jro_apps/redmine Commit - r1235:993b60d61eb9

Adds 2 permissions (closes #859):...

Jean-Philippe Lang -

r1235:993b60d61eb9

parent child

Context file:

r1235:993b60d61eb9

Collapse all files

app/controllers/timelog_controller.rb +14 -2

               menu_item :issues
               before_filter :find_project, :authorize
+              verify :method => :post, :only => :destroy, :redirect_to => { :action => :details }
               helper :sort
               include SortHelper
               helper :issues
               end
               def edit
-                render_404 and return if @time_entry && @time_entry.user != User.current
+                render_403 and return if @time_entry && !@time_entry.editable_by?(User.current)
                 @time_entry ||= TimeEntry.new(:project => @project, :issue => @issue, :user => User.current, :spent_on => Date.today)
                 @time_entry.attributes = params[:time_entry]
                 if request.post? and @time_entry.save
                   flash[:notice] = l(:notice_successful_update)
-                  redirect_to :action => 'details', :project_id => @time_entry.project, :issue_id => @time_entry.issue
+                  redirect_to :action => 'details', :project_id => @time_entry.project
                   return
                 end
                 @activities = Enumeration::get_values('ACTI')
               end
+              def destroy
+                render_404 and return unless @time_entry
+                render_403 and return unless @time_entry.editable_by?(User.current)
+                @time_entry.destroy
+                flash[:notice] = l(:notice_successful_delete)
+                redirect_to :action => 'details', :project_id => @time_entry.project
+              end
             private
               def find_project
                   render_404
                   return false
                 end
+              rescue ActiveRecord::RecordNotFound
+                render_404
               end
             end

app/models/time_entry.rb +1 -1

               # Returns true if the time entry can be edited by usr, otherwise false
               def editable_by?(usr)
-                usr == self.user
+                (usr == user && usr.allowed_to?(:edit_own_time_entries, project)) || usr.allowed_to?(:edit_time_entries, project)
               end
               def self.visible_by(usr)

app/views/issues/show.rhtml +1 -1

                 <td><b><%=l(:field_category)%> :</b></td><td><%=h @issue.category ? @issue.category.name : "-" %></td>
                 <% if User.current.allowed_to?(:view_time_entries, @project) %>
                 <td><b><%=l(:label_spent_time)%> :</b></td>
-                <td><%= @issue.spent_hours > 0 ? (link_to lwr(:label_f_hour, @issue.spent_hours), {:controller => 'timelog', :action => 'details', :issue_id => @issue}, :class => 'icon icon-time') : "-" %></td>
+                <td><%= @issue.spent_hours > 0 ? (link_to lwr(:label_f_hour, @issue.spent_hours), {:controller => 'timelog', :action => 'details', :project_id => @project, :issue_id => @issue}, :class => 'icon icon-time') : "-" %></td>
                 <% end %>
             </tr>
             <tr>

app/views/timelog/_list.rhtml +10 -3

@@ -23,9 +23,16
23	</td>	23	</td>
24	<td class="comments"><%=h entry.comments %></td>	24	<td class="comments"><%=h entry.comments %></td>
25	<td class="hours"><%= html_hours("%.2f" % entry.hours) %></td>	25	<td class="hours"><%= html_hours("%.2f" % entry.hours) %></td>
26	<td align="center"><%= link_to_if_authorized(l(:button_edit),	26	<td align="center">
27	{:controller => 'timelog', :action => 'edit', :id => entry},	27	<% if entry.editable_by?(User.current) -%>
28	:class => 'icon icon-edit') if entry.editable_by?(User.current) %></td>	28	<%= link_to image_tag('edit.png'), {:controller => 'timelog', :action => 'edit', :id => entry},
		29	:title => l(:button_edit) %>
		30	<%= link_to image_tag('delete.png'), {:controller => 'timelog', :action => 'destroy', :id => entry},
		31	:confirm => l(:text_are_you_sure),
		32	:method => :post,
		33	:title => l(:button_delete) %>
		34	<% end -%>
		35	</td>
29	</tr>	36	</tr>
30	<% end -%>	37	<% end -%>
31	</tbdoy>	38	</tbdoy>

config/routes.rb +1 0

               map.connect 'projects/:project_id/news/:action', :controller => 'news'
               map.connect 'projects/:project_id/documents/:action', :controller => 'documents'
               map.connect 'projects/:project_id/boards/:action/:id', :controller => 'boards'
+              map.connect 'projects/:project_id/timelog/:action/:id', :controller => 'timelog'
               map.connect 'boards/:board_id/topics/:action/:id', :controller => 'messages'
               map.with_options :controller => 'repositories' do |omap|

lib/redmine.rb +2 0

               map.project_module :time_tracking do |map|
                 map.permission :log_time, {:timelog => :edit}, :require => :loggedin
                 map.permission :view_time_entries, :timelog => [:details, :report]
+                map.permission :edit_time_entries, {:timelog => [:edit, :destroy]}, :require => :member
+                map.permission :edit_own_time_entries, {:timelog => [:edit, :destroy]}, :require => :loggedin
               end
               map.project_module :news do |map|

test/fixtures/roles.yml +3 0

                 - :view_calendar
                 - :log_time
                 - :view_time_entries
+                - :edit_time_entries
+                - :delete_time_entries
                 - :manage_news
                 - :comment_news
                 - :view_documents
                 - :view_calendar
                 - :log_time
                 - :view_time_entries
+                - :edit_own_time_entries
                 - :manage_news
                 - :comment_news
                 - :view_documents

test/functional/timelog_controller_test.rb +44 -1

@@ -22,13 +22,56 require 'timelog_controller'
22	class TimelogController; def rescue_action(e) raise e end; end	22	class TimelogController; def rescue_action(e) raise e end; end
23		23
24	class TimelogControllerTest < Test::Unit::TestCase	24	class TimelogControllerTest < Test::Unit::TestCase
25	fixtures :projects, :issues, :time_entries, :users, :trackers, :enumerations, :issue_statuses	25	fixtures :projects, :roles, :members, :issues, :time_entries, :users, :trackers, :enumerations, :issue_statuses
26		26
27	def setup	27	def setup
28	@controller = TimelogController.new	28	@controller = TimelogController.new
29	@request = ActionController::TestRequest.new	29	@request = ActionController::TestRequest.new
30	@response = ActionController::TestResponse.new	30	@response = ActionController::TestResponse.new
31	end	31	end
		32
		33	def test_create
		34	@request.session[:user_id] = 3
		35	post :edit, :project_id => 1,
		36	:time_entry => {:comments => 'Some work on TimelogControllerTest',
		37	:activity_id => '10',
		38	:spent_on => '2008-03-14',
		39	:issue_id => '1',
		40	:hours => '7.3'}
		41	assert_redirected_to 'projects/ecookbook/timelog/details'
		42
		43	i = Issue.find(1)
		44	t = TimeEntry.find_by_comments('Some work on TimelogControllerTest')
		45	assert_not_nil t
		46	assert_equal 7.3, t.hours
		47	assert_equal 3, t.user_id
		48	assert_equal i, t.issue
		49	assert_equal i.project, t.project
		50	end
		51
		52	def test_update
		53	entry = TimeEntry.find(1)
		54	assert_equal 1, entry.issue_id
		55	assert_equal 2, entry.user_id
		56
		57	@request.session[:user_id] = 1
		58	post :edit, :id => 1,
		59	:time_entry => {:issue_id => '2',
		60	:hours => '8'}
		61	assert_redirected_to 'projects/ecookbook/timelog/details'
		62	entry.reload
		63
		64	assert_equal 8, entry.hours
		65	assert_equal 2, entry.issue_id
		66	assert_equal 2, entry.user_id
		67	end
		68
		69	def destroy
		70	@request.session[:user_id] = 2
		71	post :destroy, :id => 1
		72	assert_redirected_to 'projects/ecookbook/timelog/details'
		73	assert_nil TimeEntry.find_by_id(1)
		74	end
32		75
33	def test_report_no_criteria	76	def test_report_no_criteria
34	get :report, :project_id => 1	77	get :report, :project_id => 1

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages