jro_apps/redmine Commit - r4421:93847ae33740

Fixes a data disclosure issue introduced in r3941....

Jean-Philippe Lang -

r4421:93847ae33740

parent child

Context file:

r4421:93847ae33740

Collapse all files

app/controllers/journals_controller.rb +1 0

             # redMine - project management software
             # Copyright (C) 2006-2008  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class JournalsController < ApplicationController
               before_filter :find_journal, :only => [:edit]
               before_filter :find_issue, :only => [:new]
               before_filter :find_optional_project, :only => [:index]
+              before_filter :authorize, :only => [:new, :edit]
               accept_key_auth :index
               helper :issues
               helper :queries
               include QueriesHelper
               helper :sort
               include SortHelper
               def index
                 retrieve_query
                 sort_init 'id', 'desc'
                 sort_update(@query.sortable_columns)
                 if @query.valid?
                   @journals = @query.journals(:order => "#{Journal.table_name}.created_on DESC",
                                               :limit => 25)
                 end
                 @title = (@project ? @project.name : Setting.app_title) + ": " + (@query.new_record? ? l(:label_changes_details) : @query.name)
                 render :layout => false, :content_type => 'application/atom+xml'
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               def new
                 journal = Journal.find(params[:journal_id]) if params[:journal_id]
                 if journal
                   user = journal.user
                   text = journal.notes
                 else
                   user = @issue.author
                   text = @issue.description
                 end
                 # Replaces pre blocks with [...]
                 text = text.to_s.strip.gsub(%r{<pre>((.|\s)*?)</pre>}m, '[...]')
                 content = "#{ll(Setting.default_language, :text_user_wrote, user)}\n> "
                 content << text.gsub(/(\r?\n|\r\n?)/, "\n> ") + "\n\n"
                 render(:update) { |page|
                   page.<< "$('notes').value = \"#{escape_javascript content}\";"
                   page.show 'update'
                   page << "Form.Element.focus('notes');"
                   page << "Element.scrollTo('update');"
                   page << "$('notes').scrollTop = $('notes').scrollHeight - $('notes').clientHeight;"
                 }
               end
               def edit
                 if request.post?
                   @journal.update_attributes(:notes => params[:notes]) if params[:notes]
                   @journal.destroy if @journal.details.empty? && @journal.notes.blank?
                   call_hook(:controller_journals_edit_post, { :journal => @journal, :params => params})
                   respond_to do |format|
                     format.html { redirect_to :controller => 'issues', :action => 'show', :id => @journal.journalized_id }
                     format.js { render :action => 'update' }
                   end
                 end
               end
             private
               def find_journal
                 @journal = Journal.find(params[:id])
                 (render_403; return false) unless @journal.editable_by?(User.current)
                 @project = @journal.journalized.project
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               # TODO: duplicated in IssuesController
               def find_issue
                 @issue = Issue.find(params[:id], :include => [:project, :tracker, :status, :author, :priority, :category])
                 @project = @issue.project
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
             end

test/functional/journals_controller_test.rb +8 -2

             # redMine - project management software
             # Copyright (C) 2006-2008  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.expand_path('../../test_helper', __FILE__)
             require 'journals_controller'
             # Re-raise errors caught by the controller.
             class JournalsController; def rescue_action(e) raise e end; end
             class JournalsControllerTest < ActionController::TestCase
               fixtures :projects, :users, :members, :member_roles, :roles, :issues, :journals, :journal_details, :enabled_modules
               def setup
                 @controller = JournalsController.new
                 @request    = ActionController::TestRequest.new
                 @response   = ActionController::TestResponse.new
                 User.current = nil
               end
               def test_index
                 get :index, :project_id => 1
                 assert_response :success
                 assert_not_nil assigns(:journals)
                 assert_equal 'application/atom+xml', @response.content_type
               end
               def test_reply_to_issue
                 @request.session[:user_id] = 2
-                get :new, :id => 1
+                get :new, :id => 6
                 assert_response :success
                 assert_select_rjs :show, "update"
               end
+              def test_reply_to_issue_without_permission
+                @request.session[:user_id] = 7
+                get :new, :id => 6
+                assert_response 403
+              end
               def test_reply_to_note
                 @request.session[:user_id] = 2
-                get :new, :id => 1, :journal_id => 2
+                get :new, :id => 6, :journal_id => 4
                 assert_response :success
                 assert_select_rjs :show, "update"
               end
               def test_get_edit
                 @request.session[:user_id] = 1
                 xhr :get, :edit, :id => 2
                 assert_response :success
                 assert_select_rjs :insert, :after, 'journal-2-notes' do
                   assert_select 'form[id=journal-2-form]'
                   assert_select 'textarea'
                 end
               end
               def test_post_edit
                 @request.session[:user_id] = 1
                 xhr :post, :edit, :id => 2, :notes => 'Updated notes'
                 assert_response :success
                 assert_select_rjs :replace, 'journal-2-notes'
                 assert_equal 'Updated notes', Journal.find(2).notes
               end
               def test_post_edit_with_empty_notes
                 @request.session[:user_id] = 1
                 xhr :post, :edit, :id => 2, :notes => ''
                 assert_response :success
                 assert_select_rjs :remove, 'change-2'
                 assert_nil Journal.find_by_id(2)
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages