##// END OF EJS Templates
jro_apps » redmine
RSS
Make sure user can not watch what he is not allowed to view....
Jean-Philippe Lang -
r3056:9a452a5c351f
parent child
Show More
Side by Side Unified
Context file:
r3056:9a452a5c351f Loading diff...:
Show file before | Show file after | Hide comments
@@ -1,97 +1,101
1 1 # redMine - project management software
2 2 # Copyright (C) 2006-2007 Jean-Philippe Lang
3 3 #
4 4 # This program is free software; you can redistribute it and/or
5 5 # modify it under the terms of the GNU General Public License
6 6 # as published by the Free Software Foundation; either version 2
7 7 # of the License, or (at your option) any later version.
8 8 #
9 9 # This program is distributed in the hope that it will be useful,
10 10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 12 # GNU General Public License for more details.
13 13 #
14 14 # You should have received a copy of the GNU General Public License
15 15 # along with this program; if not, write to the Free Software
16 16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
17 17
18 18 class WatchersController < ApplicationController
19 19 before_filter :find_project
20 20 before_filter :require_login, :check_project_privacy, :only => [:watch, :unwatch]
21 21 before_filter :authorize, :only => [:new, :destroy]
22 22
23 23 verify :method => :post,
24 24 :only => [ :watch, :unwatch ],
25 25 :render => { :nothing => true, :status => :method_not_allowed }
26 26
27 27 def watch
28 set_watcher(User.current, true)
28 if @watched.respond_to?(:visible?) && !@watched.visible?(User.current)
29 render_403
30 else
31 set_watcher(User.current, true)
32 end
29 33 end
30 34
31 35 def unwatch
32 36 set_watcher(User.current, false)
33 37 end
34 38
35 39 def new
36 40 @watcher = Watcher.new(params[:watcher])
37 41 @watcher.watchable = @watched
38 42 @watcher.save if request.post?
39 43 respond_to do |format|
40 44 format.html { redirect_to :back }
41 45 format.js do
42 46 render :update do |page|
43 47 page.replace_html 'watchers', :partial => 'watchers/watchers', :locals => {:watched => @watched}
44 48 end
45 49 end
46 50 end
47 51 rescue ::ActionController::RedirectBackError
48 52 render :text => 'Watcher added.', :layout => true
49 53 end
50 54
51 55 def destroy
52 56 @watched.set_watcher(User.find(params[:user_id]), false) if request.post?
53 57 respond_to do |format|
54 58 format.html { redirect_to :back }
55 59 format.js do
56 60 render :update do |page|
57 61 page.replace_html 'watchers', :partial => 'watchers/watchers', :locals => {:watched => @watched}
58 62 end
59 63 end
60 64 end
61 65 end
62 66
63 67 private
64 68 def find_project
65 69 klass = Object.const_get(params[:object_type].camelcase)
66 70 return false unless klass.respond_to?('watched_by')
67 71 @watched = klass.find(params[:object_id])
68 72 @project = @watched.project
69 73 rescue
70 74 render_404
71 75 end
72 76
73 77 def set_watcher(user, watching)
74 78 @watched.set_watcher(user, watching)
75 79 if params[:replace].present?
76 80 if params[:replace].is_a? Array
77 81 replace_ids = params[:replace]
78 82 else
79 83 replace_ids = [params[:replace]]
80 84 end
81 85 else
82 86 replace_ids = 'watcher'
83 87 end
84 88 respond_to do |format|
85 89 format.html { redirect_to :back }
86 90 format.js do
87 91 render(:update) do |page|
88 92 replace_ids.each do |replace_id|
89 93 page.replace_html replace_id, watcher_link(@watched, user, :replace => replace_ids)
90 94 end
91 95 end
92 96 end
93 97 end
94 98 rescue ::ActionController::RedirectBackError
95 99 render :text => (watching ? 'Watcher added.' : 'Watcher removed.'), :layout => true
96 100 end
97 101 end
Show file before | Show file after | Hide comments
@@ -1,101 +1,110
1 1 # Redmine - project management software
2 2 # Copyright (C) 2006-2008 Jean-Philippe Lang
3 3 #
4 4 # This program is free software; you can redistribute it and/or
5 5 # modify it under the terms of the GNU General Public License
6 6 # as published by the Free Software Foundation; either version 2
7 7 # of the License, or (at your option) any later version.
8 8 #
9 9 # This program is distributed in the hope that it will be useful,
10 10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 12 # GNU General Public License for more details.
13 13 #
14 14 # You should have received a copy of the GNU General Public License
15 15 # along with this program; if not, write to the Free Software
16 16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
17 17
18 18 require File.dirname(__FILE__) + '/../test_helper'
19 19 require 'watchers_controller'
20 20
21 21 # Re-raise errors caught by the controller.
22 22 class WatchersController; def rescue_action(e) raise e end; end
23 23
24 24 class WatchersControllerTest < ActionController::TestCase
25 25 fixtures :projects, :users, :roles, :members, :member_roles, :enabled_modules,
26 26 :issues, :trackers, :projects_trackers, :issue_statuses, :enumerations, :watchers
27 27
28 28 def setup
29 29 @controller = WatchersController.new
30 30 @request = ActionController::TestRequest.new
31 31 @response = ActionController::TestResponse.new
32 32 User.current = nil
33 33 end
34 34
35 35 def test_get_watch_should_be_invalid
36 36 @request.session[:user_id] = 3
37 37 get :watch, :object_type => 'issue', :object_id => '1'
38 38 assert_response 405
39 39 end
40 40
41 41 def test_watch
42 42 @request.session[:user_id] = 3
43 43 assert_difference('Watcher.count') do
44 44 xhr :post, :watch, :object_type => 'issue', :object_id => '1'
45 45 assert_response :success
46 46 assert_select_rjs :replace_html, 'watcher'
47 47 end
48 48 assert Issue.find(1).watched_by?(User.find(3))
49 49 end
50
51 def test_watch_should_be_denied_without_permission
52 Role.find(2).remove_permission! :view_issues
53 @request.session[:user_id] = 3
54 assert_no_difference('Watcher.count') do
55 xhr :post, :watch, :object_type => 'issue', :object_id => '1'
56 assert_response 403
57 end
58 end
50 59
51 60 def test_watch_with_multiple_replacements
52 61 @request.session[:user_id] = 3
53 62 assert_difference('Watcher.count') do
54 63 xhr :post, :watch, :object_type => 'issue', :object_id => '1', :replace => ['watch_item_1','watch_item_2']
55 64 assert_response :success
56 65 assert_select_rjs :replace_html, 'watch_item_1'
57 66 assert_select_rjs :replace_html, 'watch_item_2'
58 67 end
59 68 end
60 69
61 70 def test_unwatch
62 71 @request.session[:user_id] = 3
63 72 assert_difference('Watcher.count', -1) do
64 73 xhr :post, :unwatch, :object_type => 'issue', :object_id => '2'
65 74 assert_response :success
66 75 assert_select_rjs :replace_html, 'watcher'
67 76 end
68 77 assert !Issue.find(1).watched_by?(User.find(3))
69 78 end
70 79
71 80 def test_unwatch_with_multiple_replacements
72 81 @request.session[:user_id] = 3
73 82 assert_difference('Watcher.count', -1) do
74 83 xhr :post, :unwatch, :object_type => 'issue', :object_id => '2', :replace => ['watch_item_1', 'watch_item_2']
75 84 assert_response :success
76 85 assert_select_rjs :replace_html, 'watch_item_1'
77 86 assert_select_rjs :replace_html, 'watch_item_2'
78 87 end
79 88 assert !Issue.find(1).watched_by?(User.find(3))
80 89 end
81 90
82 91 def test_new_watcher
83 92 @request.session[:user_id] = 2
84 93 assert_difference('Watcher.count') do
85 94 xhr :post, :new, :object_type => 'issue', :object_id => '2', :watcher => {:user_id => '4'}
86 95 assert_response :success
87 96 assert_select_rjs :replace_html, 'watchers'
88 97 end
89 98 assert Issue.find(2).watched_by?(User.find(4))
90 99 end
91 100
92 101 def test_remove_watcher
93 102 @request.session[:user_id] = 2
94 103 assert_difference('Watcher.count', -1) do
95 104 xhr :post, :destroy, :object_type => 'issue', :object_id => '2', :user_id => '3'
96 105 assert_response :success
97 106 assert_select_rjs :replace_html, 'watchers'
98 107 end
99 108 assert !Issue.find(2).watched_by?(User.find(3))
100 109 end
101 110 end
General Comments 0
You need to be logged in to leave comments. Login now