jro_apps/redmine Commit - r3056:9a452a5c351f

Make sure user can not watch what he is not allowed to view....

Jean-Philippe Lang -

r3056:9a452a5c351f

parent child

Context file:

r3056:9a452a5c351f

Collapse all files

app/controllers/watchers_controller.rb +5 -1

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class WatchersController < ApplicationController
               before_filter :find_project
               before_filter :require_login, :check_project_privacy, :only => [:watch, :unwatch]
               before_filter :authorize, :only => [:new, :destroy]
               verify :method => :post,
                      :only => [ :watch, :unwatch ],
                      :render => { :nothing => true, :status => :method_not_allowed }
               def watch
-                set_watcher(User.current, true)
+                if @watched.respond_to?(:visible?) && !@watched.visible?(User.current)
+                  render_403
+                else
+                  set_watcher(User.current, true)
+                end
               end
               def unwatch
                 set_watcher(User.current, false)
               end
               def new
                 @watcher = Watcher.new(params[:watcher])
                 @watcher.watchable = @watched
                 @watcher.save if request.post?
                 respond_to do |format|
                   format.html { redirect_to :back }
                   format.js do
                     render :update do |page|
                       page.replace_html 'watchers', :partial => 'watchers/watchers', :locals => {:watched => @watched}
                     end
                   end
                 end
               rescue ::ActionController::RedirectBackError
                 render :text => 'Watcher added.', :layout => true
               end
               def destroy
                 @watched.set_watcher(User.find(params[:user_id]), false) if request.post?
                 respond_to do |format|
                   format.html { redirect_to :back }
                   format.js do
                     render :update do |page|
                       page.replace_html 'watchers', :partial => 'watchers/watchers', :locals => {:watched => @watched}
                     end
                   end
                 end
               end
             private
               def find_project
                 klass = Object.const_get(params[:object_type].camelcase)
                 return false unless klass.respond_to?('watched_by')
                 @watched = klass.find(params[:object_id])
                 @project = @watched.project
               rescue
                 render_404
               end
               def set_watcher(user, watching)
                 @watched.set_watcher(user, watching)
                 if params[:replace].present?
                   if params[:replace].is_a? Array
                     replace_ids = params[:replace]
                   else
                     replace_ids = [params[:replace]]
                   end
                 else
                   replace_ids = 'watcher'
                 end
                 respond_to do |format|
                   format.html { redirect_to :back }
                   format.js do
                     render(:update) do |page|
                       replace_ids.each do |replace_id|
                         page.replace_html replace_id, watcher_link(@watched, user, :replace => replace_ids)
                       end
                     end
                   end
                 end
               rescue ::ActionController::RedirectBackError
                 render :text => (watching ? 'Watcher added.' : 'Watcher removed.'), :layout => true
               end
             end

test/functional/watchers_controller_test.rb +9 0

             # Redmine - project management software
             # Copyright (C) 2006-2008  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.dirname(__FILE__) + '/../test_helper'
             require 'watchers_controller'
             # Re-raise errors caught by the controller.
             class WatchersController; def rescue_action(e) raise e end; end
             class WatchersControllerTest < ActionController::TestCase
               fixtures :projects, :users, :roles, :members, :member_roles, :enabled_modules,
                        :issues, :trackers, :projects_trackers, :issue_statuses, :enumerations, :watchers
               def setup
                 @controller = WatchersController.new
                 @request    = ActionController::TestRequest.new
                 @response   = ActionController::TestResponse.new
                 User.current = nil
               end
               def test_get_watch_should_be_invalid
                 @request.session[:user_id] = 3
                 get :watch, :object_type => 'issue', :object_id => '1'
                 assert_response 405
               end
               def test_watch
                 @request.session[:user_id] = 3
                 assert_difference('Watcher.count') do
                   xhr :post, :watch, :object_type => 'issue', :object_id => '1'
                   assert_response :success
                   assert_select_rjs :replace_html, 'watcher'
                 end
                 assert Issue.find(1).watched_by?(User.find(3))
               end
+              def test_watch_should_be_denied_without_permission
+                Role.find(2).remove_permission! :view_issues
+                @request.session[:user_id] = 3
+                assert_no_difference('Watcher.count') do
+                  xhr :post, :watch, :object_type => 'issue', :object_id => '1'
+                  assert_response 403
+                end
+              end
               def test_watch_with_multiple_replacements
                 @request.session[:user_id] = 3
                 assert_difference('Watcher.count') do
                   xhr :post, :watch, :object_type => 'issue', :object_id => '1', :replace => ['watch_item_1','watch_item_2']
                   assert_response :success
                   assert_select_rjs :replace_html, 'watch_item_1'
                   assert_select_rjs :replace_html, 'watch_item_2'
                 end
               end
               def test_unwatch
                 @request.session[:user_id] = 3
                 assert_difference('Watcher.count', -1) do
                   xhr :post, :unwatch, :object_type => 'issue', :object_id => '2'
                   assert_response :success
                   assert_select_rjs :replace_html, 'watcher'
                 end
                 assert !Issue.find(1).watched_by?(User.find(3))
               end
               def test_unwatch_with_multiple_replacements
                 @request.session[:user_id] = 3
                 assert_difference('Watcher.count', -1) do
                   xhr :post, :unwatch, :object_type => 'issue', :object_id => '2', :replace => ['watch_item_1', 'watch_item_2']
                   assert_response :success
                   assert_select_rjs :replace_html, 'watch_item_1'
                   assert_select_rjs :replace_html, 'watch_item_2'
                 end
                 assert !Issue.find(1).watched_by?(User.find(3))
               end
               def test_new_watcher
                 @request.session[:user_id] = 2
                 assert_difference('Watcher.count') do
                   xhr :post, :new, :object_type => 'issue', :object_id => '2', :watcher => {:user_id => '4'}
                   assert_response :success
                   assert_select_rjs :replace_html, 'watchers'
                 end
                 assert Issue.find(2).watched_by?(User.find(4))
               end
               def test_remove_watcher
                 @request.session[:user_id] = 2
                 assert_difference('Watcher.count', -1) do
                   xhr :post, :destroy, :object_type => 'issue', :object_id => '2', :user_id => '3'
                   assert_response :success
                   assert_select_rjs :replace_html, 'watchers'
                 end
                 assert !Issue.find(2).watched_by?(User.find(3))
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages