jro_apps/redmine Commit - r15204:83777f727a42

Assignable users should not include users that cannot view the tracker (#23172)....

Jean-Philippe Lang -

r15204:83777f727a42

parent child

Context file:

r15204:83777f727a42

app/controllers/context_menus_controller.rb +2 -10

                          :add_watchers => User.current.allowed_to?(:add_issue_watchers, @projects),
                          :delete => @issues.all?(&:deletable?)
                          }
-                 if @project
-                   if @issue
-                     @assignables = @issue.assignable_users
-                   else
-                     @assignables = @project.assignable_users
-                   end
-                 else
-                   #when multiple projects, we only keep the intersection of each set
-                   @assignables = @projects.map(&:assignable_users).reduce(:&)
-                 end
+                 @assignables = @issues.map(&:assignable_users).reduce(:&)
                  @trackers = @projects.map {|p| Issue.allowed_target_trackers(p) }.reduce(:&)
                  @versions = @projects.map {|p| p.shared_versions.open}.reduce(:&)

app/models/issue.rb +1 -1

                # Users the issue can be assigned to
                def assignable_users
-                 users = project.assignable_users.to_a
+                 users = project.assignable_users(tracker).to_a
                  users << author if author && author.active?
                  users << assigned_to if assigned_to
                  users.uniq.sort

app/models/project.rb +13 -2

                end
                # Return a Principal scope of users/groups issues can be assigned to
-               def assignable_users
+               def assignable_users(tracker=nil)
+                 return @assignable_users[tracker] if @assignable_users && @assignable_users[tracker]
                  types = ['User']
                  types << 'Group' if Setting.issue_group_assignment?
-                 @assignable_users ||= Principal.
+                 scope = Principal.
                    active.
                    joins(:members => :roles).
                    where(:type => types, :members => {:project_id => id}, :roles => {:assignable => true}).
                    uniq.
                    sorted
+                 if tracker
+                   # Rejects users that cannot the view the tracker
+                   roles = Role.where(:assignable => true).select {|role| role.permissions_tracker?(:view_issues, tracker)}
+                   scope = scope.where(:roles => {:id => roles.map(&:id)})
+                 end
+                 @assignable_users ||= {}
+                 @assignable_users[tracker] = scope
                end
                # Returns the mail addresses of users that should be always notified on project events

app/models/role.rb +7 0

                  permissions_all_trackers[permission.to_s].to_s != '0'
                end
+               # Returns true if permission is given for the tracker
+               # (explicitly or for all trackers)
+               def permissions_tracker?(permission, tracker)
+                 permissions_all_trackers?(permission) ||
+                   permissions_tracker_ids?(permission, tracker.try(:id))
+               end
                # Sets the trackers that are allowed for a permission.
                # tracker_ids can be an array of tracker ids or :all for
                # no restrictions.

test/unit/issue_test.rb +13 0

                  end
                end
+               def test_assignable_users_should_not_include_users_that_cannot_view_the_tracker
+                 user = User.find(3)
+                 role = Role.find(2)
+                 role.set_permission_trackers :view_issues, [1, 3]
+                 role.save!
+                 issue1 = Issue.new(:project_id => 1, :tracker_id => 1)
+                 issue2 = Issue.new(:project_id => 1, :tracker_id => 2)
+                 assert_include user, issue1.assignable_users
+                 assert_not_include user, issue2.assignable_users
+               end
                def test_create_should_send_email_notification
                  ActionMailer::Base.deliveries.clear
                  issue = Issue.new(:project_id => 1, :tracker_id => 1,

General Comments 0

You need to be logged in to leave comments. Login now

No TODOs yet

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages