jro_apps/redmine Commit - r15011:8cbfeddeb011

Child nodes should only be rendered if the user is actually authorized to see them (#15880)....

Jean-Philippe Lang -

r15011:8cbfeddeb011

parent child

Context file:

r15011:8cbfeddeb011

Collapse all files

lib/redmine/menu_manager.rb +3 -2

                        # Standard children
                        standard_children_list = "".html_safe.tap do |child_html|
                          node.children.each do |child|
-                           child_html << render_menu_node(child, project)
+                           child_html << render_menu_node(child, project) if allowed_node?(child, User.current, project)
                          end
                        end
                        # Tree nodes support #each so we need to do object detection
                        if unattached_children.is_a? Array
                          unattached_children.each do |child|
-                           child_html << content_tag(:li, render_unattached_menu_item(child, project))
+                           child_html << content_tag(:li, render_unattached_menu_item(child, project)) if allowed_node?(child, User.current, project)
                          end
                        else
                          raise MenuError, ":child_menus must be an array of MenuItems"
                    # See MenuItem#allowed?
                    def allowed_node?(node, user, project)
+                     raise MenuError, ":child_menus must be an array of MenuItems" unless node.is_a? MenuItem
                      node.allowed?(user, project)
                    end
                  end

test/unit/lib/redmine/menu_manager/menu_helper_test.rb +48 -2

                  User.current = User.find(2)
                  parent_node = Redmine::MenuManager::MenuItem.new(:parent_node,
-                                                                  '/test',
+                                                                  {:controller => 'issues', :action => 'index'},
                                                                   {
                                                                     :children => Proc.new {|p|
                                                                       children = []
                                                                   })
                  parent_node << Redmine::MenuManager::MenuItem.new(:child_node,
-                                                                  '/test',
+                                                                  {:controller => 'issues', :action => 'index'},
                                                                   {
                                                                     :children => Proc.new {|p|
                                                                       children = []
                  end
                end
+               def test_render_menu_node_with_allowed_and_unallowed_unattached_children
+                 User.current = User.find(2)
+                 parent_node = Redmine::MenuManager::MenuItem.new(:parent_node,
+                                                                  {:controller => 'issues', :action => 'index'},
+                                                                  {
+                                                                    :children => Proc.new {|p|
+                                                                      [
+                                                                        Redmine::MenuManager::MenuItem.new("test_child_allowed", {:controller => 'issues', :action => 'index'}, {}),
+                                                                        Redmine::MenuManager::MenuItem.new("test_child_unallowed", {:controller => 'issues', :action => 'unallowed'}, {}),
+                                                                      ]
+                                                                    }
+                                                                  })
+                 @output_buffer = render_menu_node(parent_node, Project.find(1))
+                 assert_select("li") do
+                   assert_select("a.parent-node", "Parent node")
+                   assert_select("ul.menu-children.unattached") do
+                     assert_select("li a.test-child-allowed", "Test child allowed")
+                     assert_select("li a.test-child-unallowed", false)
+                   end
+                 end
+               end
+               def test_render_menu_node_with_allowed_and_unallowed_standard_children
+                 User.current = User.find(6)
+                 Redmine::MenuManager.map :some_menu do |menu|
+                   menu.push(:parent_node, {:controller => 'issues', :action => 'index'}, { })
+                   menu.push(:test_child_allowed, {:controller => 'issues', :action => 'index'}, {:parent => :parent_node})
+                   menu.push(:test_child_unallowed, {:controller => 'issues', :action => 'new'}, {:parent => :parent_node})
+                 end
+                 @output_buffer = render_menu(:some_menu, Project.find(1))
+                 assert_select("li") do
+                   assert_select("a.parent-node", "Parent node")
+                   assert_select("ul.menu-children.unattached", false)
+                   assert_select("ul.menu-children") do
+                     assert_select("li a.test-child-allowed", "Test child allowed")
+                     assert_select("li a.test-child-unallowed", false)
+                   end
+                 end
+               end
                def test_render_menu_node_with_children_without_an_array
                  parent_node = Redmine::MenuManager::MenuItem.new(:parent_node,
                                                                   '/test',

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages