jro_apps/redmine Commit - r2114:5d2899ee1b3e

AttachmentsController now handles attachments deletion....

Jean-Philippe Lang -

r2114:5d2899ee1b3e

parent child

Context file:

r2114:5d2899ee1b3e

Expand all files

vendor/plugins/acts_as_attachable/init.rb created 644 +2 0

@@ -0,0 +1,2
	1	require File.dirname(__FILE__) + '/lib/acts_as_attachable'
	2	ActiveRecord::Base.send(:include, Redmine::Acts::Attachable)

vendor/plugins/acts_as_attachable/lib/acts_as_attachable.rb created 644 +57 0

@@ -0,0 +1,57
	1	# Redmine - project management software
	2	# Copyright (C) 2006-2008 Jean-Philippe Lang
	3	#
	4	# This program is free software; you can redistribute it and/or
	5	# modify it under the terms of the GNU General Public License
	6	# as published by the Free Software Foundation; either version 2
	7	# of the License, or (at your option) any later version.
	8	#
	9	# This program is distributed in the hope that it will be useful,
	10	# but WITHOUT ANY WARRANTY; without even the implied warranty of
	11	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	12	# GNU General Public License for more details.
	13	#
	14	# You should have received a copy of the GNU General Public License
	15	# along with this program; if not, write to the Free Software
	16	# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
	17
	18	module Redmine
	19	module Acts
	20	module Attachable
	21	def self.included(base)
	22	base.extend ClassMethods
	23	end
	24
	25	module ClassMethods
	26	def acts_as_attachable(options = {})
	27	cattr_accessor :attachable_options
	28	self.attachable_options = {}
	29	attachable_options[:view_permission] = options.delete(:view_permission) \|\| "view_#{self.name.pluralize.underscore}".to_sym
	30	attachable_options[:delete_permission] = options.delete(:delete_permission) \|\| "edit_#{self.name.pluralize.underscore}".to_sym
	31
	32	has_many :attachments, options.merge(:as => :container,
	33	:order => "#{Attachment.table_name}.created_on",
	34	:dependent => :destroy)
	35	send :include, Redmine::Acts::Attachable::InstanceMethods
	36	end
	37	end
	38
	39	module InstanceMethods
	40	def self.included(base)
	41	base.extend ClassMethods
	42	end
	43
	44	def attachments_visible?(user=User.current)
	45	user.allowed_to?(self.class.attachable_options[:view_permission], self.project)
	46	end
	47
	48	def attachments_deletable?(user=User.current)
	49	user.allowed_to?(self.class.attachable_options[:delete_permission], self.project)
	50	end
	51
	52	module ClassMethods
	53	end
	54	end
	55	end
	56	end
	57	end

app/controllers/attachments_controller.rb +25 -8

-            # redMine - project management software
+            # Redmine - project management software
-            # Copyright (C) 2006-2007  Jean-Philippe Lang
+            # Copyright (C) 2006-2008  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class AttachmentsController < ApplicationController
               before_filter :find_project
+              before_filter :read_authorize, :except => :destroy
+              before_filter :delete_authorize, :only => :destroy
+              verify :method => :post, :only => :destroy
               def show
                 if @attachment.is_diff?
                   @diff = File.new(@attachment.diskfile, "rb").read
                   render :action => 'diff'
                 elsif @attachment.is_text?
                   @content = File.new(@attachment.diskfile, "rb").read
                   render :action => 'file'
                 elsif
                   download
                 end
               end
               def download
                 @attachment.increment_download if @attachment.container.is_a?(Version)
                 # images are sent inline
                 send_file @attachment.diskfile, :filename => filename_for_content_disposition(@attachment.filename),
                                                 :type => @attachment.content_type,
                                                 :disposition => (@attachment.image? ? 'inline' : 'attachment')
               end
+              def destroy
+                # Make sure association callbacks are called
+                @attachment.container.attachments.delete(@attachment)
+                redirect_to :back
+              rescue ::ActionController::RedirectBackError
+                redirect_to :controller => 'projects', :action => 'show', :id => @project
+              end
             private
               def find_project
                 @attachment = Attachment.find(params[:id])
                 # Show 404 if the filename in the url is wrong
                 raise ActiveRecord::RecordNotFound if params[:filename] && params[:filename] != @attachment.filename
                 @project = @attachment.project
-                permission = @attachment.container.is_a?(Version) ? :view_files : "view_#{@attachment.container.class.name.underscore.pluralize}".to_sym
-                allowed = User.current.allowed_to?(permission, @project)
-                allowed ? true : (User.current.logged? ? render_403 : require_login)
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
+              def read_authorize
+                @attachment.visible? ? true : deny_access
+              end
+              def delete_authorize
+                @attachment.deletable? ? true : deny_access
+              end
             end

app/controllers/documents_controller.rb 0 -5

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class DocumentsController < ApplicationController
               before_filter :find_project, :only => [:index, :new]
               before_filter :find_document, :except => [:index, :new]
               before_filter :authorize
               helper :attachments
               def index
                 @sort_by = %w(category date title author).include?(params[:sort_by]) ? params[:sort_by] : 'category'
                 documents = @project.documents.find :all, :include => [:attachments, :category]
                 case @sort_by
                 when 'date'
                   @grouped = documents.group_by {|d| d.created_on.to_date }
                 when 'title'
                   @grouped = documents.group_by {|d| d.title.first.upcase}
                 when 'author'
                   @grouped = documents.select{|d| d.attachments.any?}.group_by {|d| d.attachments.last.author}
                 else
                   @grouped = documents.group_by(&:category)
                 end
                 render :layout => false if request.xhr?
               end
               def show
                 @attachments = @document.attachments.find(:all, :order => "created_on DESC")
               end
               def new
                 @document = @project.documents.build(params[:document])
                 if request.post? and @document.save
                   attach_files(@document, params[:attachments])
                   flash[:notice] = l(:notice_successful_create)
                   Mailer.deliver_document_added(@document) if Setting.notified_events.include?('document_added')
                   redirect_to :action => 'index', :project_id => @project
                 end
               end
               def edit
                 @categories = Enumeration::get_values('DCAT')
                 if request.post? and @document.update_attributes(params[:document])
                   flash[:notice] = l(:notice_successful_update)
                   redirect_to :action => 'show', :id => @document
                 end
               end
               def destroy
                 @document.destroy
                 redirect_to :controller => 'documents', :action => 'index', :project_id => @project
               end
               def add_attachment
                 attachments = attach_files(@document, params[:attachments])
                 Mailer.deliver_attachments_added(attachments) if !attachments.empty? && Setting.notified_events.include?('document_added')
                 redirect_to :action => 'show', :id => @document
               end
-              def destroy_attachment
-                @document.attachments.find(params[:attachment_id]).destroy
-                redirect_to :action => 'show', :id => @document
-              end
             private
               def find_project
                 @project = Project.find(params[:project_id])
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               def find_document
                 @document = Document.find(params[:id])
                 @project = @document.project
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
             end

app/controllers/issues_controller.rb +1 -12

             # Redmine - project management software
             # Copyright (C) 2006-2008  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class IssuesController < ApplicationController
               menu_item :new_issue, :only => :new
-              before_filter :find_issue, :only => [:show, :edit, :reply, :destroy_attachment]
+              before_filter :find_issue, :only => [:show, :edit, :reply]
               before_filter :find_issues, :only => [:bulk_edit, :move, :destroy]
               before_filter :find_project, :only => [:new, :update_form, :preview]
               before_filter :authorize, :except => [:index, :changes, :gantt, :calendar, :preview, :update_form, :context_menu]
               before_filter :find_optional_project, :only => [:index, :changes, :gantt, :calendar]
               accept_key_auth :index, :changes
               helper :journals
               helper :projects
               include ProjectsHelper
               helper :custom_fields
               include CustomFieldsHelper
               helper :ifpdf
               include IfpdfHelper
               helper :issue_relations
               include IssueRelationsHelper
               helper :watchers
               include WatchersHelper
               helper :attachments
               include AttachmentsHelper
               helper :queries
               helper :sort
               include SortHelper
               include IssuesHelper
               helper :timelog
               def index
                 sort_init "#{Issue.table_name}.id", "desc"
                 sort_update
                 retrieve_query
                 if @query.valid?
                   limit = per_page_option
                   respond_to do |format|
                     format.html { }
                     format.atom { }
                     format.csv  { limit = Setting.issues_export_limit.to_i }
                     format.pdf  { limit = Setting.issues_export_limit.to_i }
                   end
                   @issue_count = Issue.count(:include => [:status, :project], :conditions => @query.statement)
                   @issue_pages = Paginator.new self, @issue_count, limit, params['page']
                   @issues = Issue.find :all, :order => sort_clause,
                                        :include => [ :assigned_to, :status, :tracker, :project, :priority, :category, :fixed_version ],
                                        :conditions => @query.statement,
                                        :limit  =>  limit,
                                        :offset =>  @issue_pages.current.offset
                   respond_to do |format|
                     format.html { render :template => 'issues/index.rhtml', :layout => !request.xhr? }
                     format.atom { render_feed(@issues, :title => "#{@project || Setting.app_title}: #{l(:label_issue_plural)}") }
                     format.csv  { send_data(issues_to_csv(@issues, @project).read, :type => 'text/csv; header=present', :filename => 'export.csv') }
                     format.pdf  { send_data(render(:template => 'issues/index.rfpdf', :layout => false), :type => 'application/pdf', :filename => 'export.pdf') }
                   end
                 else
                   # Send html if the query is not valid
                   render(:template => 'issues/index.rhtml', :layout => !request.xhr?)
                 end
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               def changes
                 sort_init "#{Issue.table_name}.id", "desc"
                 sort_update
                 retrieve_query
                 if @query.valid?
                   @journals = Journal.find :all, :include => [ :details, :user, {:issue => [:project, :author, :tracker, :status]} ],
                                                  :conditions => @query.statement,
                                                  :limit => 25,
                                                  :order => "#{Journal.table_name}.created_on DESC"
                 end
                 @title = (@project ? @project.name : Setting.app_title) + ": " + (@query.new_record? ? l(:label_changes_details) : @query.name)
                 render :layout => false, :content_type => 'application/atom+xml'
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               def show
                 @journals = @issue.journals.find(:all, :include => [:user, :details], :order => "#{Journal.table_name}.created_on ASC")
                 @journals.each_with_index {|j,i| j.indice = i+1}
                 @journals.reverse! if User.current.wants_comments_in_reverse_order?
                 @allowed_statuses = @issue.new_statuses_allowed_to(User.current)
                 @edit_allowed = User.current.allowed_to?(:edit_issues, @project)
                 @priorities = Enumeration::get_values('IPRI')
                 @time_entry = TimeEntry.new
                 respond_to do |format|
                   format.html { render :template => 'issues/show.rhtml' }
                   format.atom { render :action => 'changes', :layout => false, :content_type => 'application/atom+xml' }
                   format.pdf  { send_data(render(:template => 'issues/show.rfpdf', :layout => false), :type => 'application/pdf', :filename => "#{@project.identifier}-#{@issue.id}.pdf") }
                 end
               end
               # Add a new issue
               # The new issue will be created from an existing one if copy_from parameter is given
               def new
                 @issue = Issue.new
                 @issue.copy_from(params[:copy_from]) if params[:copy_from]
                 @issue.project = @project
                 # Tracker must be set before custom field values
                 @issue.tracker ||= @project.trackers.find((params[:issue] && params[:issue][:tracker_id]) || params[:tracker_id] || :first)
                 if @issue.tracker.nil?
                   flash.now[:error] = 'No tracker is associated to this project. Please check the Project settings.'
                   render :nothing => true, :layout => true
                   return
                 end
                 @issue.attributes = params[:issue]
                 @issue.author = User.current
                 default_status = IssueStatus.default
                 unless default_status
                   flash.now[:error] = 'No default issue status is defined. Please check your configuration (Go to "Administration -> Issue statuses").'
                   render :nothing => true, :layout => true
                   return
                 end
                 @issue.status = default_status
                 @allowed_statuses = ([default_status] + default_status.find_new_statuses_allowed_to(User.current.role_for_project(@project), @issue.tracker)).uniq
                 if request.get? || request.xhr?
                   @issue.start_date ||= Date.today
                 else
                   requested_status = IssueStatus.find_by_id(params[:issue][:status_id])
                   # Check that the user is allowed to apply the requested status
                   @issue.status = (@allowed_statuses.include? requested_status) ? requested_status : default_status
                   if @issue.save
                     attach_files(@issue, params[:attachments])
                     flash[:notice] = l(:notice_successful_create)
                     Mailer.deliver_issue_add(@issue) if Setting.notified_events.include?('issue_added')
                     redirect_to :controller => 'issues', :action => 'show', :id => @issue
                     return
                   end
                 end
                 @priorities = Enumeration::get_values('IPRI')
                 render :layout => !request.xhr?
               end
               # Attributes that can be updated on workflow transition (without :edit permission)
               # TODO: make it configurable (at least per role)
               UPDATABLE_ATTRS_ON_TRANSITION = %w(status_id assigned_to_id fixed_version_id done_ratio) unless const_defined?(:UPDATABLE_ATTRS_ON_TRANSITION)
               def edit
                 @allowed_statuses = @issue.new_statuses_allowed_to(User.current)
                 @priorities = Enumeration::get_values('IPRI')
                 @edit_allowed = User.current.allowed_to?(:edit_issues, @project)
                 @time_entry = TimeEntry.new
                 @notes = params[:notes]
                 journal = @issue.init_journal(User.current, @notes)
                 # User can change issue attributes only if he has :edit permission or if a workflow transition is allowed
                 if (@edit_allowed || !@allowed_statuses.empty?) && params[:issue]
                   attrs = params[:issue].dup
                   attrs.delete_if {|k,v| !UPDATABLE_ATTRS_ON_TRANSITION.include?(k) } unless @edit_allowed
                   attrs.delete(:status_id) unless @allowed_statuses.detect {|s| s.id.to_s == attrs[:status_id].to_s}
                   @issue.attributes = attrs
                 end
                 if request.post?
                   @time_entry = TimeEntry.new(:project => @project, :issue => @issue, :user => User.current, :spent_on => Date.today)
                   @time_entry.attributes = params[:time_entry]
                   attachments = attach_files(@issue, params[:attachments])
                   attachments.each {|a| journal.details << JournalDetail.new(:property => 'attachment', :prop_key => a.id, :value => a.filename)}
                   call_hook(:controller_issues_edit_before_save, { :params => params, :issue => @issue, :time_entry => @time_entry, :journal => journal})
                   if (@time_entry.hours.nil? || @time_entry.valid?) && @issue.save
                     # Log spend time
                     if current_role.allowed_to?(:log_time)
                       @time_entry.save
                     end
                     if !journal.new_record?
                       # Only send notification if something was actually changed
                       flash[:notice] = l(:notice_successful_update)
                       Mailer.deliver_issue_edit(journal) if Setting.notified_events.include?('issue_updated')
                     end
                     redirect_to(params[:back_to] || {:action => 'show', :id => @issue})
                   end
                 end
               rescue ActiveRecord::StaleObjectError
                 # Optimistic locking exception
                 flash.now[:error] = l(:notice_locking_conflict)
               end
               def reply
                 journal = Journal.find(params[:journal_id]) if params[:journal_id]
                 if journal
                   user = journal.user
                   text = journal.notes
                 else
                   user = @issue.author
                   text = @issue.description
                 end
                 content = "#{ll(Setting.default_language, :text_user_wrote, user)}\\n> "
                 content << text.to_s.strip.gsub(%r{<pre>((.|\s)*?)</pre>}m, '[...]').gsub('"', '\"').gsub(/(\r?\n|\r\n?)/, "\\n> ") + "\\n\\n"
                 render(:update) { |page|
                   page.<< "$('notes').value = \"#{content}\";"
                   page.show 'update'
                   page << "Form.Element.focus('notes');"
                   page << "Element.scrollTo('update');"
                   page << "$('notes').scrollTop = $('notes').scrollHeight - $('notes').clientHeight;"
                 }
               end
               # Bulk edit a set of issues
               def bulk_edit
                 if request.post?
                   status = params[:status_id].blank? ? nil : IssueStatus.find_by_id(params[:status_id])
                   priority = params[:priority_id].blank? ? nil : Enumeration.find_by_id(params[:priority_id])
                   assigned_to = (params[:assigned_to_id].blank? || params[:assigned_to_id] == 'none') ? nil : User.find_by_id(params[:assigned_to_id])
                   category = (params[:category_id].blank? || params[:category_id] == 'none') ? nil : @project.issue_categories.find_by_id(params[:category_id])
                   fixed_version = (params[:fixed_version_id].blank? || params[:fixed_version_id] == 'none') ? nil : @project.versions.find_by_id(params[:fixed_version_id])
                   unsaved_issue_ids = []
                   @issues.each do |issue|
                     journal = issue.init_journal(User.current, params[:notes])
                     issue.priority = priority if priority
                     issue.assigned_to = assigned_to if assigned_to || params[:assigned_to_id] == 'none'
                     issue.category = category if category || params[:category_id] == 'none'
                     issue.fixed_version = fixed_version if fixed_version || params[:fixed_version_id] == 'none'
                     issue.start_date = params[:start_date] unless params[:start_date].blank?
                     issue.due_date = params[:due_date] unless params[:due_date].blank?
                     issue.done_ratio = params[:done_ratio] unless params[:done_ratio].blank?
                     call_hook(:controller_issues_bulk_edit_before_save, { :params => params, :issue => issue })
                     # Don't save any change to the issue if the user is not authorized to apply the requested status
                     if (status.nil? || (issue.status.new_status_allowed_to?(status, current_role, issue.tracker) && issue.status = status)) && issue.save
                       # Send notification for each issue (if changed)
                       Mailer.deliver_issue_edit(journal) if journal.details.any? && Setting.notified_events.include?('issue_updated')
                     else
                       # Keep unsaved issue ids to display them in flash error
                       unsaved_issue_ids << issue.id
                     end
                   end
                   if unsaved_issue_ids.empty?
                     flash[:notice] = l(:notice_successful_update) unless @issues.empty?
                   else
                     flash[:error] = l(:notice_failed_to_save_issues, unsaved_issue_ids.size, @issues.size, '#' + unsaved_issue_ids.join(', #'))
                   end
                   redirect_to(params[:back_to] || {:controller => 'issues', :action => 'index', :project_id => @project})
                   return
                 end
                 # Find potential statuses the user could be allowed to switch issues to
                 @available_statuses = Workflow.find(:all, :include => :new_status,
                                                           :conditions => {:role_id => current_role.id}).collect(&:new_status).compact.uniq.sort
               end
               def move
                 @allowed_projects = []
                 # find projects to which the user is allowed to move the issue
                 if User.current.admin?
                   # admin is allowed to move issues to any active (visible) project
                   @allowed_projects = Project.find(:all, :conditions => Project.visible_by(User.current), :order => 'name')
                 else
                   User.current.memberships.each {|m| @allowed_projects << m.project if m.role.allowed_to?(:move_issues)}
                 end
                 @target_project = @allowed_projects.detect {|p| p.id.to_s == params[:new_project_id]} if params[:new_project_id]
                 @target_project ||= @project
                 @trackers = @target_project.trackers
                 if request.post?
                   new_tracker = params[:new_tracker_id].blank? ? nil : @target_project.trackers.find_by_id(params[:new_tracker_id])
                   unsaved_issue_ids = []
                   @issues.each do |issue|
                     issue.init_journal(User.current)
                     unsaved_issue_ids << issue.id unless issue.move_to(@target_project, new_tracker)
                   end
                   if unsaved_issue_ids.empty?
                     flash[:notice] = l(:notice_successful_update) unless @issues.empty?
                   else
                     flash[:error] = l(:notice_failed_to_save_issues, unsaved_issue_ids.size, @issues.size, '#' + unsaved_issue_ids.join(', #'))
                   end
                   redirect_to :controller => 'issues', :action => 'index', :project_id => @project
                   return
                 end
                 render :layout => false if request.xhr?
               end
               def destroy
                 @hours = TimeEntry.sum(:hours, :conditions => ['issue_id IN (?)', @issues]).to_f
                 if @hours > 0
                   case params[:todo]
                   when 'destroy'
                     # nothing to do
                   when 'nullify'
                     TimeEntry.update_all('issue_id = NULL', ['issue_id IN (?)', @issues])
                   when 'reassign'
                     reassign_to = @project.issues.find_by_id(params[:reassign_to_id])
                     if reassign_to.nil?
                       flash.now[:error] = l(:error_issue_not_found_in_project)
                       return
                     else
                       TimeEntry.update_all("issue_id = #{reassign_to.id}", ['issue_id IN (?)', @issues])
                     end
                   else
                     # display the destroy form
                     return
                   end
                 end
                 @issues.each(&:destroy)
                 redirect_to :action => 'index', :project_id => @project
               end
-              def destroy_attachment
-                a = @issue.attachments.find(params[:attachment_id])
-                a.destroy
-                journal = @issue.init_journal(User.current)
-                journal.details << JournalDetail.new(:property => 'attachment',
-                                                     :prop_key => a.id,
-                                                     :old_value => a.filename)
-                journal.save
-                redirect_to :action => 'show', :id => @issue
-              end
               def gantt
                 @gantt = Redmine::Helpers::Gantt.new(params)
                 retrieve_query
                 if @query.valid?
                   events = []
                   # Issues that have start and due dates
                   events += Issue.find(:all,
                                        :order => "start_date, due_date",
                                        :include => [:tracker, :status, :assigned_to, :priority, :project],
                                        :conditions => ["(#{@query.statement}) AND (((start_date>=? and start_date<=?) or (due_date>=? and due_date<=?) or (start_date<? and due_date>?)) and start_date is not null and due_date is not null)", @gantt.date_from, @gantt.date_to, @gantt.date_from, @gantt.date_to, @gantt.date_from, @gantt.date_to]
                                        )
                   # Issues that don't have a due date but that are assigned to a version with a date
                   events += Issue.find(:all,
                                        :order => "start_date, effective_date",
                                        :include => [:tracker, :status, :assigned_to, :priority, :project, :fixed_version],
                                        :conditions => ["(#{@query.statement}) AND (((start_date>=? and start_date<=?) or (effective_date>=? and effective_date<=?) or (start_date<? and effective_date>?)) and start_date is not null and due_date is null and effective_date is not null)", @gantt.date_from, @gantt.date_to, @gantt.date_from, @gantt.date_to, @gantt.date_from, @gantt.date_to]
                                        )
                   # Versions
                   events += Version.find(:all, :include => :project,
                                                :conditions => ["(#{@query.project_statement}) AND effective_date BETWEEN ? AND ?", @gantt.date_from, @gantt.date_to])
                   @gantt.events = events
                 end
                 respond_to do |format|
                   format.html { render :template => "issues/gantt.rhtml", :layout => !request.xhr? }
                   format.png  { send_data(@gantt.to_image, :disposition => 'inline', :type => 'image/png', :filename => "#{@project.identifier}-gantt.png") } if @gantt.respond_to?('to_image')
                   format.pdf  { send_data(render(:template => "issues/gantt.rfpdf", :layout => false), :type => 'application/pdf', :filename => "#{@project.nil? ? '' : "#{@project.identifier}-" }gantt.pdf") }
                 end
               end
               def calendar
                 if params[:year] and params[:year].to_i > 1900
                   @year = params[:year].to_i
                   if params[:month] and params[:month].to_i > 0 and params[:month].to_i < 13
                     @month = params[:month].to_i
                   end
                 end
                 @year ||= Date.today.year
                 @month ||= Date.today.month
                 @calendar = Redmine::Helpers::Calendar.new(Date.civil(@year, @month, 1), current_language, :month)
                 retrieve_query
                 if @query.valid?
                   events = []
                   events += Issue.find(:all,
                                        :include => [:tracker, :status, :assigned_to, :priority, :project],
                                        :conditions => ["(#{@query.statement}) AND ((start_date BETWEEN ? AND ?) OR (due_date BETWEEN ? AND ?))", @calendar.startdt, @calendar.enddt, @calendar.startdt, @calendar.enddt]
                                        )
                   events += Version.find(:all, :include => :project,
                                                :conditions => ["(#{@query.project_statement}) AND effective_date BETWEEN ? AND ?", @calendar.startdt, @calendar.enddt])
                   @calendar.events = events
                 end
                 render :layout => false if request.xhr?
               end
               def context_menu
                 @issues = Issue.find_all_by_id(params[:ids], :include => :project)
                 if (@issues.size == 1)
                   @issue = @issues.first
                   @allowed_statuses = @issue.new_statuses_allowed_to(User.current)
                 end
                 projects = @issues.collect(&:project).compact.uniq
                 @project = projects.first if projects.size == 1
                 @can = {:edit => (@project && User.current.allowed_to?(:edit_issues, @project)),
                         :log_time => (@project && User.current.allowed_to?(:log_time, @project)),
                         :update => (@project && (User.current.allowed_to?(:edit_issues, @project) || (User.current.allowed_to?(:change_status, @project) && @allowed_statuses && !@allowed_statuses.empty?))),
                         :move => (@project && User.current.allowed_to?(:move_issues, @project)),
                         :copy => (@issue && @project.trackers.include?(@issue.tracker) && User.current.allowed_to?(:add_issues, @project)),
                         :delete => (@project && User.current.allowed_to?(:delete_issues, @project))
                         }
                 if @project
                   @assignables = @project.assignable_users
                   @assignables << @issue.assigned_to if @issue && @issue.assigned_to && !@assignables.include?(@issue.assigned_to)
                 end
                 @priorities = Enumeration.get_values('IPRI').reverse
                 @statuses = IssueStatus.find(:all, :order => 'position')
                 @back = request.env['HTTP_REFERER']
                 render :layout => false
               end
               def update_form
                 @issue = Issue.new(params[:issue])
                 render :action => :new, :layout => false
               end
               def preview
                 @issue = @project.issues.find_by_id(params[:id]) unless params[:id].blank?
                 @attachements = @issue.attachments if @issue
                 @text = params[:notes] || (params[:issue] ? params[:issue][:description] : nil)
                 render :partial => 'common/preview'
               end
             private
               def find_issue
                 @issue = Issue.find(params[:id], :include => [:project, :tracker, :status, :author, :priority, :category])
                 @project = @issue.project
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               # Filter for bulk operations
               def find_issues
                 @issues = Issue.find_all_by_id(params[:id] || params[:ids])
                 raise ActiveRecord::RecordNotFound if @issues.empty?
                 projects = @issues.collect(&:project).compact.uniq
                 if projects.size == 1
                   @project = projects.first
                 else
                   # TODO: let users bulk edit/move/destroy issues from different projects
                   render_error 'Can not bulk edit/move/destroy issues from different projects' and return false
                 end
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               def find_project
                 @project = Project.find(params[:project_id])
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               def find_optional_project
                 @project = Project.find(params[:project_id]) unless params[:project_id].blank?
                 allowed = User.current.allowed_to?({:controller => params[:controller], :action => params[:action]}, @project, :global => true)
                 allowed ? true : deny_access
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               # Retrieve query from session or build a new query
               def retrieve_query
                 if !params[:query_id].blank?
                   cond = "project_id IS NULL"
                   cond << " OR project_id = #{@project.id}" if @project
                   @query = Query.find(params[:query_id], :conditions => cond)
                   @query.project = @project
                   session[:query] = {:id => @query.id, :project_id => @query.project_id}
                 else
                   if params[:set_filter] || session[:query].nil? || session[:query][:project_id] != (@project ? @project.id : nil)
                     # Give it a name, required to be valid
                     @query = Query.new(:name => "_")
                     @query.project = @project
                     if params[:fields] and params[:fields].is_a? Array
                       params[:fields].each do |field|
                         @query.add_filter(field, params[:operators][field], params[:values][field])
                       end
                     else
                       @query.available_filters.keys.each do |field|
                         @query.add_short_filter(field, params[field]) if params[field]
                       end
                     end
                     session[:query] = {:project_id => @query.project_id, :filters => @query.filters}
                   else
                     @query = Query.find_by_id(session[:query][:id]) if session[:query][:id]
                     @query ||= Query.new(:name => "_", :project => @project, :filters => session[:query][:filters])
                     @query.project = @project
                   end
                 end
               end
             end

app/controllers/versions_controller.rb 0 -6

             # redMine - project management software
             # Copyright (C) 2006  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class VersionsController < ApplicationController
               menu_item :roadmap
               before_filter :find_project, :authorize
               def show
               end
               def edit
                 if request.post? and @version.update_attributes(params[:version])
                   flash[:notice] = l(:notice_successful_update)
                   redirect_to :controller => 'projects', :action => 'settings', :tab => 'versions', :id => @project
                 end
               end
               def destroy
                 @version.destroy
                 redirect_to :controller => 'projects', :action => 'settings', :tab => 'versions', :id => @project
               rescue
                 flash[:error] = l(:notice_unable_delete_version)
                 redirect_to :controller => 'projects', :action => 'settings', :tab => 'versions', :id => @project
               end
-              def destroy_file
-                @version.attachments.find(params[:attachment_id]).destroy
-                flash[:notice] = l(:notice_successful_delete)
-                redirect_to :controller => 'projects', :action => 'list_files', :id => @project
-              end
               def status_by
                 respond_to do |format|
                   format.html { render :action => 'show' }
                   format.js { render(:update) {|page| page.replace_html 'status_by', render_issue_status_by(@version, params[:status_by])} }
                 end
               end
             private
               def find_project
                 @version = Version.find(params[:id])
                 @project = @version.project
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
             end

app/controllers/wiki_controller.rb +1 -8

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require 'diff'
             class WikiController < ApplicationController
               before_filter :find_wiki, :authorize
-              verify :method => :post, :only => [:destroy, :destroy_attachment, :protect], :redirect_to => { :action => :index }
+              verify :method => :post, :only => [:destroy, :protect], :redirect_to => { :action => :index }
               helper :attachments
               include AttachmentsHelper
               # display a page (in editing mode if it doesn't exist)
               def index
                 page_title = params[:page]
                 @page = @wiki.find_or_new_page(page_title)
                 if @page.new_record?
                   if User.current.allowed_to?(:edit_wiki_pages, @project)
                     edit
                     render :action => 'edit'
                   else
                     render_404
                   end
                   return
                 end
                 if params[:version] && !User.current.allowed_to?(:view_wiki_edits, @project)
                   # Redirects user to the current version if he's not allowed to view previous versions
                   redirect_to :version => nil
                   return
                 end
                 @content = @page.content_for_version(params[:version])
                 if params[:export] == 'html'
                   export = render_to_string :action => 'export', :layout => false
                   send_data(export, :type => 'text/html', :filename => "#{@page.title}.html")
                   return
                 elsif params[:export] == 'txt'
                   send_data(@content.text, :type => 'text/plain', :filename => "#{@page.title}.txt")
                   return
                 end
             	@editable = editable?
                 render :action => 'show'
               end
               # edit an existing page or a new one
               def edit
                 @page = @wiki.find_or_new_page(params[:page])
                 return render_403 unless editable?
                 @page.content = WikiContent.new(:page => @page) if @page.new_record?
                 @content = @page.content_for_version(params[:version])
                 @content.text = initial_page_content(@page) if @content.text.blank?
                 # don't keep previous comment
                 @content.comments = nil
                 if request.get?
                   # To prevent StaleObjectError exception when reverting to a previous version
                   @content.version = @page.content.version
                 else
                   if !@page.new_record? && @content.text == params[:content][:text]
                     # don't save if text wasn't changed
                     redirect_to :action => 'index', :id => @project, :page => @page.title
                     return
                   end
                   #@content.text = params[:content][:text]
                   #@content.comments = params[:content][:comments]
                   @content.attributes = params[:content]
                   @content.author = User.current
                   # if page is new @page.save will also save content, but not if page isn't a new record
                   if (@page.new_record? ? @page.save : @content.save)
                     redirect_to :action => 'index', :id => @project, :page => @page.title
                   end
                 end
               rescue ActiveRecord::StaleObjectError
                 # Optimistic locking exception
                 flash[:error] = l(:notice_locking_conflict)
               end
               # rename a page
               def rename
                 @page = @wiki.find_page(params[:page])
             	return render_403 unless editable?
                 @page.redirect_existing_links = true
                 # used to display the *original* title if some AR validation errors occur
                 @original_title = @page.pretty_title
                 if request.post? && @page.update_attributes(params[:wiki_page])
                   flash[:notice] = l(:notice_successful_update)
                   redirect_to :action => 'index', :id => @project, :page => @page.title
                 end
               end
               def protect
                 page = @wiki.find_page(params[:page])
                 page.update_attribute :protected, params[:protected]
                 redirect_to :action => 'index', :id => @project, :page => page.title
               end
               # show page history
               def history
                 @page = @wiki.find_page(params[:page])
                 @version_count = @page.content.versions.count
                 @version_pages = Paginator.new self, @version_count, per_page_option, params['p']
                 # don't load text
                 @versions = @page.content.versions.find :all,
                                                         :select => "id, author_id, comments, updated_on, version",
                                                         :order => 'version DESC',
                                                         :limit  =>  @version_pages.items_per_page + 1,
                                                         :offset =>  @version_pages.current.offset
                 render :layout => false if request.xhr?
               end
               def diff
                 @page = @wiki.find_page(params[:page])
                 @diff = @page.diff(params[:version], params[:version_from])
                 render_404 unless @diff
               end
               def annotate
                 @page = @wiki.find_page(params[:page])
                 @annotate = @page.annotate(params[:version])
               end
               # remove a wiki page and its history
               def destroy
                 @page = @wiki.find_page(params[:page])
             	return render_403 unless editable?
                 @page.destroy if @page
                 redirect_to :action => 'special', :id => @project, :page => 'Page_index'
               end
               # display special pages
               def special
                 page_title = params[:page].downcase
                 case page_title
                 # show pages index, sorted by title
                 when 'page_index', 'date_index'
                   # eager load information about last updates, without loading text
                   @pages = @wiki.pages.find :all, :select => "#{WikiPage.table_name}.*, #{WikiContent.table_name}.updated_on",
                                                   :joins => "LEFT JOIN #{WikiContent.table_name} ON #{WikiContent.table_name}.page_id = #{WikiPage.table_name}.id",
                                                   :order => 'title'
                   @pages_by_date = @pages.group_by {|p| p.updated_on.to_date}
                   @pages_by_parent_id = @pages.group_by(&:parent_id)
                 # export wiki to a single html file
                 when 'export'
                   @pages = @wiki.pages.find :all, :order => 'title'
                   export = render_to_string :action => 'export_multiple', :layout => false
                   send_data(export, :type => 'text/html', :filename => "wiki.html")
                   return
                 else
                   # requested special page doesn't exist, redirect to default page
                   redirect_to :action => 'index', :id => @project, :page => nil and return
                 end
                 render :action => "special_#{page_title}"
               end
               def preview
                 page = @wiki.find_page(params[:page])
                 # page is nil when previewing a new page
                 return render_403 unless page.nil? || editable?(page)
                 if page
                   @attachements = page.attachments
                   @previewed = page.content
                 end
                 @text = params[:content][:text]
                 render :partial => 'common/preview'
               end
               def add_attachment
                 @page = @wiki.find_page(params[:page])
                 return render_403 unless editable?
                 attach_files(@page, params[:attachments])
                 redirect_to :action => 'index', :page => @page.title
               end
-              def destroy_attachment
-                @page = @wiki.find_page(params[:page])
-                return render_403 unless editable?
-                @page.attachments.find(params[:attachment_id]).destroy
-                redirect_to :action => 'index', :page => @page.title
-              end
             private
               def find_wiki
                 @project = Project.find(params[:id])
                 @wiki = @project.wiki
                 render_404 unless @wiki
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               # Returns true if the current user is allowed to edit the page, otherwise false
               def editable?(page = @page)
                 page.editable_by?(User.current)
               end
               # Returns the default content of a new wiki page
               def initial_page_content(page)
                 helper = Redmine::WikiFormatting.helper_for(Setting.text_formatting)
                 extend helper unless self.instance_of?(helper)
                 helper.instance_method(:initial_page_content).bind(self).call(page)
               end
             end

app/helpers/attachments_helper.rb +9 -4

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             module AttachmentsHelper
-              # displays the links to a collection of attachments
+              # Displays view/delete links to the attachments of the given object
-              def link_to_attachments(attachments, options = {})
+              # Options:
-                if attachments.any?
+              #   :author -- author names are not displayed if set to false
-                  render :partial => 'attachments/links', :locals => {:attachments => attachments, :options => options}
+              def link_to_attachments(container, options = {})
+                options.assert_valid_keys(:author)
+                if container.attachments.any?
+                  options = {:deletable => container.attachments_deletable?, :author => true}.merge(options)
+                  render :partial => 'attachments/links', :locals => {:attachments => container.attachments, :options => options}
                 end
               end
               def to_utf8(str)
                 str
               end
             end

app/models/attachment.rb +8 0

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require "digest/md5"
             class Attachment < ActiveRecord::Base
               belongs_to :container, :polymorphic => true
               belongs_to :author, :class_name => "User", :foreign_key => "author_id"
               validates_presence_of :container, :filename, :author
               validates_length_of :filename, :maximum => 255
               validates_length_of :disk_filename, :maximum => 255
               acts_as_event :title => :filename,
                             :url => Proc.new {|o| {:controller => 'attachments', :action => 'download', :id => o.id, :filename => o.filename}}
               acts_as_activity_provider :type => 'files',
                                         :permission => :view_files,
                                         :author_key => :author_id,
                                         :find_options => {:select => "#{Attachment.table_name}.*",
                                                           :joins => "LEFT JOIN #{Version.table_name} ON #{Attachment.table_name}.container_type='Version' AND #{Version.table_name}.id = #{Attachment.table_name}.container_id " +
                                                                     "LEFT JOIN #{Project.table_name} ON #{Version.table_name}.project_id = #{Project.table_name}.id"}
               acts_as_activity_provider :type => 'documents',
                                         :permission => :view_documents,
                                         :author_key => :author_id,
                                         :find_options => {:select => "#{Attachment.table_name}.*",
                                                           :joins => "LEFT JOIN #{Document.table_name} ON #{Attachment.table_name}.container_type='Document' AND #{Document.table_name}.id = #{Attachment.table_name}.container_id " +
                                                                     "LEFT JOIN #{Project.table_name} ON #{Document.table_name}.project_id = #{Project.table_name}.id"}
               cattr_accessor :storage_path
               @@storage_path = "#{RAILS_ROOT}/files"
               def validate
                 errors.add_to_base :too_long if self.filesize > Setting.attachment_max_size.to_i.kilobytes
               end
               def file=(incoming_file)
                 unless incoming_file.nil?
                   @temp_file = incoming_file
                   if @temp_file.size > 0
                     self.filename = sanitize_filename(@temp_file.original_filename)
                     self.disk_filename = Attachment.disk_filename(filename)
                     self.content_type = @temp_file.content_type.to_s.chomp
                     self.filesize = @temp_file.size
                   end
                 end
               end
               def file
                 nil
               end
               # Copy temp file to its final location
               def before_save
                 if @temp_file && (@temp_file.size > 0)
                   logger.debug("saving '#{self.diskfile}'")
                   File.open(diskfile, "wb") do |f|
                     f.write(@temp_file.read)
                   end
                   self.digest = self.class.digest(diskfile)
                 end
                 # Don't save the content type if it's longer than the authorized length
                 if self.content_type && self.content_type.length > 255
                   self.content_type = nil
                 end
               end
               # Deletes file on the disk
               def after_destroy
                 File.delete(diskfile) if !filename.blank? && File.exist?(diskfile)
               end
               # Returns file's location on disk
               def diskfile
                 "#{@@storage_path}/#{self.disk_filename}"
               end
               def increment_download
                 increment!(:downloads)
               end
               def project
                 container.project
               end
+              def visible?(user=User.current)
+                container.attachments_visible?(user)
+              end
+              def deletable?(user=User.current)
+                container.attachments_deletable?(user)
+              end
               def image?
                 self.filename =~ /\.(jpe?g|gif|png)$/i
               end
               def is_text?
                 Redmine::MimeType.is_type?('text', filename)
               end
               def is_diff?
                 self.filename =~ /\.(patch|diff)$/i
               end
             private
               def sanitize_filename(value)
                 # get only the filename, not the whole path
                 just_filename = value.gsub(/^.*(\\|\/)/, '')
                 # NOTE: File.basename doesn't work right with Windows paths on Unix
                 # INCORRECT: just_filename = File.basename(value.gsub('\\\\', '/'))
                 # Finally, replace all non alphanumeric, hyphens or periods with underscore
                 @filename = just_filename.gsub(/[^\w\.\-]/,'_')
               end
               # Returns an ASCII or hashed filename
               def self.disk_filename(filename)
                 df = DateTime.now.strftime("%y%m%d%H%M%S") + "_"
                 if filename =~ %r{^[a-zA-Z0-9_\.\-]*$}
                   df << filename
                 else
                   df << Digest::MD5.hexdigest(filename)
                   # keep the extension if any
                   df << $1 if filename =~ %r{(\.[a-zA-Z0-9]+)$}
                 end
                 df
               end
               # Returns the MD5 digest of the file at given path
               def self.digest(filename)
                 File.open(filename, 'rb') do |f|
                   Digest::MD5.hexdigest(f.read)
                 end
               end
             end

app/models/document.rb +1 -1

             # redMine - project management software
             # Copyright (C) 2006  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class Document < ActiveRecord::Base
               belongs_to :project
               belongs_to :category, :class_name => "Enumeration", :foreign_key => "category_id"
-              has_many :attachments, :as => :container, :dependent => :destroy
+              acts_as_attachable :delete_permission => :manage_documents
               acts_as_searchable :columns => ['title', "#{table_name}.description"], :include => :project
               acts_as_event :title => Proc.new {|o| "#{l(:label_document)}: #{o.title}"},
                             :author => Proc.new {|o| (a = o.attachments.find(:first, :order => "#{Attachment.table_name}.created_on ASC")) ? a.author : nil },
                             :url => Proc.new {|o| {:controller => 'documents', :action => 'show', :id => o.id}}
               acts_as_activity_provider :find_options => {:include => :project}
               validates_presence_of :project, :title, :category
               validates_length_of :title, :maximum => 60
             end

app/models/issue.rb +12 -1

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class Issue < ActiveRecord::Base
               belongs_to :project
               belongs_to :tracker
               belongs_to :status, :class_name => 'IssueStatus', :foreign_key => 'status_id'
               belongs_to :author, :class_name => 'User', :foreign_key => 'author_id'
               belongs_to :assigned_to, :class_name => 'User', :foreign_key => 'assigned_to_id'
               belongs_to :fixed_version, :class_name => 'Version', :foreign_key => 'fixed_version_id'
               belongs_to :priority, :class_name => 'Enumeration', :foreign_key => 'priority_id'
               belongs_to :category, :class_name => 'IssueCategory', :foreign_key => 'category_id'
               has_many :journals, :as => :journalized, :dependent => :destroy
-              has_many :attachments, :as => :container, :dependent => :destroy
               has_many :time_entries, :dependent => :delete_all
               has_and_belongs_to_many :changesets, :order => "#{Changeset.table_name}.committed_on ASC, #{Changeset.table_name}.id ASC"
               has_many :relations_from, :class_name => 'IssueRelation', :foreign_key => 'issue_from_id', :dependent => :delete_all
               has_many :relations_to, :class_name => 'IssueRelation', :foreign_key => 'issue_to_id', :dependent => :delete_all
+              acts_as_attachable :after_remove => :attachment_removed
               acts_as_customizable
               acts_as_watchable
               acts_as_searchable :columns => ['subject', "#{table_name}.description", "#{Journal.table_name}.notes"],
                                  :include => [:project, :journals],
                                  # sort by id so that limited eager loading doesn't break with postgresql
                                  :order_column => "#{table_name}.id"
               acts_as_event :title => Proc.new {|o| "#{o.tracker.name} ##{o.id}: #{o.subject}"},
                             :url => Proc.new {|o| {:controller => 'issues', :action => 'show', :id => o.id}}
               acts_as_activity_provider :find_options => {:include => [:project, :author, :tracker]},
                                         :author_key => :author_id
               validates_presence_of :subject, :description, :priority, :project, :tracker, :author, :status
               validates_length_of :subject, :maximum => 255
               validates_inclusion_of :done_ratio, :in => 0..100
               validates_numericality_of :estimated_hours, :allow_nil => true
               def after_initialize
                 if new_record?
                   # set default values for new records only
                   self.status ||= IssueStatus.default
                   self.priority ||= Enumeration.default('IPRI')
                 end
               end
               # Overrides Redmine::Acts::Customizable::InstanceMethods#available_custom_fields
               def available_custom_fields
                 (project && tracker) ? project.all_issue_custom_fields.select {|c| tracker.custom_fields.include? c } : []
               end
               def copy_from(arg)
                 issue = arg.is_a?(Issue) ? arg : Issue.find(arg)
                 self.attributes = issue.attributes.dup
                 self.custom_values = issue.custom_values.collect {|v| v.clone}
                 self
               end
               # Move an issue to a new project and tracker
               def move_to(new_project, new_tracker = nil)
                 transaction do
                   if new_project && project_id != new_project.id
                     # delete issue relations
                     unless Setting.cross_project_issue_relations?
                       self.relations_from.clear
                       self.relations_to.clear
                     end
                     # issue is moved to another project
                     # reassign to the category with same name if any
                     new_category = category.nil? ? nil : new_project.issue_categories.find_by_name(category.name)
                     self.category = new_category
                     self.fixed_version = nil
                     self.project = new_project
                   end
                   if new_tracker
                     self.tracker = new_tracker
                   end
                   if save
                     # Manually update project_id on related time entries
                     TimeEntry.update_all("project_id = #{new_project.id}", {:issue_id => id})
                   else
                     rollback_db_transaction
                     return false
                   end
                 end
                 return true
               end
               def priority_id=(pid)
                 self.priority = nil
                 write_attribute(:priority_id, pid)
               end
               def estimated_hours=(h)
                 write_attribute :estimated_hours, (h.is_a?(String) ? h.to_hours : h)
               end
               def validate
                 if self.due_date.nil? && @attributes['due_date'] && !@attributes['due_date'].empty?
                   errors.add :due_date, :activerecord_error_not_a_date
                 end
                 if self.due_date and self.start_date and self.due_date < self.start_date
                   errors.add :due_date, :activerecord_error_greater_than_start_date
                 end
                 if start_date && soonest_start && start_date < soonest_start
                   errors.add :start_date, :activerecord_error_invalid
                 end
               end
               def validate_on_create
                 errors.add :tracker_id, :activerecord_error_invalid unless project.trackers.include?(tracker)
               end
               def before_create
                 # default assignment based on category
                 if assigned_to.nil? && category && category.assigned_to
                   self.assigned_to = category.assigned_to
                 end
               end
               def before_save
                 if @current_journal
                   # attributes changes
                   (Issue.column_names - %w(id description)).each {|c|
                     @current_journal.details << JournalDetail.new(:property => 'attr',
                                                                   :prop_key => c,
                                                                   :old_value => @issue_before_change.send(c),
                                                                   :value => send(c)) unless send(c)==@issue_before_change.send(c)
                   }
                   # custom fields changes
                   custom_values.each {|c|
                     next if (@custom_values_before_change[c.custom_field_id]==c.value ||
                               (@custom_values_before_change[c.custom_field_id].blank? && c.value.blank?))
                     @current_journal.details << JournalDetail.new(:property => 'cf',
                                                                   :prop_key => c.custom_field_id,
                                                                   :old_value => @custom_values_before_change[c.custom_field_id],
                                                                   :value => c.value)
                   }
                   @current_journal.save
                 end
                 # Save the issue even if the journal is not saved (because empty)
                 true
               end
               def after_save
                 # Reload is needed in order to get the right status
                 reload
                 # Update start/due dates of following issues
                 relations_from.each(&:set_issue_to_dates)
                 # Close duplicates if the issue was closed
                 if @issue_before_change && !@issue_before_change.closed? && self.closed?
                   duplicates.each do |duplicate|
                     # Reload is need in case the duplicate was updated by a previous duplicate
                     duplicate.reload
                     # Don't re-close it if it's already closed
                     next if duplicate.closed?
                     # Same user and notes
                     duplicate.init_journal(@current_journal.user, @current_journal.notes)
                     duplicate.update_attribute :status, self.status
                   end
                 end
               end
               def init_journal(user, notes = "")
                 @current_journal ||= Journal.new(:journalized => self, :user => user, :notes => notes)
                 @issue_before_change = self.clone
                 @issue_before_change.status = self.status
                 @custom_values_before_change = {}
                 self.custom_values.each {|c| @custom_values_before_change.store c.custom_field_id, c.value }
                 # Make sure updated_on is updated when adding a note.
                 updated_on_will_change!
                 @current_journal
               end
               # Return true if the issue is closed, otherwise false
               def closed?
                 self.status.is_closed?
               end
               # Users the issue can be assigned to
               def assignable_users
                 project.assignable_users
               end
               # Returns an array of status that user is able to apply
               def new_statuses_allowed_to(user)
                 statuses = status.find_new_statuses_allowed_to(user.role_for_project(project), tracker)
                 statuses << status unless statuses.empty?
                 statuses.uniq.sort
               end
               # Returns the mail adresses of users that should be notified for the issue
               def recipients
                 recipients = project.recipients
                 # Author and assignee are always notified unless they have been locked
                 recipients << author.mail if author && author.active?
                 recipients << assigned_to.mail if assigned_to && assigned_to.active?
                 recipients.compact.uniq
               end
               def spent_hours
                 @spent_hours ||= time_entries.sum(:hours) || 0
               end
               def relations
                 (relations_from + relations_to).sort
               end
               def all_dependent_issues
                 dependencies = []
                 relations_from.each do |relation|
                   dependencies << relation.issue_to
                   dependencies += relation.issue_to.all_dependent_issues
                 end
                 dependencies
               end
               # Returns an array of issues that duplicate this one
               def duplicates
                 relations_to.select {|r| r.relation_type == IssueRelation::TYPE_DUPLICATES}.collect {|r| r.issue_from}
               end
               # Returns the due date or the target due date if any
               # Used on gantt chart
               def due_before
                 due_date || (fixed_version ? fixed_version.effective_date : nil)
               end
               def duration
                 (start_date && due_date) ? due_date - start_date : 0
               end
               def soonest_start
                 @soonest_start ||= relations_to.collect{|relation| relation.successor_soonest_start}.compact.min
               end
               def self.visible_by(usr)
                 with_scope(:find => { :conditions => Project.visible_by(usr) }) do
                   yield
                 end
               end
               def to_s
                 "#{tracker} ##{id}: #{subject}"
               end
+              private
+              # Callback on attachment deletion
+              def attachment_removed(obj)
+                journal = init_journal(User.current)
+                journal.details << JournalDetail.new(:property => 'attachment',
+                                                     :prop_key => obj.id,
+                                                     :old_value => obj.filename)
+                journal.save
+              end
             end

app/models/message.rb +1 -1

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class Message < ActiveRecord::Base
               belongs_to :board
               belongs_to :author, :class_name => 'User', :foreign_key => 'author_id'
               acts_as_tree :counter_cache => :replies_count, :order => "#{Message.table_name}.created_on ASC"
-              has_many :attachments, :as => :container, :dependent => :destroy
+              acts_as_attachable
               belongs_to :last_reply, :class_name => 'Message', :foreign_key => 'last_reply_id'
               acts_as_searchable :columns => ['subject', 'content'],
                                  :include => {:board, :project},
                                  :project_key => 'project_id',
                                  :date_column => "#{table_name}.created_on"
               acts_as_event :title => Proc.new {|o| "#{o.board.name}: #{o.subject}"},
                             :description => :content,
                             :type => Proc.new {|o| o.parent_id.nil? ? 'message' : 'reply'},
                             :url => Proc.new {|o| {:controller => 'messages', :action => 'show', :board_id => o.board_id}.merge(o.parent_id.nil? ? {:id => o.id} :
                                                                                                                                                    {:id => o.parent_id, :anchor => "message-#{o.id}"})}
               acts_as_activity_provider :find_options => {:include => [{:board => :project}, :author]},
                                         :author_key => :author_id
               acts_as_watchable
               attr_protected :locked, :sticky
               validates_presence_of :subject, :content
               validates_length_of :subject, :maximum => 255
               after_create :add_author_as_watcher
               def validate_on_create
                 # Can not reply to a locked topic
                 errors.add_to_base 'Topic is locked' if root.locked? && self != root
               end
               def after_create
                 board.update_attribute(:last_message_id, self.id)
                 board.increment! :messages_count
                 if parent
                   parent.reload.update_attribute(:last_reply_id, self.id)
                 else
                   board.increment! :topics_count
                 end
               end
               def after_destroy
                 # The following line is required so that the previous counter
                 # updates (due to children removal) are not overwritten
                 board.reload
                 board.decrement! :messages_count
                 board.decrement! :topics_count unless parent
               end
               def sticky?
                 sticky == 1
               end
               def project
                 board.project
               end
               def editable_by?(usr)
                 usr && usr.logged? && (usr.allowed_to?(:edit_messages, project) || (self.author == usr && usr.allowed_to?(:edit_own_messages, project)))
               end
               def destroyable_by?(usr)
                 usr && usr.logged? && (usr.allowed_to?(:delete_messages, project) || (self.author == usr && usr.allowed_to?(:delete_own_messages, project)))
               end
               private
               def add_author_as_watcher
                 Watcher.create(:watchable => self.root, :user => author)
               end
             end

app/models/version.rb +2 -1

             # redMine - project management software
             # Copyright (C) 2006  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class Version < ActiveRecord::Base
               before_destroy :check_integrity
               belongs_to :project
               has_many :fixed_issues, :class_name => 'Issue', :foreign_key => 'fixed_version_id'
-              has_many :attachments, :as => :container, :dependent => :destroy
+              acts_as_attachable :view_permission => :view_files,
+                                 :delete_permission => :manage_files
               validates_presence_of :name
               validates_uniqueness_of :name, :scope => [:project_id]
               validates_length_of :name, :maximum => 60
               validates_format_of :effective_date, :with => /^\d{4}-\d{2}-\d{2}$/, :message => 'activerecord_error_not_a_date', :allow_nil => true
               def start_date
                 effective_date
               end
               def due_date
                 effective_date
               end
               # Returns the total estimated time for this version
               def estimated_hours
                 @estimated_hours ||= fixed_issues.sum(:estimated_hours).to_f
               end
               # Returns the total reported time for this version
               def spent_hours
                 @spent_hours ||= TimeEntry.sum(:hours, :include => :issue, :conditions => ["#{Issue.table_name}.fixed_version_id = ?", id]).to_f
               end
               # Returns true if the version is completed: due date reached and no open issues
               def completed?
                 effective_date && (effective_date <= Date.today) && (open_issues_count == 0)
               end
               def completed_pourcent
                 if fixed_issues.count == 0
                 elsif open_issues_count == 0
                 else
                   (closed_issues_count * 100 + Issue.sum('done_ratio', :include => 'status', :conditions => ["fixed_version_id = ? AND is_closed = ?", id, false]).to_f) / fixed_issues.count
                 end
               end
               def closed_pourcent
                 if fixed_issues.count == 0
                 else
                   closed_issues_count * 100.0 / fixed_issues.count
                 end
               end
               # Returns true if the version is overdue: due date reached and some open issues
               def overdue?
                 effective_date && (effective_date < Date.today) && (open_issues_count > 0)
               end
               def open_issues_count
                 @open_issues_count ||= Issue.count(:all, :conditions => ["fixed_version_id = ? AND is_closed = ?", self.id, false], :include => :status)
               end
               def closed_issues_count
                 @closed_issues_count ||= Issue.count(:all, :conditions => ["fixed_version_id = ? AND is_closed = ?", self.id, true], :include => :status)
               end
               def wiki_page
                 if project.wiki && !wiki_page_title.blank?
                   @wiki_page ||= project.wiki.find_page(wiki_page_title)
                 end
                 @wiki_page
               end
               def to_s; name end
               # Versions are sorted by effective_date and name
               # Those with no effective_date are at the end, sorted by name
               def <=>(version)
                 if self.effective_date
                   version.effective_date ? (self.effective_date == version.effective_date ? self.name <=> version.name : self.effective_date <=> version.effective_date) : -1
                 else
                   version.effective_date ? 1 : (self.name <=> version.name)
                 end
               end
             private
               def check_integrity
                 raise "Can't delete version" if self.fixed_issues.find(:first)
               end
             end

app/models/wiki_page.rb +5 -1

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require 'diff'
             require 'enumerator'
             class WikiPage < ActiveRecord::Base
               belongs_to :wiki
               has_one :content, :class_name => 'WikiContent', :foreign_key => 'page_id', :dependent => :destroy
-              has_many :attachments, :as => :container, :dependent => :destroy
+              acts_as_attachable :delete_permission => :delete_wiki_pages_attachments
               acts_as_tree :order => 'title'
               acts_as_event :title => Proc.new {|o| "#{l(:label_wiki)}: #{o.title}"},
                             :description => :text,
                             :datetime => :created_on,
                             :url => Proc.new {|o| {:controller => 'wiki', :id => o.wiki.project_id, :page => o.title}}
               acts_as_searchable :columns => ['title', 'text'],
                                  :include => [{:wiki => :project}, :content],
                                  :project_key => "#{Wiki.table_name}.project_id"
               attr_accessor :redirect_existing_links
               validates_presence_of :title
               validates_format_of :title, :with => /^[^,\.\/\?\;\|\s]*$/
               validates_uniqueness_of :title, :scope => :wiki_id, :case_sensitive => false
               validates_associated :content
               def title=(value)
                 value = Wiki.titleize(value)
                 @previous_title = read_attribute(:title) if @previous_title.blank?
                 write_attribute(:title, value)
               end
               def before_save
                 self.title = Wiki.titleize(title)
                 # Manage redirects if the title has changed
                 if !@previous_title.blank? && (@previous_title != title) && !new_record?
                   # Update redirects that point to the old title
                   wiki.redirects.find_all_by_redirects_to(@previous_title).each do |r|
                     r.redirects_to = title
                     r.title == r.redirects_to ? r.destroy : r.save
                   end
                   # Remove redirects for the new title
                   wiki.redirects.find_all_by_title(title).each(&:destroy)
                   # Create a redirect to the new title
                   wiki.redirects << WikiRedirect.new(:title => @previous_title, :redirects_to => title) unless redirect_existing_links == "0"
                   @previous_title = nil
                 end
               end
               def before_destroy
                 # Remove redirects to this page
                 wiki.redirects.find_all_by_redirects_to(title).each(&:destroy)
               end
               def pretty_title
                 WikiPage.pretty_title(title)
               end
               def content_for_version(version=nil)
                 result = content.versions.find_by_version(version.to_i) if version
                 result ||= content
                 result
               end
               def diff(version_to=nil, version_from=nil)
                 version_to = version_to ? version_to.to_i : self.content.version
                 version_from = version_from ? version_from.to_i : version_to - 1
                 version_to, version_from = version_from, version_to unless version_from < version_to
                 content_to = content.versions.find_by_version(version_to)
                 content_from = content.versions.find_by_version(version_from)
                 (content_to && content_from) ? WikiDiff.new(content_to, content_from) : nil
               end
               def annotate(version=nil)
                 version = version ? version.to_i : self.content.version
                 c = content.versions.find_by_version(version)
                 c ? WikiAnnotate.new(c) : nil
               end
               def self.pretty_title(str)
                 (str && str.is_a?(String)) ? str.tr('_', ' ') : str
               end
               def project
                 wiki.project
               end
               def text
                 content.text if content
               end
               # Returns true if usr is allowed to edit the page, otherwise false
               def editable_by?(usr)
                 !protected? || usr.allowed_to?(:protect_wiki_pages, wiki.project)
               end
+              def attachments_deletable?(usr=User.current)
+                editable_by?(usr) && super(usr)
+              end
               def parent_title
                 @parent_title || (self.parent && self.parent.pretty_title)
               end
               def parent_title=(t)
                 @parent_title = t
                 parent_page = t.blank? ? nil : self.wiki.find_page(t)
                 self.parent = parent_page
               end
               protected
               def validate
                 errors.add(:parent_title, :activerecord_error_invalid) if !@parent_title.blank? && parent.nil?
                 errors.add(:parent_title, :activerecord_error_circular_dependency) if parent && (parent == self || parent.ancestors.include?(self))
                 errors.add(:parent_title, :activerecord_error_not_same_project) if parent && (parent.wiki_id != wiki_id)
               end
             end
             class WikiDiff
               attr_reader :diff, :words, :content_to, :content_from
               def initialize(content_to, content_from)
                 @content_to = content_to
                 @content_from = content_from
                 @words = content_to.text.split(/(\s+)/)
                 @words = @words.select {|word| word != ' '}
                 words_from = content_from.text.split(/(\s+)/)
                 words_from = words_from.select {|word| word != ' '}
                 @diff = words_from.diff @words
               end
             end
             class WikiAnnotate
               attr_reader :lines, :content
               def initialize(content)
                 @content = content
                 current = content
                 current_lines = current.text.split(/\r?\n/)
                 @lines = current_lines.collect {|t| [nil, nil, t]}
                 positions = []
                 current_lines.size.times {|i| positions << i}
                 while (current.previous)
                   d = current.previous.text.split(/\r?\n/).diff(current.text.split(/\r?\n/)).diffs.flatten
                   d.each_slice(3) do |s|
                     sign, line = s[0], s[1]
                     if sign == '+' && positions[line] && positions[line] != -1
                       if @lines[positions[line]][0].nil?
                         @lines[positions[line]][0] = current.version
                         @lines[positions[line]][1] = current.author
                       end
                     end
                   end
                   d.each_slice(3) do |s|
                     sign, line = s[0], s[1]
                     if sign == '-'
                       positions.insert(line, -1)
                     else
                       positions[line] = nil
                     end
                   end
                   positions.compact!
                   # Stop if every line is annotated
                   break unless @lines.detect { |line| line[0].nil? }
                   current = current.previous
                 end
                 @lines.each { |line| line[0] ||= current.version }
               end
             end

app/views/attachments/_links.rhtml +3 -3

             <div class="attachments">
             <% for attachment in attachments %>
             <p><%= link_to_attachment attachment, :class => 'icon icon-attachment' -%>
             <%= h(" - #{attachment.description}") unless attachment.description.blank? %>
               <span class="size">(<%= number_to_human_size attachment.filesize %>)</span>
-              <% if options[:delete_url] %>
+              <% if options[:deletable] %>
-                <%= link_to image_tag('delete.png'), options[:delete_url].update({:attachment_id => attachment}),
+                <%= link_to image_tag('delete.png'), {:controller => 'attachments', :action => 'destroy', :id => attachment},
                                                      :confirm => l(:text_are_you_sure),
                                                      :method => :post,
                                                      :class => 'delete',
                                                      :title => l(:button_delete) %>
               <% end %>
-              <% unless options[:no_author] %>
+              <% if options[:author] %>
                 <span class="author"><%= attachment.author %>, <%= format_time(attachment.created_on) %></span>
               <% end %>
               </p>
             <% end %>
             </div>

app/views/documents/show.rhtml +1 -1

             <div class="contextual">
             <%= link_to_if_authorized l(:button_edit), {:controller => 'documents', :action => 'edit', :id => @document}, :class => 'icon icon-edit', :accesskey => accesskey(:edit) %>
             <%= link_to_if_authorized l(:button_delete), {:controller => 'documents', :action => 'destroy', :id => @document}, :confirm => l(:text_are_you_sure), :method => :post, :class => 'icon icon-del' %>
             </div>
             <h2><%=h @document.title %></h2>
             <p><em><%=h @document.category.name %><br />
             <%= format_date @document.created_on %></em></p>
             <div class="wiki">
             <%= textilizable @document.description, :attachments => @document.attachments %>
             </div>
             <h3><%= l(:label_attachment_plural) %></h3>
-            <%= link_to_attachments @attachments, :delete_url => (authorize_for('documents', 'destroy_attachment') ? {:controller => 'documents', :action => 'destroy_attachment', :id => @document} : nil) %>
+            <%= link_to_attachments @document %>
             <% if authorize_for('documents', 'add_attachment') %>
             <p><%= link_to l(:label_attachment_new), {}, :onclick => "Element.show('add_attachment_form'); Element.hide(this); Element.scrollTo('add_attachment_form'); return false;",
                                                          :id => 'attach_files_link' %></p>
               <% form_tag({ :controller => 'documents', :action => 'add_attachment', :id => @document }, :multipart => true, :id => "add_attachment_form", :style => "display:none;") do %>
               <div class="box">
               <p><%= render :partial => 'attachments/form' %></p>
               </div>
               <%= submit_tag l(:button_add) %>
               <% end %>
             <% end %>
             <% html_title @document.title -%>

app/views/issues/show.rhtml +1 -3

             <div class="contextual">
             <%= link_to_if_authorized(l(:button_update), {:controller => 'issues', :action => 'edit', :id => @issue }, :onclick => 'showAndScrollTo("update", "notes"); return false;', :class => 'icon icon-edit', :accesskey => accesskey(:edit)) %>
             <%= link_to_if_authorized l(:button_log_time), {:controller => 'timelog', :action => 'edit', :issue_id => @issue}, :class => 'icon icon-time' %>
             <%= watcher_tag(@issue, User.current) %>
             <%= link_to_if_authorized l(:button_copy), {:controller => 'issues', :action => 'new', :project_id => @project, :copy_from => @issue }, :class => 'icon icon-copy' %>
             <%= link_to_if_authorized l(:button_move), {:controller => 'issues', :action => 'move', :id => @issue }, :class => 'icon icon-move' %>
             <%= link_to_if_authorized l(:button_delete), {:controller => 'issues', :action => 'destroy', :id => @issue}, :confirm => l(:text_are_you_sure), :method => :post, :class => 'icon icon-del' %>
             </div>
             <h2><%= @issue.tracker.name %> #<%= @issue.id %></h2>
             <div class="issue <%= "status-#{@issue.status.position} priority-#{@issue.priority.position}" %>">
                     <%= avatar(@issue.author, :size => "64") %>
                     <h3><%=h @issue.subject %></h3>
                     <p class="author">
                     <%= authoring @issue.created_on, @issue.author %>.
                     <%= l(:label_updated_time, distance_of_time_in_words(Time.now, @issue.updated_on)) + '.' if @issue.created_on != @issue.updated_on %>
                     </p>
             <table width="100%">
             <tr>
                 <td style="width:15%" class="status"><b><%=l(:field_status)%>:</b></td><td style="width:35%" class="status status-<%= @issue.status.name %>"><%= @issue.status.name %></td>
                 <td style="width:15%" class="start-date"><b><%=l(:field_start_date)%>:</b></td><td style="width:35%"><%= format_date(@issue.start_date) %></td>
             </tr>
             <tr>
                 <td class="priority"><b><%=l(:field_priority)%>:</b></td><td class="priority priority-<%= @issue.priority.name %>"><%= @issue.priority.name %></td>
                 <td class="due-date"><b><%=l(:field_due_date)%>:</b></td><td class="due-date"><%= format_date(@issue.due_date) %></td>
             </tr>
             <tr>
                 <td class="assigned-to"><b><%=l(:field_assigned_to)%>:</b></td><td><%= avatar(@issue.assigned_to, :size => "14") %><%= @issue.assigned_to ? link_to_user(@issue.assigned_to) : "-" %></td>
                 <td class="progress"><b><%=l(:field_done_ratio)%>:</b></td><td class="progress"><%= progress_bar @issue.done_ratio, :width => '80px', :legend => "#{@issue.done_ratio}%" %></td>
             </tr>
             <tr>
                 <td class="category"><b><%=l(:field_category)%>:</b></td><td><%=h @issue.category ? @issue.category.name : "-" %></td>
                 <% if User.current.allowed_to?(:view_time_entries, @project) %>
                 <td class="spent-time"><b><%=l(:label_spent_time)%>:</b></td>
                 <td class="spent-hours"><%= @issue.spent_hours > 0 ? (link_to lwr(:label_f_hour, @issue.spent_hours), {:controller => 'timelog', :action => 'details', :project_id => @project, :issue_id => @issue}, :class => 'icon icon-time') : "-" %></td>
                 <% end %>
             </tr>
             <tr>
                 <td class="fixed-version"><b><%=l(:field_fixed_version)%>:</b></td><td><%= @issue.fixed_version ? link_to_version(@issue.fixed_version) : "-" %></td>
                 <% if @issue.estimated_hours %>
                 <td class="estimated-hours"><b><%=l(:field_estimated_hours)%>:</b></td><td><%= lwr(:label_f_hour, @issue.estimated_hours) %></td>
                 <% end %>
             </tr>
             <tr>
             <% n = 0 -%>
             <% @issue.custom_values.each do |value| -%>
                 <td valign="top"><b><%=h value.custom_field.name %>:</b></td><td valign="top"><%= simple_format(h(show_value(value))) %></td>
             <% n = n + 1
                if (n > 1)
                     n = 0 %>
                     </tr><tr>
              <%end
             end %>
             </tr>
             <%= call_hook(:view_issues_show_details_bottom, :issue => @issue) %>
             </table>
             <hr />
             <div class="contextual">
             <%= link_to_remote_if_authorized l(:button_quote), { :url => {:action => 'reply', :id => @issue} }, :class => 'icon icon-comment' %>
             </div>
             <p><strong><%=l(:field_description)%></strong></p>
             <div class="wiki">
             <%= textilizable @issue, :description, :attachments => @issue.attachments %>
             </div>
-            <% if @issue.attachments.any? %>
+            <%= link_to_attachments @issue %>
-            <%= link_to_attachments @issue.attachments, :delete_url => (authorize_for('issues', 'destroy_attachment') ? {:controller => 'issues', :action => 'destroy_attachment', :id => @issue} : nil) %>
-            <% end %>
             <% if authorize_for('issue_relations', 'new') || @issue.relations.any? %>
             <hr />
             <div id="relations">
             <%= render :partial => 'relations' %>
             </div>
             <% end %>
             <% if User.current.allowed_to?(:add_issue_watchers, @project) ||
                     (@issue.watchers.any? && User.current.allowed_to?(:view_issue_watchers, @project)) %>
             <hr />
             <div id="watchers">
             <%= render :partial => 'watchers/watchers', :locals => {:watched => @issue} %>
             </div>
             <% end %>
             </div>
             <% if @issue.changesets.any? && User.current.allowed_to?(:view_changesets, @project) %>
             <div id="issue-changesets">
             <h3><%=l(:label_associated_revisions)%></h3>
             <%= render :partial => 'changesets', :locals => { :changesets => @issue.changesets} %>
             </div>
             <% end %>
             <% if @journals.any? %>
             <div id="history">
             <h3><%=l(:label_history)%></h3>
             <%= render :partial => 'history', :locals => { :journals => @journals } %>
             </div>
             <% end %>
             <div style="clear: both;"></div>
             <% if authorize_for('issues', 'edit') %>
               <div id="update" style="display:none;">
               <h3><%= l(:button_update) %></h3>
               <%= render :partial => 'edit' %>
               </div>
             <% end %>
             <p class="other-formats">
             <%= l(:label_export_to) %>
             <span><%= link_to 'Atom', {:format => 'atom', :key => User.current.rss_key}, :class => 'feed' %></span>
             <span><%= link_to 'PDF', {:format => 'pdf'}, :class => 'pdf' %></span>
             </p>
             <% html_title "#{@issue.tracker.name} ##{@issue.id}: #{@issue.subject}" %>
             <% content_for :sidebar do %>
                 <%= render :partial => 'issues/sidebar' %>
             <% end %>
             <% content_for :header_tags do %>
                 <%= auto_discovery_link_tag(:atom, {:format => 'atom', :key => User.current.rss_key}, :title => "#{@issue.project} - #{@issue.tracker} ##{@issue.id}: #{@issue.subject}") %>
                 <%= stylesheet_link_tag 'scm' %>
             <% end %>

app/views/messages/show.rhtml +2 -2

             <%= breadcrumb link_to(l(:label_board_plural), {:controller => 'boards', :action => 'index', :project_id => @project}),
                            link_to(h(@board.name), {:controller => 'boards', :action => 'show', :project_id => @project, :id => @board}) %>
             <div class="contextual">
                 <%= watcher_tag(@topic, User.current) %>
                 <%= link_to_remote_if_authorized l(:button_quote), { :url => {:action => 'quote', :id => @topic} }, :class => 'icon icon-comment' %>
                 <%= link_to(l(:button_edit), {:action => 'edit', :id => @topic}, :class => 'icon icon-edit') if @message.editable_by?(User.current) %>
                 <%= link_to(l(:button_delete), {:action => 'destroy', :id => @topic}, :method => :post, :confirm => l(:text_are_you_sure), :class => 'icon icon-del') if @message.destroyable_by?(User.current) %>
             </div>
             <h2><%=h @topic.subject %></h2>
             <div class="message">
             <p><span class="author"><%= authoring @topic.created_on, @topic.author %></span></p>
             <div class="wiki">
             <%= textilizable(@topic.content, :attachments => @topic.attachments) %>
             </div>
-            <%= link_to_attachments @topic.attachments, :no_author => true %>
+            <%= link_to_attachments @topic, :author => false %>
             </div>
             <br />
             <% unless @replies.empty? %>
             <h3 class="icon22 icon22-comment"><%= l(:label_reply_plural) %></h3>
             <% @replies.each do |message| %>
               <a name="<%= "message-#{message.id}" %>"></a>
               <div class="contextual">
                 <%= link_to_remote_if_authorized image_tag('comment.png'), { :url => {:action => 'quote', :id => message} }, :title => l(:button_quote) %>
                 <%= link_to(image_tag('edit.png'), {:action => 'edit', :id => message}, :title => l(:button_edit)) if message.editable_by?(User.current) %>
                 <%= link_to(image_tag('delete.png'), {:action => 'destroy', :id => message}, :method => :post, :confirm => l(:text_are_you_sure), :title => l(:button_delete)) if message.destroyable_by?(User.current) %>
               </div>
               <div class="message reply">
               <h4><%=h message.subject %> - <%= authoring message.created_on, message.author %></h4>
               <div class="wiki"><%= textilizable message, :content, :attachments => message.attachments %></div>
-              <%= link_to_attachments message.attachments, :no_author => true %>
+              <%= link_to_attachments message, :author => false %>
               </div>
             <% end %>
             <% end %>
             <% if !@topic.locked? && authorize_for('messages', 'reply') %>
             <p><%= toggle_link l(:button_reply), "reply", :focus => 'message_content' %></p>
             <div id="reply" style="display:none;">
             <% form_for :reply, @reply, :url => {:action => 'reply', :id => @topic}, :html => {:multipart => true, :id => 'message-form'} do |f| %>
               <%= render :partial => 'form', :locals => {:f => f, :replying => true} %>
               <%= submit_tag l(:button_submit) %>
               <%= link_to_remote l(:label_preview),
                                  { :url => { :controller => 'messages', :action => 'preview', :board_id => @board },
                                    :method => 'post',
                                    :update => 'preview',
                                    :with => "Form.serialize('message-form')",
                                    :complete => "Element.scrollTo('preview')"
                                  }, :accesskey => accesskey(:preview) %>
             <% end %>
             <div id="preview" class="wiki"></div>
             </div>
             <% end %>
             <% content_for :header_tags do %>
               <%= stylesheet_link_tag 'scm' %>
             <% end %>
             <% html_title h(@topic.subject) %>

app/views/projects/list_files.rhtml +3 -2

             <div class="contextual">
             <%= link_to_if_authorized l(:label_attachment_new), {:controller => 'projects', :action => 'add_file', :id => @project}, :class => 'icon icon-add' %>
             </div>
             <h2><%=l(:label_attachment_plural)%></h2>
-            <% delete_allowed = authorize_for('versions', 'destroy_file') %>
+            <% delete_allowed = User.current.allowed_to?(:manage_files, @project) %>
             <table class="list">
               <thead><tr>
                 <th><%=l(:field_version)%></th>
                 <%= sort_header_tag("#{Attachment.table_name}.filename", :caption => l(:field_filename)) %>
                 <%= sort_header_tag("#{Attachment.table_name}.created_on", :caption => l(:label_date), :default_order => 'desc') %>
                 <%= sort_header_tag("#{Attachment.table_name}.filesize", :caption => l(:field_filesize), :default_order => 'desc') %>
                 <%= sort_header_tag("#{Attachment.table_name}.downloads", :caption => l(:label_downloads_abbr), :default_order => 'desc') %>
                 <th>MD5</th>
                 <% if delete_allowed %><th></th><% end %>
               </tr></thead>
               <tbody>
             <% for version in @versions %>
               <% unless version.attachments.empty? %>
               <tr><th colspan="7" align="left"><span class="icon icon-package"><b><%= version.name %></b></span></th></tr>
               <% for file in version.attachments %>
               <tr class="<%= cycle("odd", "even") %>">
                 <td></td>
                 <td><%= link_to_attachment file, :download => true, :title => file.description %></td>
                 <td align="center"><%= format_time(file.created_on) %></td>
                 <td align="center"><%= number_to_human_size(file.filesize) %></td>
                 <td align="center"><%= file.downloads %></td>
                 <td align="center"><small><%= file.digest %></small></td>
                 <% if delete_allowed %>
                 <td align="center">
-                    <%= link_to_if_authorized image_tag('delete.png'), {:controller => 'versions', :action => 'destroy_file', :id => version, :attachment_id => file}, :confirm => l(:text_are_you_sure), :method => :post %>
+                    <%= link_to image_tag('delete.png'), {:controller => 'attachments', :action => 'destroy', :id => file},
+            																						 :confirm => l(:text_are_you_sure), :method => :post %>
                 </td>
                 <% end %>
               </tr>
               <% end
               reset_cycle %>
               <% end %>
             <% end %>
               </tbody>
             </table>
             <% html_title(l(:label_attachment_plural)) -%>

app/views/wiki/show.rhtml +1 -1

             <div class="contextual">
             <% if @editable %>
             <%= link_to_if_authorized(l(:button_edit), {:action => 'edit', :page => @page.title}, :class => 'icon icon-edit', :accesskey => accesskey(:edit)) if @content.version == @page.content.version %>
             <%= link_to_if_authorized(l(:button_lock), {:action => 'protect', :page => @page.title, :protected => 1}, :method => :post, :class => 'icon icon-lock') if !@page.protected? %>
             <%= link_to_if_authorized(l(:button_unlock), {:action => 'protect', :page => @page.title, :protected => 0}, :method => :post, :class => 'icon icon-unlock') if @page.protected? %>
             <%= link_to_if_authorized(l(:button_rename), {:action => 'rename', :page => @page.title}, :class => 'icon icon-move') if @content.version == @page.content.version %>
             <%= link_to_if_authorized(l(:button_delete), {:action => 'destroy', :page => @page.title}, :method => :post, :confirm => l(:text_are_you_sure), :class => 'icon icon-del') %>
             <%= link_to_if_authorized(l(:button_rollback), {:action => 'edit', :page => @page.title, :version => @content.version }, :class => 'icon icon-cancel') if @content.version < @page.content.version %>
             <% end %>
             <%= link_to_if_authorized(l(:label_history), {:action => 'history', :page => @page.title}, :class => 'icon icon-history') %>
             </div>
             <%= breadcrumb(@page.ancestors.reverse.collect {|parent| link_to h(parent.pretty_title), {:page => parent.title}}) %>
             <% if @content.version != @page.content.version %>
                 <p>
                 <%= link_to(('&#171; ' + l(:label_previous)), :action => 'index', :page => @page.title, :version => (@content.version - 1)) + " - " if @content.version > 1 %>
                 <%= "#{l(:label_version)} #{@content.version}/#{@page.content.version}" %>
                 <%= '(' + link_to('diff', :controller => 'wiki', :action => 'diff', :page => @page.title, :version => @content.version) + ')' if @content.version > 1 %> -
                 <%= link_to((l(:label_next) + ' &#187;'), :action => 'index', :page => @page.title, :version => (@content.version + 1)) + " - " if @content.version < @page.content.version %>
                 <%= link_to(l(:label_current_version), :action => 'index', :page => @page.title) %>
                 <br />
                 <em><%= @content.author ? @content.author.name : "anonyme" %>, <%= format_time(@content.updated_on) %> </em><br />
                 <%=h @content.comments %>
                 </p>
                 <hr />
             <% end %>
             <%= render(:partial => "wiki/content", :locals => {:content => @content}) %>
-            <%= link_to_attachments @page.attachments, :delete_url => ((@editable && authorize_for('wiki', 'destroy_attachment')) ? {:controller => 'wiki', :action => 'destroy_attachment', :page => @page.title} : nil) %>
+            <%= link_to_attachments @page %>
             <% if @editable && authorize_for('wiki', 'add_attachment') %>
             <p><%= link_to l(:label_attachment_new), {}, :onclick => "Element.show('add_attachment_form'); Element.hide(this); Element.scrollTo('add_attachment_form'); return false;",
                                                          :id => 'attach_files_link' %></p>
             <% form_tag({ :controller => 'wiki', :action => 'add_attachment', :page => @page.title }, :multipart => true, :id => "add_attachment_form", :style => "display:none;") do %>
               <div class="box">
               <p><%= render :partial => 'attachments/form' %></p>
               </div>
             <%= submit_tag l(:button_add) %>
             <%= link_to l(:button_cancel), {}, :onclick => "Element.hide('add_attachment_form'); Element.show('attach_files_link'); return false;" %>
             <% end %>
             <% end %>
             <p class="other-formats">
             <%= l(:label_export_to) %>
             <span><%= link_to 'HTML', {:page => @page.title, :export => 'html', :version => @content.version}, :class => 'html' %></span>
             <span><%= link_to 'TXT', {:page => @page.title, :export => 'txt', :version => @content.version}, :class => 'text' %></span>
             </p>
             <% content_for :header_tags do %>
               <%= stylesheet_link_tag 'scm' %>
             <% end %>
             <% content_for :sidebar do %>
               <%= render :partial => 'sidebar' %>
             <% end %>
             <% html_title @page.pretty_title %>

lib/redmine.rb +4 -4

             require 'redmine/access_control'
             require 'redmine/menu_manager'
             require 'redmine/activity'
             require 'redmine/mime_type'
             require 'redmine/core_ext'
             require 'redmine/themes'
             require 'redmine/hook'
             require 'redmine/plugin'
             require 'redmine/wiki_formatting'
             begin
               require_library_or_gem 'RMagick' unless Object.const_defined?(:Magick)
             rescue LoadError
               # RMagick is not available
             end
             REDMINE_SUPPORTED_SCM = %w( Subversion Darcs Mercurial Cvs Bazaar Git Filesystem )
             # Permissions
             Redmine::AccessControl.map do |map|
               map.permission :view_project, {:projects => [:show, :activity]}, :public => true
               map.permission :search_project, {:search => :index}, :public => true
               map.permission :edit_project, {:projects => [:settings, :edit]}, :require => :member
               map.permission :select_project_modules, {:projects => :modules}, :require => :member
               map.permission :manage_members, {:projects => :settings, :members => [:new, :edit, :destroy]}, :require => :member
               map.permission :manage_versions, {:projects => [:settings, :add_version], :versions => [:edit, :destroy]}, :require => :member
               map.project_module :issue_tracking do |map|
                 # Issue categories
                 map.permission :manage_categories, {:projects => [:settings, :add_issue_category], :issue_categories => [:edit, :destroy]}, :require => :member
                 # Issues
                 map.permission :view_issues, {:projects => [:changelog, :roadmap],
                                               :issues => [:index, :changes, :show, :context_menu],
                                               :versions => [:show, :status_by],
                                               :queries => :index,
                                               :reports => :issue_report}, :public => true
                 map.permission :add_issues, {:issues => :new}
-                map.permission :edit_issues, {:issues => [:edit, :reply, :bulk_edit, :destroy_attachment]}
+                map.permission :edit_issues, {:issues => [:edit, :reply, :bulk_edit]}
                 map.permission :manage_issue_relations, {:issue_relations => [:new, :destroy]}
                 map.permission :add_issue_notes, {:issues => [:edit, :reply]}
                 map.permission :edit_issue_notes, {:journals => :edit}, :require => :loggedin
                 map.permission :edit_own_issue_notes, {:journals => :edit}, :require => :loggedin
                 map.permission :move_issues, {:issues => :move}, :require => :loggedin
                 map.permission :delete_issues, {:issues => :destroy}, :require => :member
                 # Queries
                 map.permission :manage_public_queries, {:queries => [:new, :edit, :destroy]}, :require => :member
                 map.permission :save_queries, {:queries => [:new, :edit, :destroy]}, :require => :loggedin
                 # Gantt & calendar
                 map.permission :view_gantt, :issues => :gantt
                 map.permission :view_calendar, :issues => :calendar
                 # Watchers
                 map.permission :view_issue_watchers, {}
                 map.permission :add_issue_watchers, {:watchers => :new}
               end
               map.project_module :time_tracking do |map|
                 map.permission :log_time, {:timelog => :edit}, :require => :loggedin
                 map.permission :view_time_entries, :timelog => [:details, :report]
                 map.permission :edit_time_entries, {:timelog => [:edit, :destroy]}, :require => :member
                 map.permission :edit_own_time_entries, {:timelog => [:edit, :destroy]}, :require => :loggedin
               end
               map.project_module :news do |map|
                 map.permission :manage_news, {:news => [:new, :edit, :destroy, :destroy_comment]}, :require => :member
                 map.permission :view_news, {:news => [:index, :show]}, :public => true
                 map.permission :comment_news, {:news => :add_comment}
               end
               map.project_module :documents do |map|
-                map.permission :manage_documents, {:documents => [:new, :edit, :destroy, :add_attachment, :destroy_attachment]}, :require => :loggedin
+                map.permission :manage_documents, {:documents => [:new, :edit, :destroy, :add_attachment]}, :require => :loggedin
                 map.permission :view_documents, :documents => [:index, :show, :download]
               end
               map.project_module :files do |map|
-                map.permission :manage_files, {:projects => :add_file, :versions => :destroy_file}, :require => :loggedin
+                map.permission :manage_files, {:projects => :add_file}, :require => :loggedin
                 map.permission :view_files, :projects => :list_files, :versions => :download
               end
               map.project_module :wiki do |map|
                 map.permission :manage_wiki, {:wikis => [:edit, :destroy]}, :require => :member
                 map.permission :rename_wiki_pages, {:wiki => :rename}, :require => :member
                 map.permission :delete_wiki_pages, {:wiki => :destroy}, :require => :member
                 map.permission :view_wiki_pages, :wiki => [:index, :special]
                 map.permission :view_wiki_edits, :wiki => [:history, :diff, :annotate]
                 map.permission :edit_wiki_pages, :wiki => [:edit, :preview, :add_attachment]
-                map.permission :delete_wiki_pages_attachments, :wiki => :destroy_attachment
+                map.permission :delete_wiki_pages_attachments, {}
                 map.permission :protect_wiki_pages, {:wiki => :protect}, :require => :member
               end
               map.project_module :repository do |map|
                 map.permission :manage_repository, {:repositories => [:edit, :committers, :destroy]}, :require => :member
                 map.permission :browse_repository, :repositories => [:show, :browse, :entry, :annotate, :changes, :diff, :stats, :graph]
                 map.permission :view_changesets, :repositories => [:show, :revisions, :revision]
                 map.permission :commit_access, {}
               end
               map.project_module :boards do |map|
                 map.permission :manage_boards, {:boards => [:new, :edit, :destroy]}, :require => :member
                 map.permission :view_messages, {:boards => [:index, :show], :messages => [:show]}, :public => true
                 map.permission :add_messages, {:messages => [:new, :reply, :quote]}
                 map.permission :edit_messages, {:messages => :edit}, :require => :member
                 map.permission :edit_own_messages, {:messages => :edit}, :require => :loggedin
                 map.permission :delete_messages, {:messages => :destroy}, :require => :member
                 map.permission :delete_own_messages, {:messages => :destroy}, :require => :loggedin
               end
             end
             Redmine::MenuManager.map :top_menu do |menu|
               menu.push :home, :home_path
               menu.push :my_page, { :controller => 'my', :action => 'page' }, :if => Proc.new { User.current.logged? }
               menu.push :projects, { :controller => 'projects', :action => 'index' }, :caption => :label_project_plural
               menu.push :administration, { :controller => 'admin', :action => 'index' }, :if => Proc.new { User.current.admin? }, :last => true
               menu.push :help, Redmine::Info.help_url, :last => true
             end
             Redmine::MenuManager.map :account_menu do |menu|
               menu.push :login, :signin_path, :if => Proc.new { !User.current.logged? }
               menu.push :register, { :controller => 'account', :action => 'register' }, :if => Proc.new { !User.current.logged? && Setting.self_registration? }
               menu.push :my_account, { :controller => 'my', :action => 'account' }, :if => Proc.new { User.current.logged? }
               menu.push :logout, :signout_path, :if => Proc.new { User.current.logged? }
             end
             Redmine::MenuManager.map :application_menu do |menu|
               # Empty
             end
             Redmine::MenuManager.map :admin_menu do |menu|
               # Empty
             end
             Redmine::MenuManager.map :project_menu do |menu|
               menu.push :overview, { :controller => 'projects', :action => 'show' }
               menu.push :activity, { :controller => 'projects', :action => 'activity' }
               menu.push :roadmap, { :controller => 'projects', :action => 'roadmap' },
                           :if => Proc.new { |p| p.versions.any? }
               menu.push :issues, { :controller => 'issues', :action => 'index' }, :param => :project_id, :caption => :label_issue_plural
               menu.push :new_issue, { :controller => 'issues', :action => 'new' }, :param => :project_id, :caption => :label_issue_new,
                           :html => { :accesskey => Redmine::AccessKeys.key_for(:new_issue) }
               menu.push :news, { :controller => 'news', :action => 'index' }, :param => :project_id, :caption => :label_news_plural
               menu.push :documents, { :controller => 'documents', :action => 'index' }, :param => :project_id, :caption => :label_document_plural
               menu.push :wiki, { :controller => 'wiki', :action => 'index', :page => nil },
                           :if => Proc.new { |p| p.wiki && !p.wiki.new_record? }
               menu.push :boards, { :controller => 'boards', :action => 'index', :id => nil }, :param => :project_id,
                           :if => Proc.new { |p| p.boards.any? }, :caption => :label_board_plural
               menu.push :files, { :controller => 'projects', :action => 'list_files' }, :caption => :label_attachment_plural
               menu.push :repository, { :controller => 'repositories', :action => 'show' },
                           :if => Proc.new { |p| p.repository && !p.repository.new_record? }
               menu.push :settings, { :controller => 'projects', :action => 'settings' }, :last => true
             end
             Redmine::Activity.map do |activity|
               activity.register :issues, :class_name => %w(Issue Journal)
               activity.register :changesets
               activity.register :news
               activity.register :documents, :class_name => %w(Document Attachment)
               activity.register :files, :class_name => 'Attachment'
               activity.register :wiki_edits, :class_name => 'WikiContent::Version', :default => false
               activity.register :messages, :default => false
             end
             Redmine::WikiFormatting.map do |format|
               format.register :textile, Redmine::WikiFormatting::Textile::Formatter, Redmine::WikiFormatting::Textile::Helper
             end

test/functional/attachments_controller_test.rb +29 0

             # redMine - project management software
             # Copyright (C) 2006-2008  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.dirname(__FILE__) + '/../test_helper'
             require 'attachments_controller'
             # Re-raise errors caught by the controller.
             class AttachmentsController; def rescue_action(e) raise e end; end
             class AttachmentsControllerTest < Test::Unit::TestCase
               fixtures :users, :projects, :roles, :members, :enabled_modules, :issues, :attachments
               def setup
                 @controller = AttachmentsController.new
                 @request    = ActionController::TestRequest.new
                 @response   = ActionController::TestResponse.new
                 Attachment.storage_path = "#{RAILS_ROOT}/test/fixtures/files"
                 User.current = nil
               end
               def test_routing
                 assert_routing('/attachments/1', :controller => 'attachments', :action => 'show', :id => '1')
                 assert_routing('/attachments/1/filename.ext', :controller => 'attachments', :action => 'show', :id => '1', :filename => 'filename.ext')
                 assert_routing('/attachments/download/1', :controller => 'attachments', :action => 'download', :id => '1')
                 assert_routing('/attachments/download/1/filename.ext', :controller => 'attachments', :action => 'download', :id => '1', :filename => 'filename.ext')
               end
               def test_recognizes
                 assert_recognizes({:controller => 'attachments', :action => 'show', :id => '1'}, '/attachments/1')
                 assert_recognizes({:controller => 'attachments', :action => 'show', :id => '1'}, '/attachments/show/1')
                 assert_recognizes({:controller => 'attachments', :action => 'show', :id => '1', :filename => 'filename.ext'}, '/attachments/1/filename.ext')
                 assert_recognizes({:controller => 'attachments', :action => 'download', :id => '1'}, '/attachments/download/1')
                 assert_recognizes({:controller => 'attachments', :action => 'download', :id => '1', :filename => 'filename.ext'},'/attachments/download/1/filename.ext')
               end
               def test_show_diff
                 get :show, :id => 5
                 assert_response :success
                 assert_template 'diff'
               end
               def test_show_text_file
                 get :show, :id => 4
                 assert_response :success
                 assert_template 'file'
               end
               def test_show_other
                 get :show, :id => 6
                 assert_response :success
                 assert_equal 'application/octet-stream', @response.content_type
               end
               def test_download_text_file
                 get :download, :id => 4
                 assert_response :success
                 assert_equal 'application/x-ruby', @response.content_type
               end
               def test_anonymous_on_private_private
                 get :download, :id => 7
                 assert_redirected_to 'account/login'
               end
+              def test_destroy_issue_attachment
+                issue = Issue.find(3)
+                @request.session[:user_id] = 2
+                assert_difference 'issue.attachments.count', -1 do
+                  post :destroy, :id => 1
+                end
+                # no referrer
+                assert_redirected_to 'projects/show/ecookbook'
+                assert_nil Attachment.find_by_id(1)
+                j = issue.journals.find(:first, :order => 'created_on DESC')
+                assert_equal 'attachment', j.details.first.property
+                assert_equal '1', j.details.first.prop_key
+                assert_equal 'error281.txt', j.details.first.old_value
+              end
+              def test_destroy_wiki_page_attachment
+                @request.session[:user_id] = 2
+                assert_difference 'Attachment.count', -1 do
+                  post :destroy, :id => 3
+                end
+              end
+              def test_destroy_without_permission
+                post :destroy, :id => 3
+                assert_redirected_to '/login'
+                assert Attachment.find_by_id(3)
+              end
             end

test/functional/issues_controller_test.rb 0 -13

             # Redmine - project management software
             # Copyright (C) 2006-2008  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.dirname(__FILE__) + '/../test_helper'
             require 'issues_controller'
             # Re-raise errors caught by the controller.
             class IssuesController; def rescue_action(e) raise e end; end
             class IssuesControllerTest < Test::Unit::TestCase
               fixtures :projects,
                        :users,
                        :roles,
                        :members,
                        :issues,
                        :issue_statuses,
                        :versions,
                        :trackers,
                        :projects_trackers,
                        :issue_categories,
                        :enabled_modules,
                        :enumerations,
                        :attachments,
                        :workflows,
                        :custom_fields,
                        :custom_values,
                        :custom_fields_trackers,
                        :time_entries,
                        :journals,
                        :journal_details
               def setup
                 @controller = IssuesController.new
                 @request    = ActionController::TestRequest.new
                 @response   = ActionController::TestResponse.new
                 User.current = nil
               end
               def test_index
                 get :index
                 assert_response :success
                 assert_template 'index.rhtml'
                 assert_not_nil assigns(:issues)
                 assert_nil assigns(:project)
                 assert_tag :tag => 'a', :content => /Can't print recipes/
                 assert_tag :tag => 'a', :content => /Subproject issue/
                 # private projects hidden
                 assert_no_tag :tag => 'a', :content => /Issue of a private subproject/
                 assert_no_tag :tag => 'a', :content => /Issue on project 2/
               end
               def test_index_should_not_list_issues_when_module_disabled
                 EnabledModule.delete_all("name = 'issue_tracking' AND project_id = 1")
                 get :index
                 assert_response :success
                 assert_template 'index.rhtml'
                 assert_not_nil assigns(:issues)
                 assert_nil assigns(:project)
                 assert_no_tag :tag => 'a', :content => /Can't print recipes/
                 assert_tag :tag => 'a', :content => /Subproject issue/
               end
               def test_index_with_project
                 Setting.display_subprojects_issues = 0
                 get :index, :project_id => 1
                 assert_response :success
                 assert_template 'index.rhtml'
                 assert_not_nil assigns(:issues)
                 assert_tag :tag => 'a', :content => /Can't print recipes/
                 assert_no_tag :tag => 'a', :content => /Subproject issue/
               end
               def test_index_with_project_and_subprojects
                 Setting.display_subprojects_issues = 1
                 get :index, :project_id => 1
                 assert_response :success
                 assert_template 'index.rhtml'
                 assert_not_nil assigns(:issues)
                 assert_tag :tag => 'a', :content => /Can't print recipes/
                 assert_tag :tag => 'a', :content => /Subproject issue/
                 assert_no_tag :tag => 'a', :content => /Issue of a private subproject/
               end
               def test_index_with_project_and_subprojects_should_show_private_subprojects
                 @request.session[:user_id] = 2
                 Setting.display_subprojects_issues = 1
                 get :index, :project_id => 1
                 assert_response :success
                 assert_template 'index.rhtml'
                 assert_not_nil assigns(:issues)
                 assert_tag :tag => 'a', :content => /Can't print recipes/
                 assert_tag :tag => 'a', :content => /Subproject issue/
                 assert_tag :tag => 'a', :content => /Issue of a private subproject/
               end
               def test_index_with_project_and_filter
                 get :index, :project_id => 1, :set_filter => 1
                 assert_response :success
                 assert_template 'index.rhtml'
                 assert_not_nil assigns(:issues)
               end
               def test_index_csv_with_project
                 get :index, :format => 'csv'
                 assert_response :success
                 assert_not_nil assigns(:issues)
                 assert_equal 'text/csv', @response.content_type
                 get :index, :project_id => 1, :format => 'csv'
                 assert_response :success
                 assert_not_nil assigns(:issues)
                 assert_equal 'text/csv', @response.content_type
               end
               def test_index_pdf
                 get :index, :format => 'pdf'
                 assert_response :success
                 assert_not_nil assigns(:issues)
                 assert_equal 'application/pdf', @response.content_type
                 get :index, :project_id => 1, :format => 'pdf'
                 assert_response :success
                 assert_not_nil assigns(:issues)
                 assert_equal 'application/pdf', @response.content_type
               end
               def test_gantt
                 get :gantt, :project_id => 1
                 assert_response :success
                 assert_template 'gantt.rhtml'
                 assert_not_nil assigns(:gantt)
                 events = assigns(:gantt).events
                 assert_not_nil events
                 # Issue with start and due dates
                 i = Issue.find(1)
                 assert_not_nil i.due_date
                 assert events.include?(Issue.find(1))
                 # Issue with without due date but targeted to a version with date
                 i = Issue.find(2)
                 assert_nil i.due_date
                 assert events.include?(i)
               end
               def test_cross_project_gantt
                 get :gantt
                 assert_response :success
                 assert_template 'gantt.rhtml'
                 assert_not_nil assigns(:gantt)
                 events = assigns(:gantt).events
                 assert_not_nil events
               end
               def test_gantt_export_to_pdf
                 get :gantt, :project_id => 1, :format => 'pdf'
                 assert_response :success
                 assert_template 'gantt.rfpdf'
                 assert_equal 'application/pdf', @response.content_type
                 assert_not_nil assigns(:gantt)
               end
               def test_cross_project_gantt_export_to_pdf
                 get :gantt, :format => 'pdf'
                 assert_response :success
                 assert_template 'gantt.rfpdf'
                 assert_equal 'application/pdf', @response.content_type
                 assert_not_nil assigns(:gantt)
               end
               if Object.const_defined?(:Magick)
                 def test_gantt_image
                   get :gantt, :project_id => 1, :format => 'png'
                   assert_response :success
                   assert_equal 'image/png', @response.content_type
                 end
               else
                 puts "RMagick not installed. Skipping tests !!!"
               end
               def test_calendar
                 get :calendar, :project_id => 1
                 assert_response :success
                 assert_template 'calendar'
                 assert_not_nil assigns(:calendar)
               end
               def test_cross_project_calendar
                 get :calendar
                 assert_response :success
                 assert_template 'calendar'
                 assert_not_nil assigns(:calendar)
               end
               def test_changes
                 get :changes, :project_id => 1
                 assert_response :success
                 assert_not_nil assigns(:journals)
                 assert_equal 'application/atom+xml', @response.content_type
               end
               def test_show_by_anonymous
                 get :show, :id => 1
                 assert_response :success
                 assert_template 'show.rhtml'
                 assert_not_nil assigns(:issue)
                 assert_equal Issue.find(1), assigns(:issue)
                 # anonymous role is allowed to add a note
                 assert_tag :tag => 'form',
                            :descendant => { :tag => 'fieldset',
                                             :child => { :tag => 'legend',
                                                         :content => /Notes/ } }
               end
               def test_show_by_manager
                 @request.session[:user_id] = 2
                 get :show, :id => 1
                 assert_response :success
                 assert_tag :tag => 'form',
                            :descendant => { :tag => 'fieldset',
                                             :child => { :tag => 'legend',
                                                         :content => /Change properties/ } },
                            :descendant => { :tag => 'fieldset',
                                             :child => { :tag => 'legend',
                                                         :content => /Log time/ } },
                            :descendant => { :tag => 'fieldset',
                                             :child => { :tag => 'legend',
                                                         :content => /Notes/ } }
               end
               def test_get_new
                 @request.session[:user_id] = 2
                 get :new, :project_id => 1, :tracker_id => 1
                 assert_response :success
                 assert_template 'new'
                 assert_tag :tag => 'input', :attributes => { :name => 'issue[custom_field_values][2]',
                                                              :value => 'Default string' }
               end
               def test_get_new_without_tracker_id
                 @request.session[:user_id] = 2
                 get :new, :project_id => 1
                 assert_response :success
                 assert_template 'new'
                 issue = assigns(:issue)
                 assert_not_nil issue
                 assert_equal Project.find(1).trackers.first, issue.tracker
               end
               def test_update_new_form
                 @request.session[:user_id] = 2
                 xhr :post, :new, :project_id => 1,
                                  :issue => {:tracker_id => 2,
                                             :subject => 'This is the test_new issue',
                                             :description => 'This is the description',
                                             :priority_id => 5}
                 assert_response :success
                 assert_template 'new'
               end
               def test_post_new
                 @request.session[:user_id] = 2
                 post :new, :project_id => 1,
                            :issue => {:tracker_id => 3,
                                       :subject => 'This is the test_new issue',
                                       :description => 'This is the description',
                                       :priority_id => 5,
                                       :estimated_hours => '',
                                       :custom_field_values => {'2' => 'Value for field 2'}}
                 assert_redirected_to 'issues/show'
                 issue = Issue.find_by_subject('This is the test_new issue')
                 assert_not_nil issue
                 assert_equal 2, issue.author_id
                 assert_equal 3, issue.tracker_id
                 assert_nil issue.estimated_hours
                 v = issue.custom_values.find(:first, :conditions => {:custom_field_id => 2})
                 assert_not_nil v
                 assert_equal 'Value for field 2', v.value
               end
               def test_post_new_without_custom_fields_param
                 @request.session[:user_id] = 2
                 post :new, :project_id => 1,
                            :issue => {:tracker_id => 1,
                                       :subject => 'This is the test_new issue',
                                       :description => 'This is the description',
                                       :priority_id => 5}
                 assert_redirected_to 'issues/show'
               end
               def test_post_new_with_required_custom_field_and_without_custom_fields_param
                 field = IssueCustomField.find_by_name('Database')
                 field.update_attribute(:is_required, true)
                 @request.session[:user_id] = 2
                 post :new, :project_id => 1,
                            :issue => {:tracker_id => 1,
                                       :subject => 'This is the test_new issue',
                                       :description => 'This is the description',
                                       :priority_id => 5}
                 assert_response :success
                 assert_template 'new'
                 issue = assigns(:issue)
                 assert_not_nil issue
                 assert_equal 'activerecord_error_invalid', issue.errors.on(:custom_values)
               end
               def test_post_should_preserve_fields_values_on_validation_failure
                 @request.session[:user_id] = 2
                 post :new, :project_id => 1,
                            :issue => {:tracker_id => 1,
                                       :subject => 'This is the test_new issue',
                                       # empty description
                                       :description => '',
                                       :priority_id => 6,
                                       :custom_field_values => {'1' => 'Oracle', '2' => 'Value for field 2'}}
                 assert_response :success
                 assert_template 'new'
                 assert_tag :input, :attributes => { :name => 'issue[subject]',
                                                     :value => 'This is the test_new issue' }
                 assert_tag :select, :attributes => { :name => 'issue[priority_id]' },
                                     :child => { :tag => 'option', :attributes => { :selected => 'selected',
                                                                                    :value => '6' },
                                                                   :content => 'High' }
                 # Custom fields
                 assert_tag :select, :attributes => { :name => 'issue[custom_field_values][1]' },
                                     :child => { :tag => 'option', :attributes => { :selected => 'selected',
                                                                                    :value => 'Oracle' },
                                                                   :content => 'Oracle' }
                 assert_tag :input, :attributes => { :name => 'issue[custom_field_values][2]',
                                                     :value => 'Value for field 2'}
               end
               def test_copy_issue
                 @request.session[:user_id] = 2
                 get :new, :project_id => 1, :copy_from => 1
                 assert_template 'new'
                 assert_not_nil assigns(:issue)
                 orig = Issue.find(1)
                 assert_equal orig.subject, assigns(:issue).subject
               end
               def test_get_edit
                 @request.session[:user_id] = 2
                 get :edit, :id => 1
                 assert_response :success
                 assert_template 'edit'
                 assert_not_nil assigns(:issue)
                 assert_equal Issue.find(1), assigns(:issue)
               end
               def test_get_edit_with_params
                 @request.session[:user_id] = 2
                 get :edit, :id => 1, :issue => { :status_id => 5, :priority_id => 7 }
                 assert_response :success
                 assert_template 'edit'
                 issue = assigns(:issue)
                 assert_not_nil issue
                 assert_equal 5, issue.status_id
                 assert_tag :select, :attributes => { :name => 'issue[status_id]' },
                                     :child => { :tag => 'option',
                                                 :content => 'Closed',
                                                 :attributes => { :selected => 'selected' } }
                 assert_equal 7, issue.priority_id
                 assert_tag :select, :attributes => { :name => 'issue[priority_id]' },
                                     :child => { :tag => 'option',
                                                 :content => 'Urgent',
                                                 :attributes => { :selected => 'selected' } }
               end
               def test_reply_to_issue
                 @request.session[:user_id] = 2
                 get :reply, :id => 1
                 assert_response :success
                 assert_select_rjs :show, "update"
               end
               def test_reply_to_note
                 @request.session[:user_id] = 2
                 get :reply, :id => 1, :journal_id => 2
                 assert_response :success
                 assert_select_rjs :show, "update"
               end
               def test_post_edit_without_custom_fields_param
                 @request.session[:user_id] = 2
                 ActionMailer::Base.deliveries.clear
                 issue = Issue.find(1)
                 assert_equal '125', issue.custom_value_for(2).value
                 old_subject = issue.subject
                 new_subject = 'Subject modified by IssuesControllerTest#test_post_edit'
                 assert_difference('Journal.count') do
                   assert_difference('JournalDetail.count', 2) do
                     post :edit, :id => 1, :issue => {:subject => new_subject,
                                                      :priority_id => '6',
                                                      :category_id => '1' # no change
                                                     }
                   end
                 end
                 assert_redirected_to 'issues/show/1'
                 issue.reload
                 assert_equal new_subject, issue.subject
                 # Make sure custom fields were not cleared
                 assert_equal '125', issue.custom_value_for(2).value
                 mail = ActionMailer::Base.deliveries.last
                 assert_kind_of TMail::Mail, mail
                 assert mail.subject.starts_with?("[#{issue.project.name} - #{issue.tracker.name} ##{issue.id}]")
                 assert mail.body.include?("Subject changed from #{old_subject} to #{new_subject}")
               end
               def test_post_edit_with_custom_field_change
                 @request.session[:user_id] = 2
                 issue = Issue.find(1)
                 assert_equal '125', issue.custom_value_for(2).value
                 assert_difference('Journal.count') do
                   assert_difference('JournalDetail.count', 3) do
                     post :edit, :id => 1, :issue => {:subject => 'Custom field change',
                                                      :priority_id => '6',
                                                      :category_id => '1', # no change
                                                      :custom_field_values => { '2' => 'New custom value' }
                                                     }
                   end
                 end
                 assert_redirected_to 'issues/show/1'
                 issue.reload
                 assert_equal 'New custom value', issue.custom_value_for(2).value
                 mail = ActionMailer::Base.deliveries.last
                 assert_kind_of TMail::Mail, mail
                 assert mail.body.include?("Searchable field changed from 125 to New custom value")
               end
               def test_post_edit_with_status_and_assignee_change
                 issue = Issue.find(1)
                 assert_equal 1, issue.status_id
                 @request.session[:user_id] = 2
                 assert_difference('TimeEntry.count', 0) do
                   post :edit,
                        :id => 1,
                        :issue => { :status_id => 2, :assigned_to_id => 3 },
                        :notes => 'Assigned to dlopper',
                        :time_entry => { :hours => '', :comments => '', :activity_id => Enumeration.get_values('ACTI').first }
                 end
                 assert_redirected_to 'issues/show/1'
                 issue.reload
                 assert_equal 2, issue.status_id
                 j = issue.journals.find(:first, :order => 'id DESC')
                 assert_equal 'Assigned to dlopper', j.notes
                 assert_equal 2, j.details.size
                 mail = ActionMailer::Base.deliveries.last
                 assert mail.body.include?("Status changed from New to Assigned")
               end
               def test_post_edit_with_note_only
                 notes = 'Note added by IssuesControllerTest#test_update_with_note_only'
                 # anonymous user
                 post :edit,
                      :id => 1,
                      :notes => notes
                 assert_redirected_to 'issues/show/1'
                 j = Issue.find(1).journals.find(:first, :order => 'id DESC')
                 assert_equal notes, j.notes
                 assert_equal 0, j.details.size
                 assert_equal User.anonymous, j.user
                 mail = ActionMailer::Base.deliveries.last
                 assert mail.body.include?(notes)
               end
               def test_post_edit_with_note_and_spent_time
                 @request.session[:user_id] = 2
                 spent_hours_before = Issue.find(1).spent_hours
                 assert_difference('TimeEntry.count') do
                   post :edit,
                        :id => 1,
                        :notes => '2.5 hours added',
                        :time_entry => { :hours => '2.5', :comments => '', :activity_id => Enumeration.get_values('ACTI').first }
                 end
                 assert_redirected_to 'issues/show/1'
                 issue = Issue.find(1)
                 j = issue.journals.find(:first, :order => 'id DESC')
                 assert_equal '2.5 hours added', j.notes
                 assert_equal 0, j.details.size
                 t = issue.time_entries.find(:first, :order => 'id DESC')
                 assert_not_nil t
                 assert_equal 2.5, t.hours
                 assert_equal spent_hours_before + 2.5, issue.spent_hours
               end
               def test_post_edit_with_attachment_only
                 set_tmp_attachments_directory
                 # Delete all fixtured journals, a race condition can occur causing the wrong
                 # journal to get fetched in the next find.
                 Journal.delete_all
                 # anonymous user
                 post :edit,
                      :id => 1,
                      :notes => '',
                      :attachments => {'1' => {'file' => test_uploaded_file('testfile.txt', 'text/plain')}}
                 assert_redirected_to 'issues/show/1'
                 j = Issue.find(1).journals.find(:first, :order => 'id DESC')
                 assert j.notes.blank?
                 assert_equal 1, j.details.size
                 assert_equal 'testfile.txt', j.details.first.value
                 assert_equal User.anonymous, j.user
                 mail = ActionMailer::Base.deliveries.last
                 assert mail.body.include?('testfile.txt')
               end
               def test_post_edit_with_no_change
                 issue = Issue.find(1)
                 issue.journals.clear
                 ActionMailer::Base.deliveries.clear
                 post :edit,
                      :id => 1,
                      :notes => ''
                 assert_redirected_to 'issues/show/1'
                 issue.reload
                 assert issue.journals.empty?
                 # No email should be sent
                 assert ActionMailer::Base.deliveries.empty?
               end
               def test_bulk_edit
                 @request.session[:user_id] = 2
                 # update issues priority
                 post :bulk_edit, :ids => [1, 2], :priority_id => 7, :notes => 'Bulk editing', :assigned_to_id => ''
                 assert_response 302
                 # check that the issues were updated
                 assert_equal [7, 7], Issue.find_all_by_id([1, 2]).collect {|i| i.priority.id}
                 assert_equal 'Bulk editing', Issue.find(1).journals.find(:first, :order => 'created_on DESC').notes
               end
               def test_bulk_unassign
                 assert_not_nil Issue.find(2).assigned_to
                 @request.session[:user_id] = 2
                 # unassign issues
                 post :bulk_edit, :ids => [1, 2], :notes => 'Bulk unassigning', :assigned_to_id => 'none'
                 assert_response 302
                 # check that the issues were updated
                 assert_nil Issue.find(2).assigned_to
               end
               def test_move_one_issue_to_another_project
                 @request.session[:user_id] = 1
                 post :move, :id => 1, :new_project_id => 2
                 assert_redirected_to 'projects/ecookbook/issues'
                 assert_equal 2, Issue.find(1).project_id
               end
               def test_bulk_move_to_another_project
                 @request.session[:user_id] = 1
                 post :move, :ids => [1, 2], :new_project_id => 2
                 assert_redirected_to 'projects/ecookbook/issues'
                 # Issues moved to project 2
                 assert_equal 2, Issue.find(1).project_id
                 assert_equal 2, Issue.find(2).project_id
                 # No tracker change
                 assert_equal 1, Issue.find(1).tracker_id
                 assert_equal 2, Issue.find(2).tracker_id
               end
               def test_bulk_move_to_another_tracker
                 @request.session[:user_id] = 1
                 post :move, :ids => [1, 2], :new_tracker_id => 2
                 assert_redirected_to 'projects/ecookbook/issues'
                 assert_equal 2, Issue.find(1).tracker_id
                 assert_equal 2, Issue.find(2).tracker_id
               end
               def test_context_menu_one_issue
                 @request.session[:user_id] = 2
                 get :context_menu, :ids => [1]
                 assert_response :success
                 assert_template 'context_menu'
                 assert_tag :tag => 'a', :content => 'Edit',
                                         :attributes => { :href => '/issues/edit/1',
                                                          :class => 'icon-edit' }
                 assert_tag :tag => 'a', :content => 'Closed',
                                         :attributes => { :href => '/issues/edit/1?issue%5Bstatus_id%5D=5',
                                                          :class => '' }
                 assert_tag :tag => 'a', :content => 'Immediate',
                                         :attributes => { :href => '/issues/bulk_edit?ids%5B%5D=1&amp;priority_id=8',
                                                          :class => '' }
                 assert_tag :tag => 'a', :content => 'Dave Lopper',
                                         :attributes => { :href => '/issues/bulk_edit?assigned_to_id=3&amp;ids%5B%5D=1',
                                                          :class => '' }
                 assert_tag :tag => 'a', :content => 'Copy',
                                         :attributes => { :href => '/projects/ecookbook/issues/new?copy_from=1',
                                                          :class => 'icon-copy' }
                 assert_tag :tag => 'a', :content => 'Move',
                                         :attributes => { :href => '/issues/move?ids%5B%5D=1',
                                                          :class => 'icon-move' }
                 assert_tag :tag => 'a', :content => 'Delete',
                                         :attributes => { :href => '/issues/destroy?ids%5B%5D=1',
                                                          :class => 'icon-del' }
               end
               def test_context_menu_one_issue_by_anonymous
                 get :context_menu, :ids => [1]
                 assert_response :success
                 assert_template 'context_menu'
                 assert_tag :tag => 'a', :content => 'Delete',
                                         :attributes => { :href => '#',
                                                          :class => 'icon-del disabled' }
               end
               def test_context_menu_multiple_issues_of_same_project
                 @request.session[:user_id] = 2
                 get :context_menu, :ids => [1, 2]
                 assert_response :success
                 assert_template 'context_menu'
                 assert_tag :tag => 'a', :content => 'Edit',
                                         :attributes => { :href => '/issues/bulk_edit?ids%5B%5D=1&amp;ids%5B%5D=2',
                                                          :class => 'icon-edit' }
                 assert_tag :tag => 'a', :content => 'Immediate',
                                         :attributes => { :href => '/issues/bulk_edit?ids%5B%5D=1&amp;ids%5B%5D=2&amp;priority_id=8',
                                                          :class => '' }
                 assert_tag :tag => 'a', :content => 'Dave Lopper',
                                         :attributes => { :href => '/issues/bulk_edit?assigned_to_id=3&amp;ids%5B%5D=1&amp;ids%5B%5D=2',
                                                          :class => '' }
                 assert_tag :tag => 'a', :content => 'Move',
                                         :attributes => { :href => '/issues/move?ids%5B%5D=1&amp;ids%5B%5D=2',
                                                          :class => 'icon-move' }
                 assert_tag :tag => 'a', :content => 'Delete',
                                         :attributes => { :href => '/issues/destroy?ids%5B%5D=1&amp;ids%5B%5D=2',
                                                          :class => 'icon-del' }
               end
               def test_context_menu_multiple_issues_of_different_project
                 @request.session[:user_id] = 2
                 get :context_menu, :ids => [1, 2, 4]
                 assert_response :success
                 assert_template 'context_menu'
                 assert_tag :tag => 'a', :content => 'Delete',
                                         :attributes => { :href => '#',
                                                          :class => 'icon-del disabled' }
               end
               def test_destroy_issue_with_no_time_entries
                 assert_nil TimeEntry.find_by_issue_id(2)
                 @request.session[:user_id] = 2
                 post :destroy, :id => 2
                 assert_redirected_to 'projects/ecookbook/issues'
                 assert_nil Issue.find_by_id(2)
               end
               def test_destroy_issues_with_time_entries
                 @request.session[:user_id] = 2
                 post :destroy, :ids => [1, 3]
                 assert_response :success
                 assert_template 'destroy'
                 assert_not_nil assigns(:hours)
                 assert Issue.find_by_id(1) && Issue.find_by_id(3)
               end
               def test_destroy_issues_and_destroy_time_entries
                 @request.session[:user_id] = 2
                 post :destroy, :ids => [1, 3], :todo => 'destroy'
                 assert_redirected_to 'projects/ecookbook/issues'
                 assert !(Issue.find_by_id(1) || Issue.find_by_id(3))
                 assert_nil TimeEntry.find_by_id([1, 2])
               end
               def test_destroy_issues_and_assign_time_entries_to_project
                 @request.session[:user_id] = 2
                 post :destroy, :ids => [1, 3], :todo => 'nullify'
                 assert_redirected_to 'projects/ecookbook/issues'
                 assert !(Issue.find_by_id(1) || Issue.find_by_id(3))
                 assert_nil TimeEntry.find(1).issue_id
                 assert_nil TimeEntry.find(2).issue_id
               end
               def test_destroy_issues_and_reassign_time_entries_to_another_issue
                 @request.session[:user_id] = 2
                 post :destroy, :ids => [1, 3], :todo => 'reassign', :reassign_to_id => 2
                 assert_redirected_to 'projects/ecookbook/issues'
                 assert !(Issue.find_by_id(1) || Issue.find_by_id(3))
                 assert_equal 2, TimeEntry.find(1).issue_id
                 assert_equal 2, TimeEntry.find(2).issue_id
               end
-              def test_destroy_attachment
-                issue = Issue.find(3)
-                a = issue.attachments.size
-                @request.session[:user_id] = 2
-                post :destroy_attachment, :id => 3, :attachment_id => 1
-                assert_redirected_to 'issues/show/3'
-                assert_nil Attachment.find_by_id(1)
-                issue.reload
-                assert_equal((a-1), issue.attachments.size)
-                j = issue.journals.find(:first, :order => 'created_on DESC')
-                assert_equal 'attachment', j.details.first.property
-              end
             end

test/functional/wiki_controller_test.rb 0 -7

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.dirname(__FILE__) + '/../test_helper'
             require 'wiki_controller'
             # Re-raise errors caught by the controller.
             class WikiController; def rescue_action(e) raise e end; end
             class WikiControllerTest < Test::Unit::TestCase
               fixtures :projects, :users, :roles, :members, :enabled_modules, :wikis, :wiki_pages, :wiki_contents, :wiki_content_versions, :attachments
               def setup
                 @controller = WikiController.new
                 @request    = ActionController::TestRequest.new
                 @response   = ActionController::TestResponse.new
                 User.current = nil
               end
               def test_show_start_page
                 get :index, :id => 'ecookbook'
                 assert_response :success
                 assert_template 'show'
                 assert_tag :tag => 'h1', :content => /CookBook documentation/
                 # child_pages macro
                 assert_tag :ul, :attributes => { :class => 'pages-hierarchy' },
                            :child => { :tag => 'li',
                                        :child => { :tag => 'a', :attributes => { :href => '/wiki/ecookbook/Page_with_an_inline_image' },
                                                                 :content => 'Page with an inline image' } }
               end
               def test_show_page_with_name
                 get :index, :id => 1, :page => 'Another_page'
                 assert_response :success
                 assert_template 'show'
                 assert_tag :tag => 'h1', :content => /Another page/
                 # Included page with an inline image
                 assert_tag :tag => 'p', :content => /This is an inline image/
                 assert_tag :tag => 'img', :attributes => { :src => '/attachments/download/3',
                                                            :alt => 'This is a logo' }
               end
               def test_show_unexistent_page_without_edit_right
                 get :index, :id => 1, :page => 'Unexistent page'
                 assert_response 404
               end
               def test_show_unexistent_page_with_edit_right
                 @request.session[:user_id] = 2
                 get :index, :id => 1, :page => 'Unexistent page'
                 assert_response :success
                 assert_template 'edit'
               end
               def test_create_page
                 @request.session[:user_id] = 2
                 post :edit, :id => 1,
                             :page => 'New page',
                             :content => {:comments => 'Created the page',
                                          :text => "h1. New page\n\nThis is a new page",
                                          :version => 0}
                 assert_redirected_to 'wiki/ecookbook/New_page'
                 page = Project.find(1).wiki.find_page('New page')
                 assert !page.new_record?
                 assert_not_nil page.content
                 assert_equal 'Created the page', page.content.comments
               end
               def test_preview
                 @request.session[:user_id] = 2
                 xhr :post, :preview, :id => 1, :page => 'CookBook_documentation',
                                                :content => { :comments => '',
                                                              :text => 'this is a *previewed text*',
                                                              :version => 3 }
                 assert_response :success
                 assert_template 'common/_preview'
                 assert_tag :tag => 'strong', :content => /previewed text/
               end
               def test_preview_new_page
                 @request.session[:user_id] = 2
                 xhr :post, :preview, :id => 1, :page => 'New page',
                                                :content => { :text => 'h1. New page',
                                                              :comments => '',
                                                              :version => 0 }
                 assert_response :success
                 assert_template 'common/_preview'
                 assert_tag :tag => 'h1', :content => /New page/
               end
               def test_history
                 get :history, :id => 1, :page => 'CookBook_documentation'
                 assert_response :success
                 assert_template 'history'
                 assert_not_nil assigns(:versions)
                 assert_equal 3, assigns(:versions).size
                 assert_select "input[type=submit][name=commit]"
               end
               def test_history_with_one_version
                 get :history, :id => 1, :page => 'Another_page'
                 assert_response :success
                 assert_template 'history'
                 assert_not_nil assigns(:versions)
                 assert_equal 1, assigns(:versions).size
                 assert_select "input[type=submit][name=commit]", false
               end
               def test_diff
                 get :diff, :id => 1, :page => 'CookBook_documentation', :version => 2, :version_from => 1
                 assert_response :success
                 assert_template 'diff'
                 assert_tag :tag => 'span', :attributes => { :class => 'diff_in'},
                                            :content => /updated/
               end
               def test_annotate
                 get :annotate, :id => 1, :page =>  'CookBook_documentation', :version => 2
                 assert_response :success
                 assert_template 'annotate'
                 # Line 1
                 assert_tag :tag => 'tr', :child => { :tag => 'th', :attributes => {:class => 'line-num'}, :content => '1' },
                                          :child => { :tag => 'td', :attributes => {:class => 'author'}, :content => /John Smith/ },
                                          :child => { :tag => 'td', :content => /h1\. CookBook documentation/ }
                 # Line 2
                 assert_tag :tag => 'tr', :child => { :tag => 'th', :attributes => {:class => 'line-num'}, :content => '2' },
                                          :child => { :tag => 'td', :attributes => {:class => 'author'}, :content => /redMine Admin/ },
                                          :child => { :tag => 'td', :content => /Some updated \[\[documentation\]\] here/ }
               end
               def test_rename_with_redirect
                 @request.session[:user_id] = 2
                 post :rename, :id => 1, :page => 'Another_page',
                                         :wiki_page => { :title => 'Another renamed page',
                                                         :redirect_existing_links => 1 }
                 assert_redirected_to 'wiki/ecookbook/Another_renamed_page'
                 wiki = Project.find(1).wiki
                 # Check redirects
                 assert_not_nil wiki.find_page('Another page')
                 assert_nil wiki.find_page('Another page', :with_redirect => false)
               end
               def test_rename_without_redirect
                 @request.session[:user_id] = 2
                 post :rename, :id => 1, :page => 'Another_page',
                                         :wiki_page => { :title => 'Another renamed page',
                                                         :redirect_existing_links => "0" }
                 assert_redirected_to 'wiki/ecookbook/Another_renamed_page'
                 wiki = Project.find(1).wiki
                 # Check that there's no redirects
                 assert_nil wiki.find_page('Another page')
               end
               def test_destroy
                 @request.session[:user_id] = 2
                 post :destroy, :id => 1, :page => 'CookBook_documentation'
                 assert_redirected_to 'wiki/ecookbook/Page_index/special'
               end
               def test_page_index
                 get :special, :id => 'ecookbook', :page => 'Page_index'
                 assert_response :success
                 assert_template 'special_page_index'
                 pages = assigns(:pages)
                 assert_not_nil pages
                 assert_equal Project.find(1).wiki.pages.size, pages.size
                 assert_tag :ul, :attributes => { :class => 'pages-hierarchy' },
                                 :child => { :tag => 'li', :child => { :tag => 'a', :attributes => { :href => '/wiki/ecookbook/CookBook_documentation' },
                                                           :content => 'CookBook documentation' },
                                             :child => { :tag => 'ul',
                                                         :child => { :tag => 'li',
                                                                     :child => { :tag => 'a', :attributes => { :href => '/wiki/ecookbook/Page_with_an_inline_image' },
                                                                                              :content => 'Page with an inline image' } } } },
                                 :child => { :tag => 'li', :child => { :tag => 'a', :attributes => { :href => '/wiki/ecookbook/Another_page' },
                                                                                    :content => 'Another page' } }
               end
               def test_not_found
                 get :index, :id => 999
                 assert_response 404
               end
               def test_protect_page
                 page = WikiPage.find_by_wiki_id_and_title(1, 'Another_page')
                 assert !page.protected?
                 @request.session[:user_id] = 2
                 post :protect, :id => 1, :page => page.title, :protected => '1'
                 assert_redirected_to 'wiki/ecookbook/Another_page'
                 assert page.reload.protected?
               end
               def test_unprotect_page
                 page = WikiPage.find_by_wiki_id_and_title(1, 'CookBook_documentation')
                 assert page.protected?
                 @request.session[:user_id] = 2
                 post :protect, :id => 1, :page => page.title, :protected => '0'
                 assert_redirected_to 'wiki/ecookbook'
                 assert !page.reload.protected?
               end
               def test_show_page_with_edit_link
                 @request.session[:user_id] = 2
                 get :index, :id => 1
                 assert_response :success
                 assert_template 'show'
                 assert_tag :tag => 'a', :attributes => { :href => '/wiki/1/CookBook_documentation/edit' }
               end
               def test_show_page_without_edit_link
                 @request.session[:user_id] = 4
                 get :index, :id => 1
                 assert_response :success
                 assert_template 'show'
                 assert_no_tag :tag => 'a', :attributes => { :href => '/wiki/1/CookBook_documentation/edit' }
               end
               def test_edit_unprotected_page
                 # Non members can edit unprotected wiki pages
                 @request.session[:user_id] = 4
                 get :edit, :id => 1, :page => 'Another_page'
                 assert_response :success
                 assert_template 'edit'
               end
               def test_edit_protected_page_by_nonmember
                 # Non members can't edit protected wiki pages
                 @request.session[:user_id] = 4
                 get :edit, :id => 1, :page => 'CookBook_documentation'
                 assert_response 403
               end
               def test_edit_protected_page_by_member
                 @request.session[:user_id] = 2
                 get :edit, :id => 1, :page => 'CookBook_documentation'
                 assert_response :success
                 assert_template 'edit'
               end
-              def test_destroy_attachment
-                @request.session[:user_id] = 2
-                assert_difference 'Attachment.count', -1 do
-                  post :destroy_attachment, :id => 1, :page => 'Page_with_an_inline_image', :attachment_id => 3
-                end
-              end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages