jro_apps/redmine Commit - r1416:7ee38a95a005

Fixed: Calendar and Gantt show private subprojects even if current user is not a member of them (#1217)....

Jean-Philippe Lang -

r1416:7ee38a95a005

parent child

Context file:

r1416:7ee38a95a005

Collapse all files

app/models/project.rb +4 -3

               def issues_with_subprojects(include_subprojects=false)
                 conditions = nil
-                if include_subprojects && !active_children.empty?
+                if include_subprojects
-                  ids = [id] + active_children.collect {|c| c.id}
+                  ids = [id] + child_ids
-                  conditions = ["#{Project.table_name}.id IN (#{ids.join(',')})"]
+                  conditions = ["#{Project.table_name}.id IN (#{ids.join(',')}) AND #{Project.visible_by}"]
                 end
                 conditions ||= ["#{Project.table_name}.id = ?", id]
                 # Quick and dirty fix for Rails 2 compatibility
               end
               def self.visible_by(user=nil)
+                user ||= User.current
                 if user && user.admin?
                   return "#{Project.table_name}.status=#{Project::STATUS_ACTIVE}"
                 elsif user && user.memberships.any?

test/fixtures/issues.yml +17 -1

@@ -71,4 +71,20 issues_005:
71	assigned_to_id:	71	assigned_to_id:
72	author_id: 2	72	author_id: 2
73	status_id: 1	73	status_id: 1
74		74	issues_006:
		75	created_on: <%= 1.minute.ago.to_date.to_s(:db) %>
		76	project_id: 5
		77	updated_on: <%= 1.minute.ago.to_date.to_s(:db) %>
		78	priority_id: 4
		79	subject: Issue of a private subproject
		80	id: 6
		81	fixed_version_id:
		82	category_id:
		83	description: This is an issue of a private subproject of cookbook
		84	tracker_id: 1
		85	assigned_to_id:
		86	author_id: 2
		87	status_id: 1
		88	start_date: <%= Date.today.to_s(:db) %>
		89	due_date: <%= 1.days.from_now.to_date.to_s(:db) %>
		90	No newline at end of file

test/functional/projects_controller_test.rb +23 -2

                 @controller = ProjectsController.new
                 @request    = ActionController::TestRequest.new
                 @response   = ActionController::TestResponse.new
+                @request.session[:user_id] = nil
               end
               def test_index
                 assert_not_nil assigns(:calendar)
               end
-              def test_calendar_with_subprojects
+              def test_calendar_with_subprojects_should_not_show_private_subprojects
                 get :calendar, :id => 1, :with_subprojects => 1, :tracker_ids => [1, 2]
                 assert_response :success
                 assert_template 'calendar'
                 assert_not_nil assigns(:calendar)
+                assert_no_tag :tag => 'a', :content => /#6/
+              end
+              def test_calendar_with_subprojects_should_show_private_subprojects
+                @request.session[:user_id] = 2
+                get :calendar, :id => 1, :with_subprojects => 1, :tracker_ids => [1, 2]
+                assert_response :success
+                assert_template 'calendar'
+                assert_not_nil assigns(:calendar)
+                assert_tag :tag => 'a', :content => /#6/
               end
               def test_gantt
                 assert_not_nil assigns(:events)
               end
-              def test_gantt_with_subprojects
+              def test_gantt_with_subprojects_should_not_show_private_subprojects
                 get :gantt, :id => 1, :with_subprojects => 1, :tracker_ids => [1, 2]
                 assert_response :success
                 assert_template 'gantt.rhtml'
                 assert_not_nil assigns(:events)
+                assert_no_tag :tag => 'a', :content => /#6/
               end
+              def test_gantt_with_subprojects_should_show_private_subprojects
+                @request.session[:user_id] = 2
+                get :gantt, :id => 1, :with_subprojects => 1, :tracker_ids => [1, 2]
+                assert_response :success
+                assert_template 'gantt.rhtml'
+                assert_not_nil assigns(:events)
+                assert_tag :tag => 'a', :content => /#6/
+              end
               def test_gantt_export_to_pdf
                 get :gantt, :id => 1, :format => 'pdf'
                 assert_response :success

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages