jro_apps/redmine Commit - r14022:9b48fe532cdd

Merged r14388 (#19842)....

Jean-Philippe Lang -

r14022:9b48fe532cdd

parent child

Context file:

r14022:9b48fe532cdd

Collapse all files

app/controllers/queries_controller.rb +18 -11

             # Redmine - project management software
             # Copyright (C) 2006-2015  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class QueriesController < ApplicationController
               menu_item :issues
               before_filter :find_query, :except => [:new, :create, :index]
               before_filter :find_optional_project, :only => [:new, :create]
               accept_api_auth :index
               include QueriesHelper
               def index
                 case params[:format]
                 when 'xml', 'json'
                   @offset, @limit = api_offset_and_limit
                 else
                   @limit = per_page_option
                 end
                 @query_count = IssueQuery.visible.count
                 @query_pages = Paginator.new @query_count, @limit, params['page']
                 @queries = IssueQuery.visible.
                                 order("#{Query.table_name}.name").
                                 limit(@limit).
                                 offset(@offset).
                                 to_a
                 respond_to do |format|
                   format.html {render_error :status => 406}
                   format.api
                 end
               end
               def new
                 @query = IssueQuery.new
                 @query.user = User.current
                 @query.project = @project
-                @query.visibility = IssueQuery::VISIBILITY_PRIVATE unless User.current.allowed_to?(:manage_public_queries, @project) || User.current.admin?
                 @query.build_from_params(params)
               end
               def create
-                @query = IssueQuery.new(params[:query])
+                @query = IssueQuery.new
                 @query.user = User.current
-                @query.project = params[:query_is_for_all] ? nil : @project
+                @query.project = @project
-                @query.visibility = IssueQuery::VISIBILITY_PRIVATE unless User.current.allowed_to?(:manage_public_queries, @project) || User.current.admin?
+                update_query_from_params
-                @query.build_from_params(params)
-                @query.column_names = nil if params[:default_columns]
                 if @query.save
                   flash[:notice] = l(:notice_successful_create)
                   redirect_to_issues(:query_id => @query)
                 else
                   render :action => 'new', :layout => !request.xhr?
                 end
               end
               def edit
               end
               def update
-                @query.attributes = params[:query]
+                update_query_from_params
-                @query.project = nil if params[:query_is_for_all]
-                @query.visibility = IssueQuery::VISIBILITY_PRIVATE unless User.current.allowed_to?(:manage_public_queries, @project) || User.current.admin?
-                @query.build_from_params(params)
-                @query.column_names = nil if params[:default_columns]
                 if @query.save
                   flash[:notice] = l(:notice_successful_update)
                   redirect_to_issues(:query_id => @query)
                 else
                   render :action => 'edit'
                 end
               end
               def destroy
                 @query.destroy
                 redirect_to_issues(:set_filter => 1)
               end
             private
               def find_query
                 @query = IssueQuery.find(params[:id])
                 @project = @query.project
                 render_403 unless @query.editable_by?(User.current)
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
               def find_optional_project
                 @project = Project.find(params[:project_id]) if params[:project_id]
                 render_403 unless User.current.allowed_to?(:save_queries, @project, :global => true)
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
+              def update_query_from_params
+                @query.project = params[:query_is_for_all] ? nil : @project
+                @query.build_from_params(params)
+                @query.column_names = nil if params[:default_columns]
+                @query.sort_criteria = params[:query] && params[:query][:sort_criteria]
+                @query.name = params[:query] && params[:query][:name]
+                if User.current.allowed_to?(:manage_public_queries, @query.project) || User.current.admin?
+                  @query.visibility = (params[:query] && params[:query][:visibility]) || IssueQuery::VISIBILITY_PRIVATE
+                else
+                  @query.visibility = IssueQuery::VISIBILITY_PRIVATE
+                end
+                @query
+              end
               def redirect_to_issues(options)
                 if params[:gantt]
                   if @project
                     redirect_to project_gantt_path(@project, options)
                   else
                     redirect_to issues_gantt_path(options)
                   end
                 else
                   redirect_to _project_issues_path(@project, options)
                 end
               end
             end

app/models/query.rb +3 -1

             # Redmine - project management software
             # Copyright (C) 2006-2015  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class QueryColumn
               attr_accessor :name, :sortable, :groupable, :default_order
               include Redmine::I18n
               def initialize(name, options={})
                 self.name = name
                 self.sortable = options[:sortable]
                 self.groupable = options[:groupable] || false
                 if groupable == true
                   self.groupable = name.to_s
                 end
                 self.default_order = options[:default_order]
                 @inline = options.key?(:inline) ? options[:inline] : true
                 @caption_key = options[:caption] || "field_#{name}".to_sym
                 @frozen = options[:frozen]
               end
               def caption
                 case @caption_key
                 when Symbol
                   l(@caption_key)
                 when Proc
                   @caption_key.call
                 else
                   @caption_key
                 end
               end
               # Returns true if the column is sortable, otherwise false
               def sortable?
                 !@sortable.nil?
               end
               def sortable
                 @sortable.is_a?(Proc) ? @sortable.call : @sortable
               end
               def inline?
                 @inline
               end
               def frozen?
                 @frozen
               end
               def value(object)
                 object.send name
               end
               def value_object(object)
                 object.send name
               end
               def css_classes
                 name
               end
             end
             class QueryCustomFieldColumn < QueryColumn
               def initialize(custom_field)
                 self.name = "cf_#{custom_field.id}".to_sym
                 self.sortable = custom_field.order_statement || false
                 self.groupable = custom_field.group_statement || false
                 @inline = true
                 @cf = custom_field
               end
               def caption
                 @cf.name
               end
               def custom_field
                 @cf
               end
               def value_object(object)
                 if custom_field.visible_by?(object.project, User.current)
                   cv = object.custom_values.select {|v| v.custom_field_id == @cf.id}
                   cv.size > 1 ? cv.sort {|a,b| a.value.to_s <=> b.value.to_s} : cv.first
                 else
                   nil
                 end
               end
               def value(object)
                 raw = value_object(object)
                 if raw.is_a?(Array)
                   raw.map {|r| @cf.cast_value(r.value)}
                 elsif raw
                   @cf.cast_value(raw.value)
                 else
                   nil
                 end
               end
               def css_classes
                 @css_classes ||= "#{name} #{@cf.field_format}"
               end
             end
             class QueryAssociationCustomFieldColumn < QueryCustomFieldColumn
               def initialize(association, custom_field)
                 super(custom_field)
                 self.name = "#{association}.cf_#{custom_field.id}".to_sym
                 # TODO: support sorting/grouping by association custom field
                 self.sortable = false
                 self.groupable = false
                 @association = association
               end
               def value_object(object)
                 if assoc = object.send(@association)
                   super(assoc)
                 end
               end
               def css_classes
                 @css_classes ||= "#{@association}_cf_#{@cf.id} #{@cf.field_format}"
               end
             end
             class Query < ActiveRecord::Base
               class StatementInvalid < ::ActiveRecord::StatementInvalid
               end
               VISIBILITY_PRIVATE = 0
               VISIBILITY_ROLES   = 1
               VISIBILITY_PUBLIC  = 2
               belongs_to :project
               belongs_to :user
               has_and_belongs_to_many :roles, :join_table => "#{table_name_prefix}queries_roles#{table_name_suffix}", :foreign_key => "query_id"
               serialize :filters
               serialize :column_names
               serialize :sort_criteria, Array
               serialize :options, Hash
               attr_protected :project_id, :user_id
               validates_presence_of :name
               validates_length_of :name, :maximum => 255
               validates :visibility, :inclusion => { :in => [VISIBILITY_PUBLIC, VISIBILITY_ROLES, VISIBILITY_PRIVATE] }
               validate :validate_query_filters
               validate do |query|
                 errors.add(:base, l(:label_role_plural) + ' ' + l('activerecord.errors.messages.blank')) if query.visibility == VISIBILITY_ROLES && roles.blank?
               end
               after_save do |query|
                 if query.visibility_changed? && query.visibility != VISIBILITY_ROLES
                   query.roles.clear
                 end
               end
               class_attribute :operators
               self.operators = {
                 "="   => :label_equals,
                 "!"   => :label_not_equals,
                 "o"   => :label_open_issues,
                 "c"   => :label_closed_issues,
                 "!*"  => :label_none,
                 "*"   => :label_any,
                 ">="  => :label_greater_or_equal,
                 "<="  => :label_less_or_equal,
                 "><"  => :label_between,
                 "<t+" => :label_in_less_than,
                 ">t+" => :label_in_more_than,
                 "><t+"=> :label_in_the_next_days,
                 "t+"  => :label_in,
                 "t"   => :label_today,
                 "ld"  => :label_yesterday,
                 "w"   => :label_this_week,
                 "lw"  => :label_last_week,
                 "l2w" => [:label_last_n_weeks, {:count => 2}],
                 "m"   => :label_this_month,
                 "lm"  => :label_last_month,
                 "y"   => :label_this_year,
                 ">t-" => :label_less_than_ago,
                 "<t-" => :label_more_than_ago,
                 "><t-"=> :label_in_the_past_days,
                 "t-"  => :label_ago,
                 "~"   => :label_contains,
                 "!~"  => :label_not_contains,
                 "=p"  => :label_any_issues_in_project,
                 "=!p" => :label_any_issues_not_in_project,
                 "!p"  => :label_no_issues_in_project
               }
               class_attribute :operators_by_filter_type
               self.operators_by_filter_type = {
                 :list => [ "=", "!" ],
                 :list_status => [ "o", "=", "!", "c", "*" ],
                 :list_optional => [ "=", "!", "!*", "*" ],
                 :list_subprojects => [ "*", "!*", "=" ],
                 :date => [ "=", ">=", "<=", "><", "<t+", ">t+", "><t+", "t+", "t", "ld", "w", "lw", "l2w", "m", "lm", "y", ">t-", "<t-", "><t-", "t-", "!*", "*" ],
                 :date_past => [ "=", ">=", "<=", "><", ">t-", "<t-", "><t-", "t-", "t", "ld", "w", "lw", "l2w", "m", "lm", "y", "!*", "*" ],
                 :string => [ "=", "~", "!", "!~", "!*", "*" ],
                 :text => [  "~", "!~", "!*", "*" ],
                 :integer => [ "=", ">=", "<=", "><", "!*", "*" ],
                 :float => [ "=", ">=", "<=", "><", "!*", "*" ],
                 :relation => ["=", "=p", "=!p", "!p", "!*", "*"]
               }
               class_attribute :available_columns
               self.available_columns = []
               class_attribute :queried_class
               def queried_table_name
                 @queried_table_name ||= self.class.queried_class.table_name
               end
               def initialize(attributes=nil, *args)
                 super attributes
                 @is_for_all = project.nil?
               end
               # Builds the query from the given params
               def build_from_params(params)
                 if params[:fields] || params[:f]
                   self.filters = {}
                   add_filters(params[:fields] || params[:f], params[:operators] || params[:op], params[:values] || params[:v])
                 else
                   available_filters.keys.each do |field|
                     add_short_filter(field, params[field]) if params[field]
                   end
                 end
                 self.group_by = params[:group_by] || (params[:query] && params[:query][:group_by])
                 self.column_names = params[:c] || (params[:query] && params[:query][:column_names])
                 self
               end
               # Builds a new query from the given params and attributes
               def self.build_from_params(params, attributes={})
                 new(attributes).build_from_params(params)
               end
               def validate_query_filters
                 filters.each_key do |field|
                   if values_for(field)
                     case type_for(field)
                     when :integer
                       add_filter_error(field, :invalid) if values_for(field).detect {|v| v.present? && !v.match(/^[+-]?\d+$/) }
                     when :float
                       add_filter_error(field, :invalid) if values_for(field).detect {|v| v.present? && !v.match(/^[+-]?\d+(\.\d*)?$/) }
                     when :date, :date_past
                       case operator_for(field)
                       when "=", ">=", "<=", "><"
                         add_filter_error(field, :invalid) if values_for(field).detect {|v|
                           v.present? && (!v.match(/\A\d{4}-\d{2}-\d{2}(T\d{2}((:)?\d{2}){0,2}(Z|\d{2}:?\d{2})?)?\z/) || parse_date(v).nil?)
                         }
                       when ">t-", "<t-", "t-", ">t+", "<t+", "t+", "><t+", "><t-"
                         add_filter_error(field, :invalid) if values_for(field).detect {|v| v.present? && !v.match(/^\d+$/) }
                       end
                     end
                   end
                   add_filter_error(field, :blank) unless
                       # filter requires one or more values
                       (values_for(field) and !values_for(field).first.blank?) or
                       # filter doesn't require any value
                       ["o", "c", "!*", "*", "t", "ld", "w", "lw", "l2w", "m", "lm", "y"].include? operator_for(field)
                 end if filters
               end
               def add_filter_error(field, message)
                 m = label_for(field) + " " + l(message, :scope => 'activerecord.errors.messages')
                 errors.add(:base, m)
               end
               def editable_by?(user)
                 return false unless user
                 # Admin can edit them all and regular users can edit their private queries
                 return true if user.admin? || (is_private? && self.user_id == user.id)
                 # Members can not edit public queries that are for all project (only admin is allowed to)
                 is_public? && !@is_for_all && user.allowed_to?(:manage_public_queries, project)
               end
               def trackers
                 @trackers ||= project.nil? ? Tracker.sorted.to_a : project.rolled_up_trackers
               end
               # Returns a hash of localized labels for all filter operators
               def self.operators_labels
                 operators.inject({}) {|h, operator| h[operator.first] = l(*operator.last); h}
               end
               # Returns a representation of the available filters for JSON serialization
               def available_filters_as_json
                 json = {}
                 available_filters.each do |field, options|
                   json[field] = options.slice(:type, :name, :values).stringify_keys
                 end
                 json
               end
               def all_projects
                 @all_projects ||= Project.visible.to_a
               end
               def all_projects_values
                 return @all_projects_values if @all_projects_values
                 values = []
                 Project.project_tree(all_projects) do |p, level|
                   prefix = (level > 0 ? ('--' * level + ' ') : '')
                   values << ["#{prefix}#{p.name}", p.id.to_s]
                 end
                 @all_projects_values = values
               end
               # Adds available filters
               def initialize_available_filters
                 # implemented by sub-classes
               end
               protected :initialize_available_filters
               # Adds an available filter
               def add_available_filter(field, options)
                 @available_filters ||= ActiveSupport::OrderedHash.new
                 @available_filters[field] = options
                 @available_filters
               end
               # Removes an available filter
               def delete_available_filter(field)
                 if @available_filters
                   @available_filters.delete(field)
                 end
               end
               # Return a hash of available filters
               def available_filters
                 unless @available_filters
                   initialize_available_filters
                   @available_filters.each do |field, options|
                     options[:name] ||= l(options[:label] || "field_#{field}".gsub(/_id$/, ''))
                   end
                 end
                 @available_filters
               end
               def add_filter(field, operator, values=nil)
                 # values must be an array
                 return unless values.nil? || values.is_a?(Array)
                 # check if field is defined as an available filter
                 if available_filters.has_key? field
                   filter_options = available_filters[field]
                   filters[field] = {:operator => operator, :values => (values || [''])}
                 end
               end
               def add_short_filter(field, expression)
                 return unless expression && available_filters.has_key?(field)
                 field_type = available_filters[field][:type]
                 operators_by_filter_type[field_type].sort.reverse.detect do |operator|
                   next unless expression =~ /^#{Regexp.escape(operator)}(.*)$/
                   values = $1
                   add_filter field, operator, values.present? ? values.split('|') : ['']
                 end || add_filter(field, '=', expression.split('|'))
               end
               # Add multiple filters using +add_filter+
               def add_filters(fields, operators, values)
                 if fields.is_a?(Array) && operators.is_a?(Hash) && (values.nil? || values.is_a?(Hash))
                   fields.each do |field|
                     add_filter(field, operators[field], values && values[field])
                   end
                 end
               end
               def has_filter?(field)
                 filters and filters[field]
               end
               def type_for(field)
                 available_filters[field][:type] if available_filters.has_key?(field)
               end
               def operator_for(field)
                 has_filter?(field) ? filters[field][:operator] : nil
               end
               def values_for(field)
                 has_filter?(field) ? filters[field][:values] : nil
               end
               def value_for(field, index=0)
                 (values_for(field) || [])[index]
               end
               def label_for(field)
                 label = available_filters[field][:name] if available_filters.has_key?(field)
                 label ||= l("field_#{field.to_s.gsub(/_id$/, '')}", :default => field)
               end
               def self.add_available_column(column)
                 self.available_columns << (column) if column.is_a?(QueryColumn)
               end
               # Returns an array of columns that can be used to group the results
               def groupable_columns
                 available_columns.select {|c| c.groupable}
               end
               # Returns a Hash of columns and the key for sorting
               def sortable_columns
                 available_columns.inject({}) {|h, column|
                   h[column.name.to_s] = column.sortable
                   h
                 }
               end
               def columns
                 # preserve the column_names order
                 cols = (has_default_columns? ? default_columns_names : column_names).collect do |name|
                    available_columns.find { |col| col.name == name }
                 end.compact
                 available_columns.select(&:frozen?) | cols
               end
               def inline_columns
                 columns.select(&:inline?)
               end
               def block_columns
                 columns.reject(&:inline?)
               end
               def available_inline_columns
                 available_columns.select(&:inline?)
               end
               def available_block_columns
                 available_columns.reject(&:inline?)
               end
               def default_columns_names
                 []
               end
               def column_names=(names)
                 if names
                   names = names.select {|n| n.is_a?(Symbol) || !n.blank? }
                   names = names.collect {|n| n.is_a?(Symbol) ? n : n.to_sym }
                   # Set column_names to nil if default columns
                   if names == default_columns_names
                     names = nil
                   end
                 end
                 write_attribute(:column_names, names)
               end
               def has_column?(column)
                 column_names && column_names.include?(column.is_a?(QueryColumn) ? column.name : column)
               end
               def has_custom_field_column?
                 columns.any? {|column| column.is_a? QueryCustomFieldColumn}
               end
               def has_default_columns?
                 column_names.nil? || column_names.empty?
               end
               def sort_criteria=(arg)
                 c = []
                 if arg.is_a?(Hash)
                   arg = arg.keys.sort.collect {|k| arg[k]}
                 end
-                c = arg.select {|k,o| !k.to_s.blank?}.slice(0,3).collect {|k,o| [k.to_s, (o == 'desc' || o == false) ? 'desc' : 'asc']}
+                if arg
+                  c = arg.select {|k,o| !k.to_s.blank?}.slice(0,3).collect {|k,o| [k.to_s, (o == 'desc' || o == false) ? 'desc' : 'asc']}
+                end
                 write_attribute(:sort_criteria, c)
               end
               def sort_criteria
                 read_attribute(:sort_criteria) || []
               end
               def sort_criteria_key(arg)
                 sort_criteria && sort_criteria[arg] && sort_criteria[arg].first
               end
               def sort_criteria_order(arg)
                 sort_criteria && sort_criteria[arg] && sort_criteria[arg].last
               end
               def sort_criteria_order_for(key)
                 sort_criteria.detect {|k, order| key.to_s == k}.try(:last)
               end
               # Returns the SQL sort order that should be prepended for grouping
               def group_by_sort_order
                 if grouped? && (column = group_by_column)
                   order = (sort_criteria_order_for(column.name) || column.default_order).try(:upcase)
                   column.sortable.is_a?(Array) ?
                     column.sortable.collect {|s| "#{s} #{order}"}.join(',') :
                     "#{column.sortable} #{order}"
                 end
               end
               # Returns true if the query is a grouped query
               def grouped?
                 !group_by_column.nil?
               end
               def group_by_column
                 groupable_columns.detect {|c| c.groupable && c.name.to_s == group_by}
               end
               def group_by_statement
                 group_by_column.try(:groupable)
               end
               def project_statement
                 project_clauses = []
                 if project && !project.descendants.active.empty?
                   ids = [project.id]
                   if has_filter?("subproject_id")
                     case operator_for("subproject_id")
                     when '='
                       # include the selected subprojects
                       ids += values_for("subproject_id").each(&:to_i)
                     when '!*'
                       # main project only
                     else
                       # all subprojects
                       ids += project.descendants.collect(&:id)
                     end
                   elsif Setting.display_subprojects_issues?
                     ids += project.descendants.collect(&:id)
                   end
                   project_clauses << "#{Project.table_name}.id IN (%s)" % ids.join(',')
                 elsif project
                   project_clauses << "#{Project.table_name}.id = %d" % project.id
                 end
                 project_clauses.any? ? project_clauses.join(' AND ') : nil
               end
               def statement
                 # filters clauses
                 filters_clauses = []
                 filters.each_key do |field|
                   next if field == "subproject_id"
                   v = values_for(field).clone
                   next unless v and !v.empty?
                   operator = operator_for(field)
                   # "me" value substitution
                   if %w(assigned_to_id author_id user_id watcher_id).include?(field)
                     if v.delete("me")
                       if User.current.logged?
                         v.push(User.current.id.to_s)
                         v += User.current.group_ids.map(&:to_s) if field == 'assigned_to_id'
                       else
                         v.push("0")
                       end
                     end
                   end
                   if field == 'project_id'
                     if v.delete('mine')
                       v += User.current.memberships.map(&:project_id).map(&:to_s)
                     end
                   end
                   if field =~ /cf_(\d+)$/
                     # custom field
                     filters_clauses << sql_for_custom_field(field, operator, v, $1)
                   elsif respond_to?("sql_for_#{field}_field")
                     # specific statement
                     filters_clauses << send("sql_for_#{field}_field", field, operator, v)
                   else
                     # regular field
                     filters_clauses << '(' + sql_for_field(field, operator, v, queried_table_name, field) + ')'
                   end
                 end if filters and valid?
                 if (c = group_by_column) && c.is_a?(QueryCustomFieldColumn)
                   # Excludes results for which the grouped custom field is not visible
                   filters_clauses << c.custom_field.visibility_by_project_condition
                 end
                 filters_clauses << project_statement
                 filters_clauses.reject!(&:blank?)
                 filters_clauses.any? ? filters_clauses.join(' AND ') : nil
               end
               private
               def sql_for_custom_field(field, operator, value, custom_field_id)
                 db_table = CustomValue.table_name
                 db_field = 'value'
                 filter = @available_filters[field]
                 return nil unless filter
                 if filter[:field].format.target_class && filter[:field].format.target_class <= User
                   if value.delete('me')
                     value.push User.current.id.to_s
                   end
                 end
                 not_in = nil
                 if operator == '!'
                   # Makes ! operator work for custom fields with multiple values
                   operator = '='
                   not_in = 'NOT'
                 end
                 customized_key = "id"
                 customized_class = queried_class
                 if field =~ /^(.+)\.cf_/
                   assoc = $1
                   customized_key = "#{assoc}_id"
                   customized_class = queried_class.reflect_on_association(assoc.to_sym).klass.base_class rescue nil
                   raise "Unknown #{queried_class.name} association #{assoc}" unless customized_class
                 end
                 where = sql_for_field(field, operator, value, db_table, db_field, true)
                 if operator =~ /[<>]/
                   where = "(#{where}) AND #{db_table}.#{db_field} <> ''"
                 end
                 "#{queried_table_name}.#{customized_key} #{not_in} IN (" +
                   "SELECT #{customized_class.table_name}.id FROM #{customized_class.table_name}" +
                   " LEFT OUTER JOIN #{db_table} ON #{db_table}.customized_type='#{customized_class}' AND #{db_table}.customized_id=#{customized_class.table_name}.id AND #{db_table}.custom_field_id=#{custom_field_id}" +
                   " WHERE (#{where}) AND (#{filter[:field].visibility_by_project_condition}))"
               end
               # Helper method to generate the WHERE sql for a +field+, +operator+ and a +value+
               def sql_for_field(field, operator, value, db_table, db_field, is_custom_filter=false)
                 sql = ''
                 case operator
                 when "="
                   if value.any?
                     case type_for(field)
                     when :date, :date_past
                       sql = date_clause(db_table, db_field, parse_date(value.first), parse_date(value.first), is_custom_filter)
                     when :integer
                       if is_custom_filter
                         sql = "(#{db_table}.#{db_field} <> '' AND CAST(CASE #{db_table}.#{db_field} WHEN '' THEN '0' ELSE #{db_table}.#{db_field} END AS decimal(30,3)) = #{value.first.to_i})"
                       else
                         sql = "#{db_table}.#{db_field} = #{value.first.to_i}"
                       end
                     when :float
                       if is_custom_filter
                         sql = "(#{db_table}.#{db_field} <> '' AND CAST(CASE #{db_table}.#{db_field} WHEN '' THEN '0' ELSE #{db_table}.#{db_field} END AS decimal(30,3)) BETWEEN #{value.first.to_f - 1e-5} AND #{value.first.to_f + 1e-5})"
                       else
                         sql = "#{db_table}.#{db_field} BETWEEN #{value.first.to_f - 1e-5} AND #{value.first.to_f + 1e-5}"
                       end
                     else
                       sql = "#{db_table}.#{db_field} IN (" + value.collect{|val| "'#{self.class.connection.quote_string(val)}'"}.join(",") + ")"
                     end
                   else
                     # IN an empty set
                     sql = "1=0"
                   end
                 when "!"
                   if value.any?
                     sql = "(#{db_table}.#{db_field} IS NULL OR #{db_table}.#{db_field} NOT IN (" + value.collect{|val| "'#{self.class.connection.quote_string(val)}'"}.join(",") + "))"
                   else
                     # NOT IN an empty set
                     sql = "1=1"
                   end
                 when "!*"
                   sql = "#{db_table}.#{db_field} IS NULL"
                   sql << " OR #{db_table}.#{db_field} = ''" if is_custom_filter
                 when "*"
                   sql = "#{db_table}.#{db_field} IS NOT NULL"
                   sql << " AND #{db_table}.#{db_field} <> ''" if is_custom_filter
                 when ">="
                   if [:date, :date_past].include?(type_for(field))
                     sql = date_clause(db_table, db_field, parse_date(value.first), nil, is_custom_filter)
                   else
                     if is_custom_filter
                       sql = "(#{db_table}.#{db_field} <> '' AND CAST(CASE #{db_table}.#{db_field} WHEN '' THEN '0' ELSE #{db_table}.#{db_field} END AS decimal(30,3)) >= #{value.first.to_f})"
                     else
                       sql = "#{db_table}.#{db_field} >= #{value.first.to_f}"
                     end
                   end
                 when "<="
                   if [:date, :date_past].include?(type_for(field))
                     sql = date_clause(db_table, db_field, nil, parse_date(value.first), is_custom_filter)
                   else
                     if is_custom_filter
                       sql = "(#{db_table}.#{db_field} <> '' AND CAST(CASE #{db_table}.#{db_field} WHEN '' THEN '0' ELSE #{db_table}.#{db_field} END AS decimal(30,3)) <= #{value.first.to_f})"
                     else
                       sql = "#{db_table}.#{db_field} <= #{value.first.to_f}"
                     end
                   end
                 when "><"
                   if [:date, :date_past].include?(type_for(field))
                     sql = date_clause(db_table, db_field, parse_date(value[0]), parse_date(value[1]), is_custom_filter)
                   else
                     if is_custom_filter
                       sql = "(#{db_table}.#{db_field} <> '' AND CAST(CASE #{db_table}.#{db_field} WHEN '' THEN '0' ELSE #{db_table}.#{db_field} END AS decimal(30,3)) BETWEEN #{value[0].to_f} AND #{value[1].to_f})"
                     else
                       sql = "#{db_table}.#{db_field} BETWEEN #{value[0].to_f} AND #{value[1].to_f}"
                     end
                   end
                 when "o"
                   sql = "#{queried_table_name}.status_id IN (SELECT id FROM #{IssueStatus.table_name} WHERE is_closed=#{self.class.connection.quoted_false})" if field == "status_id"
                 when "c"
                   sql = "#{queried_table_name}.status_id IN (SELECT id FROM #{IssueStatus.table_name} WHERE is_closed=#{self.class.connection.quoted_true})" if field == "status_id"
                 when "><t-"
                   # between today - n days and today
                   sql = relative_date_clause(db_table, db_field, - value.first.to_i, 0, is_custom_filter)
                 when ">t-"
                   # >= today - n days
                   sql = relative_date_clause(db_table, db_field, - value.first.to_i, nil, is_custom_filter)
                 when "<t-"
                   # <= today - n days
                   sql = relative_date_clause(db_table, db_field, nil, - value.first.to_i, is_custom_filter)
                 when "t-"
                   # = n days in past
                   sql = relative_date_clause(db_table, db_field, - value.first.to_i, - value.first.to_i, is_custom_filter)
                 when "><t+"
                   # between today and today + n days
                   sql = relative_date_clause(db_table, db_field, 0, value.first.to_i, is_custom_filter)
                 when ">t+"
                   # >= today + n days
                   sql = relative_date_clause(db_table, db_field, value.first.to_i, nil, is_custom_filter)
                 when "<t+"
                   # <= today + n days
                   sql = relative_date_clause(db_table, db_field, nil, value.first.to_i, is_custom_filter)
                 when "t+"
                   # = today + n days
                   sql = relative_date_clause(db_table, db_field, value.first.to_i, value.first.to_i, is_custom_filter)
                 when "t"
                   # = today
                   sql = relative_date_clause(db_table, db_field, 0, 0, is_custom_filter)
                 when "ld"
                   # = yesterday
                   sql = relative_date_clause(db_table, db_field, -1, -1, is_custom_filter)
                 when "w"
                   # = this week
                   first_day_of_week = l(:general_first_day_of_week).to_i
                   day_of_week = Date.today.cwday
                   days_ago = (day_of_week >= first_day_of_week ? day_of_week - first_day_of_week : day_of_week + 7 - first_day_of_week)
                   sql = relative_date_clause(db_table, db_field, - days_ago, - days_ago + 6, is_custom_filter)
                 when "lw"
                   # = last week
                   first_day_of_week = l(:general_first_day_of_week).to_i
                   day_of_week = Date.today.cwday
                   days_ago = (day_of_week >= first_day_of_week ? day_of_week - first_day_of_week : day_of_week + 7 - first_day_of_week)
                   sql = relative_date_clause(db_table, db_field, - days_ago - 7, - days_ago - 1, is_custom_filter)
                 when "l2w"
                   # = last 2 weeks
                   first_day_of_week = l(:general_first_day_of_week).to_i
                   day_of_week = Date.today.cwday
                   days_ago = (day_of_week >= first_day_of_week ? day_of_week - first_day_of_week : day_of_week + 7 - first_day_of_week)
                   sql = relative_date_clause(db_table, db_field, - days_ago - 14, - days_ago - 1, is_custom_filter)
                 when "m"
                   # = this month
                   date = Date.today
                   sql = date_clause(db_table, db_field, date.beginning_of_month, date.end_of_month, is_custom_filter)
                 when "lm"
                   # = last month
                   date = Date.today.prev_month
                   sql = date_clause(db_table, db_field, date.beginning_of_month, date.end_of_month, is_custom_filter)
                 when "y"
                   # = this year
                   date = Date.today
                   sql = date_clause(db_table, db_field, date.beginning_of_year, date.end_of_year, is_custom_filter)
                 when "~"
                   sql = "LOWER(#{db_table}.#{db_field}) LIKE '%#{self.class.connection.quote_string(value.first.to_s.downcase)}%'"
                 when "!~"
                   sql = "LOWER(#{db_table}.#{db_field}) NOT LIKE '%#{self.class.connection.quote_string(value.first.to_s.downcase)}%'"
                 else
                   raise "Unknown query operator #{operator}"
                 end
                 return sql
               end
               # Adds a filter for the given custom field
               def add_custom_field_filter(field, assoc=nil)
                 options = field.format.query_filter_options(field, self)
                 if field.format.target_class && field.format.target_class <= User
                   if options[:values].is_a?(Array) && User.current.logged?
                     options[:values].unshift ["<< #{l(:label_me)} >>", "me"]
                   end
                 end
                 filter_id = "cf_#{field.id}"
                 filter_name = field.name
                 if assoc.present?
                   filter_id = "#{assoc}.#{filter_id}"
                   filter_name = l("label_attribute_of_#{assoc}", :name => filter_name)
                 end
                 add_available_filter filter_id, options.merge({
                   :name => filter_name,
                   :field => field
                 })
               end
               # Adds filters for the given custom fields scope
               def add_custom_fields_filters(scope, assoc=nil)
                 scope.visible.where(:is_filter => true).sorted.each do |field|
                   add_custom_field_filter(field, assoc)
                 end
               end
               # Adds filters for the given associations custom fields
               def add_associations_custom_fields_filters(*associations)
                 fields_by_class = CustomField.visible.where(:is_filter => true).group_by(&:class)
                 associations.each do |assoc|
                   association_klass = queried_class.reflect_on_association(assoc).klass
                   fields_by_class.each do |field_class, fields|
                     if field_class.customized_class <= association_klass
                       fields.sort.each do |field|
                         add_custom_field_filter(field, assoc)
                       end
                     end
                   end
                 end
               end
               def quoted_time(time, is_custom_filter)
                 if is_custom_filter
                   # Custom field values are stored as strings in the DB
                   # using this format that does not depend on DB date representation
                   time.strftime("%Y-%m-%d %H:%M:%S")
                 else
                   self.class.connection.quoted_date(time)
                 end
               end
               # Returns a SQL clause for a date or datetime field.
               def date_clause(table, field, from, to, is_custom_filter)
                 s = []
                 if from
                   if from.is_a?(Date)
                     from = Time.local(from.year, from.month, from.day).yesterday.end_of_day
                   else
                     from = from - 1 # second
                   end
                   if self.class.default_timezone == :utc
                     from = from.utc
                   end
                   s << ("#{table}.#{field} > '%s'" % [quoted_time(from, is_custom_filter)])
                 end
                 if to
                   if to.is_a?(Date)
                     to = Time.local(to.year, to.month, to.day).end_of_day
                   end
                   if self.class.default_timezone == :utc
                     to = to.utc
                   end
                   s << ("#{table}.#{field} <= '%s'" % [quoted_time(to, is_custom_filter)])
                 end
                 s.join(' AND ')
               end
               # Returns a SQL clause for a date or datetime field using relative dates.
               def relative_date_clause(table, field, days_from, days_to, is_custom_filter)
                 date_clause(table, field, (days_from ? Date.today + days_from : nil), (days_to ? Date.today + days_to : nil), is_custom_filter)
               end
               # Returns a Date or Time from the given filter value
               def parse_date(arg)
                 if arg.to_s =~ /\A\d{4}-\d{2}-\d{2}T/
                   Time.parse(arg) rescue nil
                 else
                   Date.parse(arg) rescue nil
                 end
               end
               # Additional joins required for the given sort options
               def joins_for_order_statement(order_options)
                 joins = []
                 if order_options
                   if order_options.include?('authors')
                     joins << "LEFT OUTER JOIN #{User.table_name} authors ON authors.id = #{queried_table_name}.author_id"
                   end
                   order_options.scan(/cf_\d+/).uniq.each do |name|
                     column = available_columns.detect {|c| c.name.to_s == name}
                     join = column && column.custom_field.join_for_order_statement
                     if join
                       joins << join
                     end
                   end
                 end
                 joins.any? ? joins.join(' ') : nil
               end
             end

app/views/queries/_form.html.erb +8 -6

             <%= error_messages_for 'query' %>
             <div class="box">
             <div class="tabular">
             <%= hidden_field_tag 'gantt', '1' if params[:gantt] %>
             <p><label for="query_name"><%=l(:field_name)%></label>
             <%= text_field 'query', 'name', :size => 80 %></p>
-            <% if User.current.admin? || User.current.allowed_to?(:manage_public_queries, @project) %>
+            <% if User.current.admin? || User.current.allowed_to?(:manage_public_queries, @query.project) %>
             <p><label><%=l(:field_visible)%></label>
               <label class="block"><%= radio_button 'query', 'visibility', Query::VISIBILITY_PRIVATE %> <%= l(:label_visibility_private) %></label>
+              <label class="block"><%= radio_button 'query', 'visibility', Query::VISIBILITY_PUBLIC %> <%= l(:label_visibility_public) %></label>
               <label class="block"><%= radio_button 'query', 'visibility', Query::VISIBILITY_ROLES %> <%= l(:label_visibility_roles) %>:</label>
               <% Role.givable.sorted.each do |role| %>
                 <label class="block role-visibility"><%= check_box_tag 'query[role_ids][]', role.id, @query.roles.include?(role), :id => nil %> <%= role.name %></label>
               <% end %>
-              <label class="block"><%= radio_button 'query', 'visibility', Query::VISIBILITY_PUBLIC %> <%= l(:label_visibility_public) %></label>
               <%= hidden_field_tag 'query[role_ids][]', '' %>
             </p>
             <% end %>
             <p><label for="query_is_for_all"><%=l(:field_is_for_all)%></label>
-            <%= check_box_tag 'query_is_for_all', 1, @query.project.nil?,
+            <%= check_box_tag 'query_is_for_all', 1, @query.project.nil?, :class => (User.current.admin? ? '' : 'disable-unless-private') %></p>
-                  :disabled => (!@query.new_record? && (@query.project.nil? || (@query.is_public? && !User.current.admin?))) %></p>
             <% unless params[:gantt] %>
             <fieldset><legend><%= l(:label_options) %></legend>
             <p><label for="query_default_columns"><%=l(:label_default_columns)%></label>
             <%= check_box_tag 'default_columns', 1, @query.has_default_columns?, :id => 'query_default_columns',
                   :onclick => 'if (this.checked) {$("#columns").hide();} else {$("#columns").show();}' %></p>
             <p><label for="query_group_by"><%= l(:field_group_by) %></label>
             <%= select 'query', 'group_by', @query.groupable_columns.collect {|c| [c.caption, c.name.to_s]}, :include_blank => true %></p>
             <p><label><%= l(:button_show) %></label>
             <%= available_block_columns_tags(@query) %></p>
             </fieldset>
             <% else %>
             <fieldset><legend><%= l(:label_options) %></legend>
               <p><label><%= l(:button_show) %></label>
               <label class="inline"><%= check_box_tag "query[draw_relations]", "1", @query.draw_relations %> <%= l(:label_related_issues) %></label>
               <label class="inline"><%= check_box_tag "query[draw_progress_line]", "1", @query.draw_progress_line %> <%= l(:label_gantt_progress_line) %></label>
               </p>
             </fieldset>
             <% end %>
             </div>
             <fieldset id="filters"><legend><%= l(:label_filter_plural) %></legend>
             <%= render :partial => 'queries/filters', :locals => {:query => query}%>
             </fieldset>
             <% unless params[:gantt] %>
             <fieldset><legend><%= l(:label_sort) %></legend>
             <% 3.times do |i| %>
             <%= i+1 %>:
             <%= label_tag "query_sort_criteria_attribute_" + i.to_s,
                           l(:description_query_sort_criteria_attribute), :class => "hidden-for-sighted" %>
             <%= select_tag("query[sort_criteria][#{i}][]",
                            options_for_select([[]] + query.available_columns.select(&:sortable?).collect {|column| [column.caption, column.name.to_s]}, @query.sort_criteria_key(i)),
                            :id => "query_sort_criteria_attribute_" + i.to_s)%>
             <%= label_tag "query_sort_criteria_direction_" + i.to_s,
                           l(:description_query_sort_criteria_direction), :class => "hidden-for-sighted" %>
             <%= select_tag("query[sort_criteria][#{i}][]",
                             options_for_select([[], [l(:label_ascending), 'asc'], [l(:label_descending), 'desc']], @query.sort_criteria_order(i)),
                             :id => "query_sort_criteria_direction_" + i.to_s) %>
             <br />
             <% end %>
             </fieldset>
             <% end %>
             <% unless params[:gantt] %>
             <%= content_tag 'fieldset', :id => 'columns', :style => (query.has_default_columns? ? 'display:none;' : nil) do %>
             <legend><%= l(:field_column_names) %></legend>
             <%= render_query_columns_selection(query) %>
             <% end %>
             <% end %>
             </div>
             <%= javascript_tag do %>
             $(document).ready(function(){
               $("input[name='query[visibility]']").change(function(){
-                var checked = $('#query_visibility_1').is(':checked');
+                var roles_checked = $('#query_visibility_1').is(':checked');
-                $("input[name='query[role_ids][]'][type=checkbox]").attr('disabled', !checked);
+                var private_checked = $('#query_visibility_0').is(':checked');
+                $("input[name='query[role_ids][]'][type=checkbox]").attr('disabled', !roles_checked);
+                if (!private_checked) $("input.disable-unless-private").attr('checked', false);
+                $("input.disable-unless-private").attr('disabled', !private_checked);
               }).trigger('change');
             });
             <% end %>

test/functional/queries_controller_test.rb +67 -6

             # Redmine - project management software
             # Copyright (C) 2006-2015  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.expand_path('../../test_helper', __FILE__)
             class QueriesControllerTest < ActionController::TestCase
               fixtures :projects, :users, :members, :member_roles, :roles, :trackers, :issue_statuses, :issue_categories, :enumerations, :issues, :custom_fields, :custom_values, :queries, :enabled_modules
               def setup
                 User.current = nil
               end
               def test_index
                 get :index
                 # HTML response not implemented
                 assert_response 406
               end
               def test_new_project_query
                 @request.session[:user_id] = 2
                 get :new, :project_id => 1
                 assert_response :success
                 assert_template 'new'
                 assert_select 'input[name=?][value="0"][checked=checked]', 'query[visibility]'
                 assert_select 'input[name=query_is_for_all][type=checkbox]:not([checked]):not([disabled])'
                 assert_select 'select[name=?]', 'c[]' do
                   assert_select 'option[value=tracker]'
                   assert_select 'option[value=subject]'
                 end
               end
               def test_new_global_query
                 @request.session[:user_id] = 2
                 get :new
                 assert_response :success
                 assert_template 'new'
                 assert_select 'input[name=?]', 'query[visibility]', 0
                 assert_select 'input[name=query_is_for_all][type=checkbox][checked]:not([disabled])'
               end
               def test_new_on_invalid_project
                 @request.session[:user_id] = 2
                 get :new, :project_id => 'invalid'
                 assert_response 404
               end
               def test_create_project_public_query
                 @request.session[:user_id] = 2
                 post :create,
                      :project_id => 'ecookbook',
                      :default_columns => '1',
                      :f => ["status_id", "assigned_to_id"],
                      :op => {"assigned_to_id" => "=", "status_id" => "o"},
                      :v => { "assigned_to_id" => ["1"], "status_id" => ["1"]},
                      :query => {"name" => "test_new_project_public_query", "visibility" => "2"}
                 q = Query.find_by_name('test_new_project_public_query')
                 assert_redirected_to :controller => 'issues', :action => 'index', :project_id => 'ecookbook', :query_id => q
                 assert q.is_public?
                 assert q.has_default_columns?
                 assert q.valid?
               end
               def test_create_project_private_query
                 @request.session[:user_id] = 3
                 post :create,
                      :project_id => 'ecookbook',
                      :default_columns => '1',
                      :fields => ["status_id", "assigned_to_id"],
                      :operators => {"assigned_to_id" => "=", "status_id" => "o"},
                      :values => { "assigned_to_id" => ["1"], "status_id" => ["1"]},
-                     :query => {"name" => "test_new_project_private_query", "visibility" => "2"}
+                     :query => {"name" => "test_new_project_private_query", "visibility" => "0"}
                 q = Query.find_by_name('test_new_project_private_query')
                 assert_redirected_to :controller => 'issues', :action => 'index', :project_id => 'ecookbook', :query_id => q
                 assert !q.is_public?
                 assert q.has_default_columns?
                 assert q.valid?
               end
               def test_create_global_private_query_with_custom_columns
                 @request.session[:user_id] = 3
                 post :create,
                      :fields => ["status_id", "assigned_to_id"],
                      :operators => {"assigned_to_id" => "=", "status_id" => "o"},
                      :values => { "assigned_to_id" => ["me"], "status_id" => ["1"]},
-                     :query => {"name" => "test_new_global_private_query", "visibility" => "2"},
+                     :query => {"name" => "test_new_global_private_query", "visibility" => "0"},
                      :c => ["", "tracker", "subject", "priority", "category"]
                 q = Query.find_by_name('test_new_global_private_query')
                 assert_redirected_to :controller => 'issues', :action => 'index', :project_id => nil, :query_id => q
                 assert !q.is_public?
                 assert !q.has_default_columns?
                 assert_equal [:id, :tracker, :subject, :priority, :category], q.columns.collect {|c| c.name}
                 assert q.valid?
               end
               def test_create_global_query_with_custom_filters
                 @request.session[:user_id] = 3
                 post :create,
                      :fields => ["assigned_to_id"],
                      :operators => {"assigned_to_id" => "="},
                      :values => { "assigned_to_id" => ["me"]},
                      :query => {"name" => "test_new_global_query"}
                 q = Query.find_by_name('test_new_global_query')
                 assert_redirected_to :controller => 'issues', :action => 'index', :project_id => nil, :query_id => q
+                assert !q.is_public?
                 assert !q.has_filter?(:status_id)
                 assert_equal ['assigned_to_id'], q.filters.keys
                 assert q.valid?
               end
               def test_create_with_sort
                 @request.session[:user_id] = 1
                 post :create,
                      :default_columns => '1',
                      :operators => {"status_id" => "o"},
                      :values => {"status_id" => ["1"]},
                      :query => {:name => "test_new_with_sort",
                                 :visibility => "2",
                                 :sort_criteria => {"0" => ["due_date", "desc"], "1" => ["tracker", ""]}}
                 query = Query.find_by_name("test_new_with_sort")
                 assert_not_nil query
                 assert_equal [['due_date', 'desc'], ['tracker', 'asc']], query.sort_criteria
               end
               def test_create_with_failure
                 @request.session[:user_id] = 2
                 assert_no_difference '::Query.count' do
                   post :create, :project_id => 'ecookbook', :query => {:name => ''}
                 end
                 assert_response :success
                 assert_template 'new'
                 assert_select 'input[name=?]', 'query[name]'
               end
               def test_create_global_query_from_gantt
                 @request.session[:user_id] = 1
                 assert_difference 'IssueQuery.count' do
                   post :create,
                        :gantt => 1,
                        :operators => {"status_id" => "o"},
                        :values => {"status_id" => ["1"]},
                        :query => {:name => "test_create_from_gantt",
                                   :draw_relations => '1',
                                   :draw_progress_line => '1'}
                   assert_response 302
                 end
                 query = IssueQuery.order('id DESC').first
                 assert_redirected_to "/issues/gantt?query_id=#{query.id}"
                 assert_equal true, query.draw_relations
                 assert_equal true, query.draw_progress_line
               end
               def test_create_project_query_from_gantt
                 @request.session[:user_id] = 1
                 assert_difference 'IssueQuery.count' do
                   post :create,
                        :project_id => 'ecookbook',
                        :gantt => 1,
                        :operators => {"status_id" => "o"},
                        :values => {"status_id" => ["1"]},
                        :query => {:name => "test_create_from_gantt",
                                   :draw_relations => '0',
                                   :draw_progress_line => '0'}
                   assert_response 302
                 end
                 query = IssueQuery.order('id DESC').first
                 assert_redirected_to "/projects/ecookbook/issues/gantt?query_id=#{query.id}"
                 assert_equal false, query.draw_relations
                 assert_equal false, query.draw_progress_line
               end
+              def test_create_project_public_query_should_force_private_without_manage_public_queries_permission
+                @request.session[:user_id] = 3
+                query = new_record(Query) do
+                  post :create,
+                       :project_id => 'ecookbook',
+                       :query => {"name" => "name", "visibility" => "2"}
+                  assert_response 302
+                end
+                assert_not_nil query.project
+                assert_equal Query::VISIBILITY_PRIVATE, query.visibility
+              end
+              def test_create_global_public_query_should_force_private_without_manage_public_queries_permission
+                @request.session[:user_id] = 3
+                query = new_record(Query) do
+                  post :create,
+                       :project_id => 'ecookbook', :query_is_for_all => '1',
+                       :query => {"name" => "name", "visibility" => "2"}
+                  assert_response 302
+                end
+                assert_nil query.project
+                assert_equal Query::VISIBILITY_PRIVATE, query.visibility
+              end
+              def test_create_project_public_query_with_manage_public_queries_permission
+                @request.session[:user_id] = 2
+                query = new_record(Query) do
+                  post :create,
+                       :project_id => 'ecookbook',
+                       :query => {"name" => "name", "visibility" => "2"}
+                  assert_response 302
+                end
+                assert_not_nil query.project
+                assert_equal Query::VISIBILITY_PUBLIC, query.visibility
+              end
+              def test_create_global_public_query_should_force_private_with_manage_public_queries_permission
+                @request.session[:user_id] = 2
+                query = new_record(Query) do
+                  post :create,
+                       :project_id => 'ecookbook', :query_is_for_all => '1',
+                       :query => {"name" => "name", "visibility" => "2"}
+                  assert_response 302
+                end
+                assert_nil query.project
+                assert_equal Query::VISIBILITY_PRIVATE, query.visibility
+              end
+              def test_create_global_public_query_by_admin
+                @request.session[:user_id] = 1
+                query = new_record(Query) do
+                  post :create,
+                       :project_id => 'ecookbook', :query_is_for_all => '1',
+                       :query => {"name" => "name", "visibility" => "2"}
+                  assert_response 302
+                end
+                assert_nil query.project
+                assert_equal Query::VISIBILITY_PUBLIC, query.visibility
+              end
               def test_edit_global_public_query
                 @request.session[:user_id] = 1
                 get :edit, :id => 4
                 assert_response :success
                 assert_template 'edit'
                 assert_select 'input[name=?][value="2"][checked=checked]', 'query[visibility]'
-                assert_select 'input[name=query_is_for_all][type=checkbox][checked=checked][disabled=disabled]'
+                assert_select 'input[name=query_is_for_all][type=checkbox][checked=checked]'
               end
               def test_edit_global_private_query
                 @request.session[:user_id] = 3
                 get :edit, :id => 3
                 assert_response :success
                 assert_template 'edit'
                 assert_select 'input[name=?]', 'query[visibility]', 0
-                assert_select 'input[name=query_is_for_all][type=checkbox][checked=checked][disabled=disabled]'
+                assert_select 'input[name=query_is_for_all][type=checkbox][checked=checked]'
               end
               def test_edit_project_private_query
                 @request.session[:user_id] = 3
                 get :edit, :id => 2
                 assert_response :success
                 assert_template 'edit'
                 assert_select 'input[name=?]', 'query[visibility]', 0
-                assert_select 'input[name=query_is_for_all][type=checkbox]:not([checked]):not([disabled])'
+                assert_select 'input[name=query_is_for_all][type=checkbox]:not([checked])'
               end
               def test_edit_project_public_query
                 @request.session[:user_id] = 2
                 get :edit, :id => 1
                 assert_response :success
                 assert_template 'edit'
                 assert_select 'input[name=?][value="2"][checked=checked]', 'query[visibility]'
-                assert_select 'input[name=query_is_for_all][type=checkbox][disabled=disabled]:not([checked])'
+                assert_select 'input[name=query_is_for_all][type=checkbox]:not([checked])'
               end
               def test_edit_sort_criteria
                 @request.session[:user_id] = 1
                 get :edit, :id => 5
                 assert_response :success
                 assert_template 'edit'
                 assert_select 'select[name=?]', 'query[sort_criteria][0][]' do
                   assert_select 'option[value=priority][selected=selected]'
                   assert_select 'option[value=desc][selected=selected]'
                 end
               end
               def test_edit_invalid_query
                 @request.session[:user_id] = 2
                 get :edit, :id => 99
                 assert_response 404
               end
               def test_udpate_global_private_query
                 @request.session[:user_id] = 3
                 put :update,
                      :id => 3,
                      :default_columns => '1',
                      :fields => ["status_id", "assigned_to_id"],
                      :operators => {"assigned_to_id" => "=", "status_id" => "o"},
                      :values => { "assigned_to_id" => ["me"], "status_id" => ["1"]},
                      :query => {"name" => "test_edit_global_private_query", "visibility" => "2"}
                 assert_redirected_to :controller => 'issues', :action => 'index', :query_id => 3
                 q = Query.find_by_name('test_edit_global_private_query')
                 assert !q.is_public?
                 assert q.has_default_columns?
                 assert q.valid?
               end
               def test_update_global_public_query
                 @request.session[:user_id] = 1
                 put :update,
                      :id => 4,
                      :default_columns => '1',
                      :fields => ["status_id", "assigned_to_id"],
                      :operators => {"assigned_to_id" => "=", "status_id" => "o"},
                      :values => { "assigned_to_id" => ["1"], "status_id" => ["1"]},
                      :query => {"name" => "test_edit_global_public_query", "visibility" => "2"}
                 assert_redirected_to :controller => 'issues', :action => 'index', :query_id => 4
                 q = Query.find_by_name('test_edit_global_public_query')
                 assert q.is_public?
                 assert q.has_default_columns?
                 assert q.valid?
               end
               def test_update_with_failure
                 @request.session[:user_id] = 1
                 put :update, :id => 4, :query => {:name => ''}
                 assert_response :success
                 assert_template 'edit'
               end
               def test_destroy
                 @request.session[:user_id] = 2
                 delete :destroy, :id => 1
                 assert_redirected_to :controller => 'issues', :action => 'index', :project_id => 'ecookbook', :set_filter => 1, :query_id => nil
                 assert_nil Query.find_by_id(1)
               end
               def test_backslash_should_be_escaped_in_filters
                 @request.session[:user_id] = 2
                 get :new, :subject => 'foo/bar'
                 assert_response :success
                 assert_template 'new'
                 assert_include 'addFilter("subject", "=", ["foo\/bar"]);', response.body
               end
             end

test/test_helper.rb +9 0

             # Redmine - project management software
             # Copyright (C) 2006-2015  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             if ENV["COVERAGE"]
               require 'simplecov'
               require File.expand_path(File.dirname(__FILE__) + "/coverage/html_formatter")
               SimpleCov.formatter = Redmine::Coverage::HtmlFormatter
               SimpleCov.start 'rails'
             end
             ENV["RAILS_ENV"] = "test"
             require File.expand_path(File.dirname(__FILE__) + "/../config/environment")
             require 'rails/test_help'
             require Rails.root.join('test', 'mocks', 'open_id_authentication_mock.rb').to_s
             require File.expand_path(File.dirname(__FILE__) + '/object_helpers')
             include ObjectHelpers
             require 'net/ldap'
             require 'mocha/setup'
             class ActionView::TestCase
               helper :application
               include ApplicationHelper
             end
             class ActiveSupport::TestCase
               include ActionDispatch::TestProcess
               self.use_transactional_fixtures = true
               self.use_instantiated_fixtures  = false
               def uploaded_test_file(name, mime)
                 fixture_file_upload("files/#{name}", mime, true)
               end
               # Mock out a file
               def self.mock_file
                 file = 'a_file.png'
                 file.stubs(:size).returns(32)
                 file.stubs(:original_filename).returns('a_file.png')
                 file.stubs(:content_type).returns('image/png')
                 file.stubs(:read).returns(false)
                 file
               end
               def mock_file
                 self.class.mock_file
               end
               def mock_file_with_options(options={})
                 file = ''
                 file.stubs(:size).returns(32)
                 original_filename = options[:original_filename] || nil
                 file.stubs(:original_filename).returns(original_filename)
                 content_type = options[:content_type] || nil
                 file.stubs(:content_type).returns(content_type)
                 file.stubs(:read).returns(false)
                 file
               end
               # Use a temporary directory for attachment related tests
               def set_tmp_attachments_directory
                 Dir.mkdir "#{Rails.root}/tmp/test" unless File.directory?("#{Rails.root}/tmp/test")
                 unless File.directory?("#{Rails.root}/tmp/test/attachments")
                   Dir.mkdir "#{Rails.root}/tmp/test/attachments"
                 end
                 Attachment.storage_path = "#{Rails.root}/tmp/test/attachments"
               end
               def set_fixtures_attachments_directory
                 Attachment.storage_path = "#{Rails.root}/test/fixtures/files"
               end
               def with_settings(options, &block)
                 saved_settings = options.keys.inject({}) do |h, k|
                   h[k] = case Setting[k]
                     when Symbol, false, true, nil
                       Setting[k]
                     else
                       Setting[k].dup
                     end
                   h
                 end
                 options.each {|k, v| Setting[k] = v}
                 yield
               ensure
                 saved_settings.each {|k, v| Setting[k] = v} if saved_settings
               end
               # Yields the block with user as the current user
               def with_current_user(user, &block)
                 saved_user = User.current
                 User.current = user
                 yield
               ensure
                 User.current = saved_user
               end
               def with_locale(locale, &block)
                 saved_localed = ::I18n.locale
                 ::I18n.locale = locale
                 yield
               ensure
                 ::I18n.locale = saved_localed
               end
               def self.ldap_configured?
                 @test_ldap = Net::LDAP.new(:host => '127.0.0.1', :port => 389)
                 return @test_ldap.bind
               rescue Exception => e
                 # LDAP is not listening
                 return nil
               end
               def self.convert_installed?
                 Redmine::Thumbnail.convert_available?
               end
               def convert_installed?
                 self.class.convert_installed?
               end
               # Returns the path to the test +vendor+ repository
               def self.repository_path(vendor)
                 path = Rails.root.join("tmp/test/#{vendor.downcase}_repository").to_s
                 # Unlike ruby, JRuby returns Rails.root with backslashes under Windows
                 path.tr("\\", "/")
               end
               # Returns the url of the subversion test repository
               def self.subversion_repository_url
                 path = repository_path('subversion')
                 path = '/' + path unless path.starts_with?('/')
                 "file://#{path}"
               end
               # Returns true if the +vendor+ test repository is configured
               def self.repository_configured?(vendor)
                 File.directory?(repository_path(vendor))
               end
               def repository_path_hash(arr)
                 hs = {}
                 hs[:path]  = arr.join("/")
                 hs[:param] = arr.join("/")
                 hs
               end
               def sqlite?
                 ActiveRecord::Base.connection.adapter_name =~ /sqlite/i
               end
               def mysql?
                 ActiveRecord::Base.connection.adapter_name =~ /mysql/i
               end
               def postgresql?
                 ActiveRecord::Base.connection.adapter_name =~ /postgresql/i
               end
               def quoted_date(date)
                 date = Date.parse(date) if date.is_a?(String)
                 ActiveRecord::Base.connection.quoted_date(date)
               end
+            	# Asserts that a new record for the given class is created
+            	# and returns it
+              def new_record(klass, &block)
+                assert_difference "#{klass}.count" do
+                  yield
+                end
+                klass.order(:id => :desc).first
+              end
               def assert_save(object)
                 saved = object.save
                 message = "#{object.class} could not be saved"
                 errors = object.errors.full_messages.map {|m| "- #{m}"}
                 message << ":\n#{errors.join("\n")}" if errors.any?
                 assert_equal true, saved, message
               end
               def assert_select_error(arg)
                 assert_select '#errorExplanation', :text => arg
               end
               def assert_include(expected, s, message=nil)
                 assert s.include?(expected), (message || "\"#{expected}\" not found in \"#{s}\"")
               end
               def assert_not_include(expected, s, message=nil)
                 assert !s.include?(expected), (message || "\"#{expected}\" found in \"#{s}\"")
               end
               def assert_select_in(text, *args, &block)
                 d = Nokogiri::HTML(CGI::unescapeHTML(String.new(text))).root
                 assert_select(d, *args, &block)
               end
               def assert_select_email(*args, &block)
                 email = ActionMailer::Base.deliveries.last
                 assert_not_nil email
                 html_body = email.parts.detect {|part| part.content_type.include?('text/html')}.try(&:body)
                 assert_not_nil html_body
                 assert_select_in html_body.encoded, *args, &block
               end
               def assert_mail_body_match(expected, mail, message=nil)
                 if expected.is_a?(String)
                   assert_include expected, mail_body(mail), message
                 else
                   assert_match expected, mail_body(mail), message
                 end
               end
               def assert_mail_body_no_match(expected, mail, message=nil)
                 if expected.is_a?(String)
                   assert_not_include expected, mail_body(mail), message
                 else
                   assert_no_match expected, mail_body(mail), message
                 end
               end
               def mail_body(mail)
                 mail.parts.first.body.encoded
               end
               # Returns the lft value for a new root issue
               def new_issue_lft
               end
             end
             module Redmine
               class RoutingTest < ActionDispatch::IntegrationTest
                 def should_route(arg)
                   arg = arg.dup
                   request = arg.keys.detect {|key| key.is_a?(String)}
                   raise ArgumentError unless request
                   options = arg.slice!(request)
                   raise ArgumentError unless request =~ /\A(GET|POST|PUT|PATCH|DELETE)\s+(.+)\z/
                   method, path = $1.downcase.to_sym, $2
                   raise ArgumentError unless arg.values.first =~ /\A(.+)#(.+)\z/
                   controller, action = $1, $2
                   assert_routing(
                     {:method => method, :path => path},
                     options.merge(:controller => controller, :action => action)
                   )
                 end
               end
               class IntegrationTest < ActionDispatch::IntegrationTest
                 def log_user(login, password)
                   User.anonymous
                   get "/login"
                   assert_equal nil, session[:user_id]
                   assert_response :success
                   assert_template "account/login"
                   post "/login", :username => login, :password => password
                   assert_equal login, User.find(session[:user_id]).login
                 end
                 def credentials(user, password=nil)
                   {'HTTP_AUTHORIZATION' => ActionController::HttpAuthentication::Basic.encode_credentials(user, password || user)}
                 end
               end
               module ApiTest
                 API_FORMATS = %w(json xml).freeze
                 # Base class for API tests
                 class Base < Redmine::IntegrationTest
                   def setup
                     Setting.rest_api_enabled = '1'
                   end
                   def teardown
                     Setting.rest_api_enabled = '0'
                   end
                   # Uploads content using the XML API and returns the attachment token
                   def xml_upload(content, credentials)
                     upload('xml', content, credentials)
                   end
                   # Uploads content using the JSON API and returns the attachment token
                   def json_upload(content, credentials)
                     upload('json', content, credentials)
                   end
                   def upload(format, content, credentials)
                     set_tmp_attachments_directory
                     assert_difference 'Attachment.count' do
                       post "/uploads.#{format}", content, {"CONTENT_TYPE" => 'application/octet-stream'}.merge(credentials)
                       assert_response :created
                     end
                     data = response_data
                     assert_kind_of Hash, data['upload']
                     token = data['upload']['token']
                     assert_not_nil token
                     token
                   end
                   # Parses the response body based on its content type
                   def response_data
                     unless response.content_type.to_s =~ /^application\/(.+)/
                       raise "Unexpected response type: #{response.content_type}"
                     end
                     format = $1
                     case format
                     when 'xml'
                       Hash.from_xml(response.body)
                     when 'json'
                       ActiveSupport::JSON.decode(response.body)
                     else
                       raise "Unknown response format: #{format}"
                     end
                   end
                 end
                 class Routing < Redmine::RoutingTest
                   def should_route(arg)
                     arg = arg.dup
                     request = arg.keys.detect {|key| key.is_a?(String)}
                     raise ArgumentError unless request
                     options = arg.slice!(request)
                     API_FORMATS.each do |format|
                       format_request = request.sub /$/, ".#{format}"
                       super options.merge(format_request => arg[request], :format => format)
                     end
                   end
                 end
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages