| @@ -69,7 +69,7 class TimeEntry < ActiveRecord::Base | |||||
| 69 | if attrs |
|
69 | if attrs | |
| 70 | attrs = super(attrs) |
|
70 | attrs = super(attrs) | |
| 71 | if issue_id_changed? && issue |
|
71 | if issue_id_changed? && issue | |
| 72 | if user.allowed_to?(:log_time, issue.project) |
|
72 | if issue.visible?(user) && user.allowed_to?(:log_time, issue.project) | |
| 73 | if attrs[:project_id].blank? && issue.project_id != project_id |
|
73 | if attrs[:project_id].blank? && issue.project_id != project_id | |
| 74 | self.project_id = issue.project_id |
|
74 | self.project_id = issue.project_id | |
| 75 | end |
|
75 | end | |
| @@ -13,7 +13,9 | |||||
| 13 | <% end %> |
|
13 | <% end %> | |
| 14 | <p> |
|
14 | <p> | |
| 15 | <%= f.text_field :issue_id, :size => 6 %> |
|
15 | <%= f.text_field :issue_id, :size => 6 %> | |
| 16 | <span id="time_entry_issue"><%= h("#{@time_entry.issue.tracker.name} ##{@time_entry.issue.id}: #{@time_entry.issue.subject}") if @time_entry.issue %></span> |
|
16 | <% if @time_entry.issue.try(:visible?) %> | |
|
|
17 | <span id="time_entry_issue"><%= "#{@time_entry.issue.tracker.name} ##{@time_entry.issue.id}: #{@time_entry.issue.subject}" %></span> | |||
|
|
18 | <% end %> | |||
| 17 | </p> |
|
19 | </p> | |
| 18 | <p><%= f.text_field :spent_on, :size => 10, :required => true %><%= calendar_for('time_entry_spent_on') %></p> |
|
20 | <p><%= f.text_field :spent_on, :size => 10, :required => true %><%= calendar_for('time_entry_spent_on') %></p> | |
| 19 | <p><%= f.text_field :hours, :size => 6, :required => true %></p> |
|
21 | <p><%= f.text_field :hours, :size => 6, :required => true %></p> | |
| @@ -212,6 +212,23 class TimelogControllerTest < ActionController::TestCase | |||||
| 212 | end |
|
212 | end | |
| 213 | end |
|
213 | end | |
| 214 |
|
214 | |||
|
|
215 | def test_create_on_issue_that_is_not_visible_should_not_disclose_subject | |||
|
|
216 | issue = Issue.generate!(:subject => "issue_that_is_not_visible", :is_private => true) | |||
|
|
217 | assert !issue.visible?(User.find(3)) | |||
|
|
218 | ||||
|
|
219 | @request.session[:user_id] = 3 | |||
|
|
220 | assert_no_difference 'TimeEntry.count' do | |||
|
|
221 | post :create, :time_entry => { | |||
|
|
222 | :project_id => '', :issue_id => issue.id.to_s, | |||
|
|
223 | :activity_id => '11', :spent_on => '2008-03-14', :hours => '7.3' | |||
|
|
224 | } | |||
|
|
225 | end | |||
|
|
226 | assert_select_error /Issue is invalid/ | |||
|
|
227 | assert_select "input[name=?][value=?]", "time_entry[issue_id]", issue.id.to_s | |||
|
|
228 | assert_select "#time_entry_issue", 0 | |||
|
|
229 | assert !response.body.include?('issue_that_is_not_visible') | |||
|
|
230 | end | |||
|
|
231 | ||||
| 215 | def test_create_and_continue_at_project_level |
|
232 | def test_create_and_continue_at_project_level | |
| 216 | @request.session[:user_id] = 2 |
|
233 | @request.session[:user_id] = 2 | |
| 217 | assert_difference 'TimeEntry.count' do |
|
234 | assert_difference 'TimeEntry.count' do | |
General Comments 0
You need to be logged in to leave comments.
Login now