = Date.today
                   when 'current_month'
                     @from = Date.civil(Date.today.year, Date.today.month, 1)
                     @to = (@from >> 1) - 1
                   when 'last_month'
                     @from = Date.civil(Date.today.year, Date.today.month, 1) << 1
                     @to = (@from >> 1) - 1
                   when '30_days'
                     @from = Date.today - 30
                     @to = Date.today
                   when 'current_year'
                     @from = Date.civil(Date.today.year, 1, 1)
                     @to = Date.civil(Date.today.year, 12, 31)
                   end
                 elsif params[:period_type] == '2' || (params[:period_type].nil? && (!params[:from].nil? || !params[:to].nil?))
                   begin; @from = params[:from].to_s.to_date unless params[:from].blank?; rescue; end
                   begin; @to = params[:to].to_s.to_date unless params[:to].blank?; rescue; end
                   @free_period = true
                 else
                   # default
                 end
                 @from, @to = @to, @from if @from && @to && @from > @to
                 @from ||= (TimeEntry.earilest_date_for_project(@project) || Date.today)
                 @to   ||= (TimeEntry.latest_date_for_project(@project) || Date.today)
               end
               def parse_params_for_bulk_time_entry_attributes(params)
                 attributes = (params[:time_entry] || {}).reject {|k,v| v.blank?}
                 attributes.keys.each {|k| attributes[k] = '' if attributes[k] == 'none'}
                 attributes[:custom_field_values].reject! {|k,v| v.blank?} if attributes[:custom_field_values]
                 attributes
               end
             end

             # Redmine - project management software
             # Copyright (C) 2006-2011  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class TimeEntry < ActiveRecord::Base
+              include Redmine::SafeAttributes
               # could have used polymorphic association
               # project association here allows easy loading of time entries at project level with one database trip
               belongs_to :project
               belongs_to :issue
               belongs_to :user
               belongs_to :activity, :class_name => 'TimeEntryActivity', :foreign_key => 'activity_id'
               attr_protected :project_id, :user_id, :tyear, :tmonth, :tweek
               acts_as_customizable
               acts_as_event :title => Proc.new {|o| "#{l_hours(o.hours)} (#{(o.issue || o.project).event_title})"},
                             :url => Proc.new {|o| {:controller => 'timelog', :action => 'index', :project_id => o.project, :issue_id => o.issue}},
                             :author => :user,
                             :description => :comments
               acts_as_activity_provider :timestamp => "#{table_name}.created_on",
                                         :author_key => :user_id,
                                         :find_options => {:include => :project}
               validates_presence_of :user_id, :activity_id, :project_id, :hours, :spent_on
               validates_numericality_of :hours, :allow_nil => true, :message => :invalid
               validates_length_of :comments, :maximum => 255, :allow_nil => true
               before_validation :set_project_if_nil
               validate :validate_time_entry
               named_scope :visible, lambda {|*args| {
                 :include => :project,
                 :conditions => Project.allowed_to_condition(args.shift || User.current, :view_time_entries, *args)
               }}
+              safe_attributes 'hours', 'comments', 'issue_id', 'activity_id', 'spent_on', 'custom_field_values'
               def after_initialize
                 if new_record? && self.activity.nil?
                   if default_activity = TimeEntryActivity.default
                     self.activity_id = default_activity.id
                   end
                   self.hours = nil if hours == 0
                 end
               end
               def set_project_if_nil
                 self.project = issue.project if issue && project.nil?
               end
               def validate_time_entry
                 errors.add :hours, :invalid if hours && (hours < 0 || hours >= 1000)
                 errors.add :project_id, :invalid if project.nil?
                 errors.add :issue_id, :invalid if (issue_id && !issue) || (issue && project!=issue.project)
               end
               def hours=(h)
                 write_attribute :hours, (h.is_a?(String) ? (h.to_hours || h) : h)
               end
               # tyear, tmonth, tweek assigned where setting spent_on attributes
               # these attributes make time aggregations easier
               def spent_on=(date)
                 super
                 if spent_on.is_a?(Time)
                   self.spent_on = spent_on.to_date
                 end
                 self.tyear = spent_on ? spent_on.year : nil
                 self.tmonth = spent_on ? spent_on.month : nil
                 self.tweek = spent_on ? Date.civil(spent_on.year, spent_on.month, spent_on.day).cweek : nil
               end
               # Returns true if the time entry can be edited by usr, otherwise false
               def editable_by?(usr)
                 (usr == user && usr.allowed_to?(:edit_own_time_entries, project)) || usr.allowed_to?(:edit_time_entries, project)
               end
               def self.earilest_date_for_project(project=nil)
                 finder_conditions = ARCondition.new(Project.allowed_to_condition(User.current, :view_time_entries))
                 if project
                   finder_conditions << ["project_id IN (?)", project.hierarchy.collect(&:id)]
                 end
                 TimeEntry.minimum(:spent_on, :include => :project, :conditions => finder_conditions.conditions)
               end
               def self.latest_date_for_project(project=nil)
                 finder_conditions = ARCondition.new(Project.allowed_to_condition(User.current, :view_time_entries))
                 if project
                   finder_conditions << ["project_id IN (?)", project.hierarchy.collect(&:id)]
                 end
                 TimeEntry.maximum(:spent_on, :include => :project, :conditions => finder_conditions.conditions)
               end
             end