jro_apps/redmine Commit - r1416:7ee38a95a005

Fixed: Calendar and Gantt show private subprojects even if current user is not a member of them (#1217)....

Jean-Philippe Lang -

r1416:7ee38a95a005

parent child

Context file:

r1416:7ee38a95a005

Collapse all files

app/models/project.rb +4 -3

             # redMine - project management software
             # Copyright (C) 2006  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class Project < ActiveRecord::Base
               # Project statuses
               STATUS_ACTIVE     = 1
               STATUS_ARCHIVED   = 9
               has_many :members, :include => :user, :conditions => "#{User.table_name}.status=#{User::STATUS_ACTIVE}"
               has_many :users, :through => :members
               has_many :custom_values, :dependent => :delete_all, :as => :customized
               has_many :enabled_modules, :dependent => :delete_all
               has_and_belongs_to_many :trackers, :order => "#{Tracker.table_name}.position"
               has_many :issues, :dependent => :destroy, :order => "#{Issue.table_name}.created_on DESC", :include => [:status, :tracker]
               has_many :issue_changes, :through => :issues, :source => :journals
               has_many :versions, :dependent => :destroy, :order => "#{Version.table_name}.effective_date DESC, #{Version.table_name}.name DESC"
               has_many :time_entries, :dependent => :delete_all
               has_many :queries, :dependent => :delete_all
               has_many :documents, :dependent => :destroy
               has_many :news, :dependent => :delete_all, :include => :author
               has_many :issue_categories, :dependent => :delete_all, :order => "#{IssueCategory.table_name}.name"
               has_many :boards, :dependent => :destroy, :order => "position ASC"
               has_one :repository, :dependent => :destroy
               has_many :changesets, :through => :repository
               has_one :wiki, :dependent => :destroy
               # Custom field for the project issues
               has_and_belongs_to_many :custom_fields,
                                       :class_name => 'IssueCustomField',
                                       :order => "#{CustomField.table_name}.position",
                                       :join_table => "#{table_name_prefix}custom_fields_projects#{table_name_suffix}",
                                       :association_foreign_key => 'custom_field_id'
               acts_as_tree :order => "name", :counter_cache => true
               acts_as_searchable :columns => ['name', 'description'], :project_key => 'id'
               acts_as_event :title => Proc.new {|o| "#{l(:label_project)}: #{o.name}"},
                             :url => Proc.new {|o| {:controller => 'projects', :action => 'show', :id => o.id}}
               attr_protected :status, :enabled_module_names
               validates_presence_of :name, :identifier
               validates_uniqueness_of :name, :identifier
               validates_associated :custom_values, :on => :update
               validates_associated :repository, :wiki
               validates_length_of :name, :maximum => 30
               validates_length_of :homepage, :maximum => 60
               validates_length_of :identifier, :in => 3..20
               validates_format_of :identifier, :with => /^[a-z0-9\-]*$/
               before_destroy :delete_all_members
               def identifier=(identifier)
                 super unless identifier_frozen?
               end
               def identifier_frozen?
                 errors[:identifier].nil? && !(new_record? || identifier.blank?)
               end
               def issues_with_subprojects(include_subprojects=false)
                 conditions = nil
-                if include_subprojects && !active_children.empty?
+                if include_subprojects
-                  ids = [id] + active_children.collect {|c| c.id}
+                  ids = [id] + child_ids
-                  conditions = ["#{Project.table_name}.id IN (#{ids.join(',')})"]
+                  conditions = ["#{Project.table_name}.id IN (#{ids.join(',')}) AND #{Project.visible_by}"]
                 end
                 conditions ||= ["#{Project.table_name}.id = ?", id]
                 # Quick and dirty fix for Rails 2 compatibility
                 Issue.send(:with_scope, :find => { :conditions => conditions }) do
                   Version.send(:with_scope, :find => { :conditions => conditions }) do
                     yield
                   end
                 end
               end
               # returns latest created projects
               # non public projects will be returned only if user is a member of those
               def self.latest(user=nil, count=5)
                 find(:all, :limit => count, :conditions => visible_by(user), :order => "created_on DESC")
               end
               def self.visible_by(user=nil)
+                user ||= User.current
                 if user && user.admin?
                   return "#{Project.table_name}.status=#{Project::STATUS_ACTIVE}"
                 elsif user && user.memberships.any?
                   return "#{Project.table_name}.status=#{Project::STATUS_ACTIVE} AND (#{Project.table_name}.is_public = #{connection.quoted_true} or #{Project.table_name}.id IN (#{user.memberships.collect{|m| m.project_id}.join(',')}))"
                 else
                   return "#{Project.table_name}.status=#{Project::STATUS_ACTIVE} AND #{Project.table_name}.is_public = #{connection.quoted_true}"
                 end
               end
               def self.allowed_to_condition(user, permission, options={})
                 statements = []
                 base_statement = "#{Project.table_name}.status=#{Project::STATUS_ACTIVE}"
                 if options[:project]
                   project_statement = "#{Project.table_name}.id = #{options[:project].id}"
                   project_statement << " OR #{Project.table_name}.parent_id = #{options[:project].id}" if options[:with_subprojects]
                   base_statement = "(#{project_statement}) AND (#{base_statement})"
                 end
                 if user.admin?
                   # no restriction
                 elsif user.logged?
                   statements << "#{Project.table_name}.is_public = #{connection.quoted_true}" if Role.non_member.allowed_to?(permission)
                   allowed_project_ids = user.memberships.select {|m| m.role.allowed_to?(permission)}.collect {|m| m.project_id}
                   statements << "#{Project.table_name}.id IN (#{allowed_project_ids.join(',')})" if allowed_project_ids.any?
                 elsif Role.anonymous.allowed_to?(permission)
                   # anonymous user allowed on public project
                   statements << "#{Project.table_name}.is_public = #{connection.quoted_true}"
                 else
                   # anonymous user is not authorized
                   statements << "1=0"
                 end
                 statements.empty? ? base_statement : "((#{base_statement}) AND (#{statements.join(' OR ')}))"
               end
               def project_condition(with_subprojects)
                 cond = "#{Project.table_name}.id = #{id}"
                 cond = "(#{cond} OR #{Project.table_name}.parent_id = #{id})" if with_subprojects
                 cond
               end
               def self.find(*args)
                 if args.first && args.first.is_a?(String) && !args.first.match(/^\d*$/)
                   project = find_by_identifier(*args)
                   raise ActiveRecord::RecordNotFound, "Couldn't find Project with identifier=#{args.first}" if project.nil?
                   project
                 else
                   super
                 end
               end
               def to_param
                 identifier
               end
               def active?
                 self.status == STATUS_ACTIVE
               end
               def archive
                 # Archive subprojects if any
                 children.each do |subproject|
                   subproject.archive
                 end
                 update_attribute :status, STATUS_ARCHIVED
               end
               def unarchive
                 return false if parent && !parent.active?
                 update_attribute :status, STATUS_ACTIVE
               end
               def active_children
                 children.select {|child| child.active?}
               end
               # Returns an array of the trackers used by the project and its sub projects
               def rolled_up_trackers
                 @rolled_up_trackers ||=
                   Tracker.find(:all, :include => :projects,
                                      :select => "DISTINCT #{Tracker.table_name}.*",
                                      :conditions => ["#{Project.table_name}.id = ? OR #{Project.table_name}.parent_id = ?", id, id],
                                      :order => "#{Tracker.table_name}.position")
               end
               # Deletes all project's members
               def delete_all_members
                 Member.delete_all(['project_id = ?', id])
               end
               # Users issues can be assigned to
               def assignable_users
                 members.select {|m| m.role.assignable?}.collect {|m| m.user}.sort
               end
               # Returns the mail adresses of users that should be always notified on project events
               def recipients
                 members.select {|m| m.mail_notification? || m.user.mail_notification?}.collect {|m| m.user.mail}
               end
               # Returns an array of all custom fields enabled for project issues
               # (explictly associated custom fields and custom fields enabled for all projects)
               def custom_fields_for_issues(tracker)
                 all_custom_fields.select {|c| tracker.custom_fields.include? c }
               end
               def all_custom_fields
                 @all_custom_fields ||= (IssueCustomField.for_all + custom_fields).uniq
               end
               def <=>(project)
                 name.downcase <=> project.name.downcase
               end
               def to_s
                 name
               end
               # Returns a short description of the projects (first lines)
               def short_description(length = 255)
                 description.gsub(/^(.{#{length}}[^\n]*).*$/m, '\1').strip if description
               end
               def allows_to?(action)
                 if action.is_a? Hash
                   allowed_actions.include? "#{action[:controller]}/#{action[:action]}"
                 else
                   allowed_permissions.include? action
                 end
               end
               def module_enabled?(module_name)
                 module_name = module_name.to_s
                 enabled_modules.detect {|m| m.name == module_name}
               end
               def enabled_module_names=(module_names)
                 enabled_modules.clear
                 module_names = [] unless module_names && module_names.is_a?(Array)
                 module_names.each do |name|
                   enabled_modules << EnabledModule.new(:name => name.to_s)
                 end
               end
             protected
               def validate
                 errors.add(parent_id, " must be a root project") if parent and parent.parent
                 errors.add_to_base("A project with subprojects can't be a subproject") if parent and children.size > 0
                 errors.add(:identifier, :activerecord_error_invalid) if !identifier.blank? && identifier.match(/^\d*$/)
               end
             private
               def allowed_permissions
                 @allowed_permissions ||= begin
                   module_names = enabled_modules.collect {|m| m.name}
                   Redmine::AccessControl.modules_permissions(module_names).collect {|p| p.name}
                 end
               end
               def allowed_actions
                 @actions_allowed ||= allowed_permissions.inject([]) { |actions, permission| actions += Redmine::AccessControl.allowed_actions(permission) }.flatten
               end
             end

test/fixtures/issues.yml +17 -1

             ---
             issues_001:
               created_on: <%= 3.days.ago.to_date.to_s(:db) %>
               project_id: 1
               updated_on: <%= 1.day.ago.to_date.to_s(:db) %>
               priority_id: 4
               subject: Can't print recipes
               id: 1
               fixed_version_id:
               category_id: 1
               description: Unable to print recipes
               tracker_id: 1
               assigned_to_id:
               author_id: 2
               status_id: 1
             issues_002:
               created_on: 2006-07-19 21:04:21 +02:00
               project_id: 1
               updated_on: 2006-07-19 21:09:50 +02:00
               priority_id: 5
               subject: Add ingredients categories
               id: 2
               fixed_version_id:
               category_id:
               description: Ingredients of the recipe should be classified by categories
               tracker_id: 2
               assigned_to_id: 3
               author_id: 2
               status_id: 2
             issues_003:
               created_on: 2006-07-19 21:07:27 +02:00
               project_id: 1
               updated_on: 2006-07-19 21:07:27 +02:00
               priority_id: 4
               subject: Error 281 when updating a recipe
               id: 3
               fixed_version_id:
               category_id:
               description: Error 281 is encountered when saving a recipe
               tracker_id: 1
               assigned_to_id:
               author_id: 2
               status_id: 1
               start_date: <%= 1.day.from_now.to_date.to_s(:db) %>
               due_date: <%= 40.day.ago.to_date.to_s(:db) %>
             issues_004:
               created_on: <%= 5.days.ago.to_date.to_s(:db) %>
               project_id: 2
               updated_on: <%= 2.days.ago.to_date.to_s(:db) %>
               priority_id: 4
               subject: Issue on project 2
               id: 4
               fixed_version_id:
               category_id:
               description: Issue on project 2
               tracker_id: 1
               assigned_to_id:
               author_id: 2
               status_id: 1
             issues_005:
               created_on: <%= 5.days.ago.to_date.to_s(:db) %>
               project_id: 3
               updated_on: <%= 2.days.ago.to_date.to_s(:db) %>
               priority_id: 4
               subject: Subproject issue
               id: 5
               fixed_version_id:
               category_id:
               description: This is an issue on a cookbook subproject
               tracker_id: 1
               assigned_to_id:
               author_id: 2
               status_id: 1
+            issues_006:
+              created_on: <%= 1.minute.ago.to_date.to_s(:db) %>
+              project_id: 5
+              updated_on: <%= 1.minute.ago.to_date.to_s(:db) %>
+              priority_id: 4
+              subject: Issue of a private subproject
+              id: 6
+              fixed_version_id:
+              category_id:
+              description: This is an issue of a private subproject of cookbook
+              tracker_id: 1
+              assigned_to_id:
+              author_id: 2
+              status_id: 1
+              start_date: <%= Date.today.to_s(:db) %>
+              due_date: <%= 1.days.from_now.to_date.to_s(:db) %>
+  No newline at end of file

test/functional/projects_controller_test.rb +23 -2

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.dirname(__FILE__) + '/../test_helper'
             require 'projects_controller'
             # Re-raise errors caught by the controller.
             class ProjectsController; def rescue_action(e) raise e end; end
             class ProjectsControllerTest < Test::Unit::TestCase
               fixtures :projects, :versions, :users, :roles, :members, :issues, :journals, :journal_details,
                        :trackers, :projects_trackers, :issue_statuses, :enabled_modules, :enumerations, :boards, :messages
               def setup
                 @controller = ProjectsController.new
                 @request    = ActionController::TestRequest.new
                 @response   = ActionController::TestResponse.new
+                @request.session[:user_id] = nil
               end
               def test_index
                 get :index
                 assert_response :success
                 assert_template 'list'
               end
               def test_list
                 get :list
                 assert_response :success
                 assert_template 'list'
                 assert_not_nil assigns(:project_tree)
                 # Root project as hash key
                 assert assigns(:project_tree).has_key?(Project.find(1))
                 # Subproject in corresponding value
                 assert assigns(:project_tree)[Project.find(1)].include?(Project.find(3))
               end
               def test_show_by_id
                 get :show, :id => 1
                 assert_response :success
                 assert_template 'show'
                 assert_not_nil assigns(:project)
               end
               def test_show_by_identifier
                 get :show, :id => 'ecookbook'
                 assert_response :success
                 assert_template 'show'
                 assert_not_nil assigns(:project)
                 assert_equal Project.find_by_identifier('ecookbook'), assigns(:project)
               end
               def test_private_subprojects_hidden
                 get :show, :id => 'ecookbook'
                 assert_response :success
                 assert_template 'show'
                 assert_no_tag :tag => 'a', :content => /Private child/
               end
               def test_private_subprojects_visible
                 @request.session[:user_id] = 2 # manager who is a member of the private subproject
                 get :show, :id => 'ecookbook'
                 assert_response :success
                 assert_template 'show'
                 assert_tag :tag => 'a', :content => /Private child/
               end
               def test_settings
                 @request.session[:user_id] = 2 # manager
                 get :settings, :id => 1
                 assert_response :success
                 assert_template 'settings'
               end
               def test_edit
                 @request.session[:user_id] = 2 # manager
                 post :edit, :id => 1, :project => {:name => 'Test changed name',
                                                    :custom_field_ids => ['']}
                 assert_redirected_to 'projects/settings/ecookbook'
                 project = Project.find(1)
                 assert_equal 'Test changed name', project.name
               end
               def test_get_destroy
                 @request.session[:user_id] = 1 # admin
                 get :destroy, :id => 1
                 assert_response :success
                 assert_template 'destroy'
                 assert_not_nil Project.find_by_id(1)
               end
               def test_post_destroy
                 @request.session[:user_id] = 1 # admin
                 post :destroy, :id => 1, :confirm => 1
                 assert_redirected_to 'admin/projects'
                 assert_nil Project.find_by_id(1)
               end
               def test_list_files
                 get :list_files, :id => 1
                 assert_response :success
                 assert_template 'list_files'
                 assert_not_nil assigns(:versions)
               end
               def test_changelog
                 get :changelog, :id => 1
                 assert_response :success
                 assert_template 'changelog'
                 assert_not_nil assigns(:versions)
               end
               def test_roadmap
                 get :roadmap, :id => 1
                 assert_response :success
                 assert_template 'roadmap'
                 assert_not_nil assigns(:versions)
                 # Version with no date set appears
                 assert assigns(:versions).include?(Version.find(3))
                 # Completed version doesn't appear
                 assert !assigns(:versions).include?(Version.find(1))
               end
               def test_roadmap_with_completed_versions
                 get :roadmap, :id => 1, :completed => 1
                 assert_response :success
                 assert_template 'roadmap'
                 assert_not_nil assigns(:versions)
                 # Version with no date set appears
                 assert assigns(:versions).include?(Version.find(3))
                 # Completed version appears
                 assert assigns(:versions).include?(Version.find(1))
               end
               def test_project_activity
                 get :activity, :id => 1, :with_subprojects => 0
                 assert_response :success
                 assert_template 'activity'
                 assert_not_nil assigns(:events_by_day)
                 assert_not_nil assigns(:events)
                 # subproject issue not included by default
                 assert !assigns(:events).include?(Issue.find(5))
                 assert_tag :tag => "h3",
                            :content => /#{2.days.ago.to_date.day}/,
                            :sibling => { :tag => "dl",
                              :child => { :tag => "dt",
                                :attributes => { :class => 'issue-edit' },
                                :child => { :tag => "a",
                                  :content => /(#{IssueStatus.find(2).name})/,
                                }
                              }
                            }
                 get :activity, :id => 1, :from => 3.days.ago.to_date
                 assert_response :success
                 assert_template 'activity'
                 assert_not_nil assigns(:events_by_day)
                 assert_tag :tag => "h3",
                            :content => /#{3.day.ago.to_date.day}/,
                            :sibling => { :tag => "dl",
                              :child => { :tag => "dt",
                                :attributes => { :class => 'issue' },
                                :child => { :tag => "a",
                                  :content => /#{Issue.find(1).subject}/,
                                }
                              }
                            }
               end
               def test_activity_with_subprojects
                 get :activity, :id => 1, :with_subprojects => 1
                 assert_response :success
                 assert_template 'activity'
                 assert_not_nil assigns(:events)
                 assert assigns(:events).include?(Issue.find(1))
                 assert !assigns(:events).include?(Issue.find(4))
                 # subproject issue
                 assert assigns(:events).include?(Issue.find(5))
               end
               def test_global_activity_anonymous
                 get :activity
                 assert_response :success
                 assert_template 'activity'
                 assert_not_nil assigns(:events)
                 assert assigns(:events).include?(Issue.find(1))
                 # Issue of a private project
                 assert !assigns(:events).include?(Issue.find(4))
               end
               def test_global_activity_logged_user
                 @request.session[:user_id] = 2 # manager
                 get :activity
                 assert_response :success
                 assert_template 'activity'
                 assert_not_nil assigns(:events)
                 assert assigns(:events).include?(Issue.find(1))
                 # Issue of a private project the user belongs to
                 assert assigns(:events).include?(Issue.find(4))
               end
               def test_global_activity_with_all_types
                 get :activity, :show_issues => 1, :show_news => 1, :show_files => 1, :show_documents => 1, :show_changesets => 1, :show_wiki_pages => 1, :show_messages => 1
                 assert_response :success
                 assert_template 'activity'
                 assert_not_nil assigns(:events)
                 assert assigns(:events).include?(Issue.find(1))
                 assert !assigns(:events).include?(Issue.find(4))
                 assert assigns(:events).include?(Message.find(5))
               end
               def test_calendar
                 get :calendar, :id => 1
                 assert_response :success
                 assert_template 'calendar'
                 assert_not_nil assigns(:calendar)
               end
-              def test_calendar_with_subprojects
+              def test_calendar_with_subprojects_should_not_show_private_subprojects
                 get :calendar, :id => 1, :with_subprojects => 1, :tracker_ids => [1, 2]
                 assert_response :success
                 assert_template 'calendar'
                 assert_not_nil assigns(:calendar)
+                assert_no_tag :tag => 'a', :content => /#6/
+              end
+              def test_calendar_with_subprojects_should_show_private_subprojects
+                @request.session[:user_id] = 2
+                get :calendar, :id => 1, :with_subprojects => 1, :tracker_ids => [1, 2]
+                assert_response :success
+                assert_template 'calendar'
+                assert_not_nil assigns(:calendar)
+                assert_tag :tag => 'a', :content => /#6/
               end
               def test_gantt
                 get :gantt, :id => 1
                 assert_response :success
                 assert_template 'gantt.rhtml'
                 assert_not_nil assigns(:events)
               end
-              def test_gantt_with_subprojects
+              def test_gantt_with_subprojects_should_not_show_private_subprojects
                 get :gantt, :id => 1, :with_subprojects => 1, :tracker_ids => [1, 2]
                 assert_response :success
                 assert_template 'gantt.rhtml'
                 assert_not_nil assigns(:events)
+                assert_no_tag :tag => 'a', :content => /#6/
               end
+              def test_gantt_with_subprojects_should_show_private_subprojects
+                @request.session[:user_id] = 2
+                get :gantt, :id => 1, :with_subprojects => 1, :tracker_ids => [1, 2]
+                assert_response :success
+                assert_template 'gantt.rhtml'
+                assert_not_nil assigns(:events)
+                assert_tag :tag => 'a', :content => /#6/
+              end
               def test_gantt_export_to_pdf
                 get :gantt, :id => 1, :format => 'pdf'
                 assert_response :success
                 assert_template 'gantt.rfpdf'
                 assert_equal 'application/pdf', @response.content_type
                 assert_not_nil assigns(:events)
               end
               def test_archive
                 @request.session[:user_id] = 1 # admin
                 post :archive, :id => 1
                 assert_redirected_to 'admin/projects'
                 assert !Project.find(1).active?
               end
               def test_unarchive
                 @request.session[:user_id] = 1 # admin
                 Project.find(1).archive
                 post :unarchive, :id => 1
                 assert_redirected_to 'admin/projects'
                 assert Project.find(1).active?
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages