jro_apps/redmine Commit - r15204:83777f727a42

Assignable users should not include users that cannot view the tracker (#23172)....

Jean-Philippe Lang -

r15204:83777f727a42

parent child

Context file:

r15204:83777f727a42

app/controllers/context_menus_controller.rb +2 -10

@@ -35,16 +35,8 class ContextMenusController < ApplicationController
35	:add_watchers => User.current.allowed_to?(:add_issue_watchers, @projects),	35	:add_watchers => User.current.allowed_to?(:add_issue_watchers, @projects),
36	:delete => @issues.all?(&:deletable?)	36	:delete => @issues.all?(&:deletable?)
37	}	37	}
38	if @project	38
39	if @issue	39	@assignables = @issues.map(&:assignable_users).reduce(:&)
40	@assignables = @issue.assignable_users
41	else
42	@assignables = @project.assignable_users
43	end
44	else
45	#when multiple projects, we only keep the intersection of each set
46	@assignables = @projects.map(&:assignable_users).reduce(:&)
47	end
48	@trackers = @projects.map {\|p\| Issue.allowed_target_trackers(p) }.reduce(:&)	40	@trackers = @projects.map {\|p\| Issue.allowed_target_trackers(p) }.reduce(:&)
49	@versions = @projects.map {\|p\| p.shared_versions.open}.reduce(:&)	41	@versions = @projects.map {\|p\| p.shared_versions.open}.reduce(:&)
50		42

app/models/issue.rb +1 -1

               # Users the issue can be assigned to
               def assignable_users
-                users = project.assignable_users.to_a
+                users = project.assignable_users(tracker).to_a
                 users << author if author && author.active?
                 users << assigned_to if assigned_to
                 users.uniq.sort

app/models/project.rb +13 -2

               end
               # Return a Principal scope of users/groups issues can be assigned to
-              def assignable_users
+              def assignable_users(tracker=nil)
+                return @assignable_users[tracker] if @assignable_users && @assignable_users[tracker]
                 types = ['User']
                 types << 'Group' if Setting.issue_group_assignment?
-                @assignable_users ||= Principal.
+                scope = Principal.
                   active.
                   joins(:members => :roles).
                   where(:type => types, :members => {:project_id => id}, :roles => {:assignable => true}).
                   uniq.
                   sorted
+                if tracker
+                  # Rejects users that cannot the view the tracker
+                  roles = Role.where(:assignable => true).select {|role| role.permissions_tracker?(:view_issues, tracker)}
+                  scope = scope.where(:roles => {:id => roles.map(&:id)})
+                end
+                @assignable_users ||= {}
+                @assignable_users[tracker] = scope
               end
               # Returns the mail addresses of users that should be always notified on project events

app/models/role.rb +7 0

                 permissions_all_trackers[permission.to_s].to_s != '0'
               end
+              # Returns true if permission is given for the tracker
+              # (explicitly or for all trackers)
+              def permissions_tracker?(permission, tracker)
+                permissions_all_trackers?(permission) ||
+                  permissions_tracker_ids?(permission, tracker.try(:id))
+              end
               # Sets the trackers that are allowed for a permission.
               # tracker_ids can be an array of tracker ids or :all for
               # no restrictions.

test/unit/issue_test.rb +13 0

@@ -2292,6 +2292,19 class IssueTest < ActiveSupport::TestCase
2292	end	2292	end
2293	end	2293	end
2294		2294
		2295	def test_assignable_users_should_not_include_users_that_cannot_view_the_tracker
		2296	user = User.find(3)
		2297	role = Role.find(2)
		2298	role.set_permission_trackers :view_issues, [1, 3]
		2299	role.save!
		2300
		2301	issue1 = Issue.new(:project_id => 1, :tracker_id => 1)
		2302	issue2 = Issue.new(:project_id => 1, :tracker_id => 2)
		2303
		2304	assert_include user, issue1.assignable_users
		2305	assert_not_include user, issue2.assignable_users
		2306	end
		2307
2295	def test_create_should_send_email_notification	2308	def test_create_should_send_email_notification
2296	ActionMailer::Base.deliveries.clear	2309	ActionMailer::Base.deliveries.clear
2297	issue = Issue.new(:project_id => 1, :tracker_id => 1,	2310	issue = Issue.new(:project_id => 1, :tracker_id => 1,

General Comments 0

You need to be logged in to leave comments. Login now

No TODOs yet

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages