jro_apps/redmine Commit - r5756:7e1f04bdfb6f

Do not propose users that can't view an issue as watchers (#7412)....

Jean-Philippe Lang -

r5756:7e1f04bdfb6f

parent child

Context file:

r5756:7e1f04bdfb6f

Collapse all files

test/unit/watcher_test.rb +11 0

             # Redmine - project management software
             # Copyright (C) 2006-2009  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.expand_path('../../test_helper', __FILE__)
             class WatcherTest < ActiveSupport::TestCase
               fixtures :projects, :users, :members, :member_roles, :roles, :enabled_modules,
                        :issues,
                        :boards, :messages,
                        :wikis, :wiki_pages,
                        :watchers
               def setup
                 @user = User.find(1)
                 @issue = Issue.find(1)
               end
               def test_watch
                 assert @issue.add_watcher(@user)
                 @issue.reload
                 assert @issue.watchers.detect { |w| w.user == @user }
               end
               def test_cant_watch_twice
                 assert @issue.add_watcher(@user)
                 assert !@issue.add_watcher(@user)
               end
               def test_watched_by
                 assert @issue.add_watcher(@user)
                 @issue.reload
                 assert @issue.watched_by?(@user)
                 assert Issue.watched_by(@user).include?(@issue)
               end
               def test_watcher_user_ids
                 issue = Issue.new
                 issue.watcher_user_ids = ['1', '3']
                 assert issue.watched_by?(User.find(1))
               end
+              def test_addable_watcher_users
+                addable_watcher_users = @issue.addable_watcher_users
+                assert_kind_of Array, addable_watcher_users
+                assert_kind_of User, addable_watcher_users.first
+              end
+              def test_addable_watcher_users_should_not_include_user_that_cannot_view_the_object
+                issue = Issue.new(:project => Project.find(1), :is_private => true)
+                assert_nil issue.addable_watcher_users.detect {|user| !issue.visible?(user)}
+              end
               def test_recipients
                 @issue.watchers.delete_all
                 @issue.reload
                 assert @issue.watcher_recipients.empty?
                 assert @issue.add_watcher(@user)
                 @user.mail_notification = 'all'
                 @user.save!
                 @issue.reload
                 assert @issue.watcher_recipients.include?(@user.mail)
                 @user.mail_notification = 'none'
                 @user.save!
                 @issue.reload
                 assert !@issue.watcher_recipients.include?(@user.mail)
               end
               def test_unwatch
                 assert @issue.add_watcher(@user)
                 @issue.reload
                 assert_equal 1, @issue.remove_watcher(@user)
               end
               def test_prune
                 Watcher.delete_all("user_id = 9")
                 user = User.find(9)
                 # public
                 Watcher.create!(:watchable => Issue.find(1), :user => user)
                 Watcher.create!(:watchable => Issue.find(2), :user => user)
                 Watcher.create!(:watchable => Message.find(1), :user => user)
                 Watcher.create!(:watchable => Wiki.find(1), :user => user)
                 Watcher.create!(:watchable => WikiPage.find(2), :user => user)
                 # private project (id: 2)
                 Member.create!(:project => Project.find(2), :principal => user, :role_ids => [1])
                 Watcher.create!(:watchable => Issue.find(4), :user => user)
                 Watcher.create!(:watchable => Message.find(7), :user => user)
                 Watcher.create!(:watchable => Wiki.find(2), :user => user)
                 Watcher.create!(:watchable => WikiPage.find(3), :user => user)
                 assert_no_difference 'Watcher.count' do
                   Watcher.prune(:user => User.find(9))
                 end
                 Member.delete_all
                 assert_difference 'Watcher.count', -4 do
                   Watcher.prune(:user => User.find(9))
                 end
                 assert Issue.find(1).watched_by?(user)
                 assert !Issue.find(4).watched_by?(user)
               end
             end

vendor/plugins/acts_as_watchable/lib/acts_as_watchable.rb +5 -1

             # ActsAsWatchable
             module Redmine
               module Acts
                 module Watchable
                   def self.included(base)
                     base.extend ClassMethods
                   end
                   module ClassMethods
                     def acts_as_watchable(options = {})
                       return if self.included_modules.include?(Redmine::Acts::Watchable::InstanceMethods)
                       send :include, Redmine::Acts::Watchable::InstanceMethods
                       class_eval do
                         has_many :watchers, :as => :watchable, :dependent => :delete_all
                         has_many :watcher_users, :through => :watchers, :source => :user
                         named_scope :watched_by, lambda { |user_id|
                           { :include => :watchers,
                             :conditions => ["#{Watcher.table_name}.user_id = ?", user_id] }
                         }
                         attr_protected :watcher_ids, :watcher_user_ids
                       end
                     end
                   end
                   module InstanceMethods
                     def self.included(base)
                       base.extend ClassMethods
                     end
                     # Returns an array of users that are proposed as watchers
                     def addable_watcher_users
-                      self.project.users.sort - self.watcher_users
+                      users = self.project.users.sort - self.watcher_users
+                      if respond_to?(:visible?)
+                        users.reject! {|user| !visible?(user)}
+                      end
+                      users
                     end
                     # Adds user as a watcher
                     def add_watcher(user)
                       self.watchers << Watcher.new(:user => user)
                     end
                     # Removes user from the watchers list
                     def remove_watcher(user)
                       return nil unless user && user.is_a?(User)
                       Watcher.delete_all "watchable_type = '#{self.class}' AND watchable_id = #{self.id} AND user_id = #{user.id}"
                     end
                     # Adds/removes watcher
                     def set_watcher(user, watching=true)
                       watching ? add_watcher(user) : remove_watcher(user)
                     end
                     # Returns true if object is watched by +user+
                     def watched_by?(user)
                       !!(user && self.watcher_user_ids.detect {|uid| uid == user.id })
                     end
                     # Returns an array of watchers' email addresses
                     def watcher_recipients
                       notified = watcher_users.active
                       notified.reject! {|user| user.mail_notification == 'none'}
                       if respond_to?(:visible?)
                         notified.reject! {|user| !visible?(user)}
                       end
                       notified.collect(&:mail).compact
                     end
                     module ClassMethods; end
                   end
                 end
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages