##// END OF EJS Templates
jro_apps » redmine
RSS
Child nodes should only be rendered if the user is actually authorized to see them (#15880)....
Jean-Philippe Lang -
r15011:8cbfeddeb011
parent child
Show More
Side by Side Unified
Context file:
r15011:8cbfeddeb011 Loading diff...:
Show file before | Show file after | Hide comments
@@ -114,7 +114,7 module Redmine
114 # Standard children
114 # Standard children
115 standard_children_list = "".html_safe.tap do |child_html|
115 standard_children_list = "".html_safe.tap do |child_html|
116 node.children.each do |child|
116 node.children.each do |child|
117 child_html << render_menu_node(child, project)
117 child_html << render_menu_node(child, project) if allowed_node?(child, User.current, project)
118 end
118 end
119 end
119 end
120
120
@@ -138,7 +138,7 module Redmine
138 # Tree nodes support #each so we need to do object detection
138 # Tree nodes support #each so we need to do object detection
139 if unattached_children.is_a? Array
139 if unattached_children.is_a? Array
140 unattached_children.each do |child|
140 unattached_children.each do |child|
141 child_html << content_tag(:li, render_unattached_menu_item(child, project))
141 child_html << content_tag(:li, render_unattached_menu_item(child, project)) if allowed_node?(child, User.current, project)
142 end
142 end
143 else
143 else
144 raise MenuError, ":child_menus must be an array of MenuItems"
144 raise MenuError, ":child_menus must be an array of MenuItems"
@@ -192,6 +192,7 module Redmine
192
192
193 # See MenuItem#allowed?
193 # See MenuItem#allowed?
194 def allowed_node?(node, user, project)
194 def allowed_node?(node, user, project)
195 raise MenuError, ":child_menus must be an array of MenuItems" unless node.is_a? MenuItem
195 node.allowed?(user, project)
196 node.allowed?(user, project)
196 end
197 end
197 end
198 end
Show file before | Show file after | Hide comments
@@ -119,7 +119,7 class Redmine::MenuManager::MenuHelperTest < ActionView::TestCase
119 User.current = User.find(2)
119 User.current = User.find(2)
120
120
121 parent_node = Redmine::MenuManager::MenuItem.new(:parent_node,
121 parent_node = Redmine::MenuManager::MenuItem.new(:parent_node,
122 '/test',
122 {:controller => 'issues', :action => 'index'},
123 {
123 {
124 :children => Proc.new {|p|
124 :children => Proc.new {|p|
125 children = []
125 children = []
@@ -131,7 +131,7 class Redmine::MenuManager::MenuHelperTest < ActionView::TestCase
131 })
131 })
132
132
133 parent_node << Redmine::MenuManager::MenuItem.new(:child_node,
133 parent_node << Redmine::MenuManager::MenuItem.new(:child_node,
134 '/test',
134 {:controller => 'issues', :action => 'index'},
135 {
135 {
136 :children => Proc.new {|p|
136 :children => Proc.new {|p|
137 children = []
137 children = []
@@ -163,6 +163,52 class Redmine::MenuManager::MenuHelperTest < ActionView::TestCase
163 end
163 end
164 end
164 end
165
165
166 def test_render_menu_node_with_allowed_and_unallowed_unattached_children
167 User.current = User.find(2)
168
169 parent_node = Redmine::MenuManager::MenuItem.new(:parent_node,
170 {:controller => 'issues', :action => 'index'},
171 {
172 :children => Proc.new {|p|
173 [
174 Redmine::MenuManager::MenuItem.new("test_child_allowed", {:controller => 'issues', :action => 'index'}, {}),
175 Redmine::MenuManager::MenuItem.new("test_child_unallowed", {:controller => 'issues', :action => 'unallowed'}, {}),
176 ]
177 }
178 })
179
180 @output_buffer = render_menu_node(parent_node, Project.find(1))
181
182 assert_select("li") do
183 assert_select("a.parent-node", "Parent node")
184 assert_select("ul.menu-children.unattached") do
185 assert_select("li a.test-child-allowed", "Test child allowed")
186 assert_select("li a.test-child-unallowed", false)
187 end
188 end
189 end
190
191 def test_render_menu_node_with_allowed_and_unallowed_standard_children
192 User.current = User.find(6)
193
194 Redmine::MenuManager.map :some_menu do |menu|
195 menu.push(:parent_node, {:controller => 'issues', :action => 'index'}, { })
196 menu.push(:test_child_allowed, {:controller => 'issues', :action => 'index'}, {:parent => :parent_node})
197 menu.push(:test_child_unallowed, {:controller => 'issues', :action => 'new'}, {:parent => :parent_node})
198 end
199
200 @output_buffer = render_menu(:some_menu, Project.find(1))
201
202 assert_select("li") do
203 assert_select("a.parent-node", "Parent node")
204 assert_select("ul.menu-children.unattached", false)
205 assert_select("ul.menu-children") do
206 assert_select("li a.test-child-allowed", "Test child allowed")
207 assert_select("li a.test-child-unallowed", false)
208 end
209 end
210 end
211
166 def test_render_menu_node_with_children_without_an_array
212 def test_render_menu_node_with_children_without_an_array
167 parent_node = Redmine::MenuManager::MenuItem.new(:parent_node,
213 parent_node = Redmine::MenuManager::MenuItem.new(:parent_node,
168 '/test',
214 '/test',
General Comments 0
You need to be logged in to leave comments. Login now