| @@ -0,0 +1,9 | |||
|
|
1 | class AddRolesIssuesVisibility < ActiveRecord::Migration | |
|
|
2 | def self.up | |
|
|
3 | add_column :roles, :issues_visibility, :string, :limit => 30, :default => 'default', :null => false | |
|
|
4 | end | |
|
|
5 | ||
|
|
6 | def self.down | |
|
|
7 | remove_column :roles, :issues_visibility | |
|
|
8 | end | |
|
|
9 | end | |
| @@ -1,5 +1,5 | |||
|
|
1 |
# |
|
|
|
2 |
# Copyright (C) 2006-20 |
|
|
|
1 | # Redmine - project management software | |
|
|
2 | # Copyright (C) 2006-2011 Jean-Philippe Lang | |
|
|
3 | 3 | # |
|
|
4 | 4 | # This program is free software; you can redistribute it and/or |
|
|
5 | 5 | # modify it under the terms of the GNU General Public License |
| @@ -221,6 +221,10 class ApplicationController < ActionController::Base | |||
|
|
221 | 221 | def find_issues |
|
|
222 | 222 | @issues = Issue.find_all_by_id(params[:id] || params[:ids]) |
|
|
223 | 223 | raise ActiveRecord::RecordNotFound if @issues.empty? |
|
|
224 | if @issues.detect {|issue| !issue.visible?} | |
|
|
225 | deny_access | |
|
|
226 | return | |
|
|
227 | end | |
|
|
224 | 228 | @projects = @issues.collect(&:project).compact.uniq |
|
|
225 | 229 | @project = @projects.first if @projects.size == 1 |
|
|
226 | 230 | rescue ActiveRecord::RecordNotFound |
| @@ -1,5 +1,5 | |||
|
|
1 | 1 | # Redmine - project management software |
|
|
2 |
# Copyright (C) 2006-20 |
|
|
|
2 | # Copyright (C) 2006-2011 Jean-Philippe Lang | |
|
|
3 | 3 | # |
|
|
4 | 4 | # This program is free software; you can redistribute it and/or |
|
|
5 | 5 | # modify it under the terms of the GNU General Public License |
| @@ -251,7 +251,13 class IssuesController < ApplicationController | |||
|
|
251 | 251 | |
|
|
252 | 252 | private |
|
|
253 | 253 | def find_issue |
|
|
254 | # Issue.visible.find(...) can not be used to redirect user to the login form | |
|
|
255 | # if the issue actually exists but requires authentication | |
|
|
254 | 256 | @issue = Issue.find(params[:id], :include => [:project, :tracker, :status, :author, :priority, :category]) |
|
|
257 | unless @issue.visible? | |
|
|
258 | deny_access | |
|
|
259 | return | |
|
|
260 | end | |
|
|
255 | 261 | @project = @issue.project |
|
|
256 | 262 | rescue ActiveRecord::RecordNotFound |
|
|
257 | 263 | render_404 |
| @@ -88,12 +88,30 class Issue < ActiveRecord::Base | |||
|
|
88 | 88 | |
|
|
89 | 89 | # Returns a SQL conditions string used to find all issues visible by the specified user |
|
|
90 | 90 | def self.visible_condition(user, options={}) |
|
|
91 | Project.allowed_to_condition(user, :view_issues, options) | |
|
|
91 | Project.allowed_to_condition(user, :view_issues, options) do |role, user| | |
|
|
92 | case role.issues_visibility | |
|
|
93 | when 'default' | |
|
|
94 | nil | |
|
|
95 | when 'own' | |
|
|
96 | "(#{table_name}.author_id = #{user.id} OR #{table_name}.assigned_to_id = #{user.id})" | |
|
|
97 | else | |
|
|
98 | '1=0' | |
|
|
99 | end | |
|
|
100 | end | |
|
|
92 | 101 | end |
|
|
93 | 102 | |
|
|
94 | 103 | # Returns true if usr or current user is allowed to view the issue |
|
|
95 | 104 | def visible?(usr=nil) |
|
|
96 | (usr || User.current).allowed_to?(:view_issues, self.project) | |
|
|
105 | (usr || User.current).allowed_to?(:view_issues, self.project) do |role, user| | |
|
|
106 | case role.issues_visibility | |
|
|
107 | when 'default' | |
|
|
108 | true | |
|
|
109 | when 'own' | |
|
|
110 | self.author == user || self.assigned_to == user | |
|
|
111 | else | |
|
|
112 | false | |
|
|
113 | end | |
|
|
114 | end | |
|
|
97 | 115 | end |
|
|
98 | 116 | |
|
|
99 | 117 | def after_initialize |
| @@ -174,6 +174,13 class Project < ActiveRecord::Base | |||
|
|
174 | 174 | if statement_by_role.empty? |
|
|
175 | 175 | "1=0" |
|
|
176 | 176 | else |
|
|
177 | if block_given? | |
|
|
178 | statement_by_role.each do |role, statement| | |
|
|
179 | if s = yield(role, user) | |
|
|
180 | statement_by_role[role] = "(#{statement} AND (#{s}))" | |
|
|
181 | end | |
|
|
182 | end | |
|
|
183 | end | |
|
|
177 | 184 | "((#{base_statement}) AND (#{statement_by_role.values.join(' OR ')}))" |
|
|
178 | 185 | end |
|
|
179 | 186 | end |
| @@ -19,6 +19,11 class Role < ActiveRecord::Base | |||
|
|
19 | 19 | # Built-in roles |
|
|
20 | 20 | BUILTIN_NON_MEMBER = 1 |
|
|
21 | 21 | BUILTIN_ANONYMOUS = 2 |
|
|
22 | ||
|
|
23 | ISSUES_VISIBILITY_OPTIONS = [ | |
|
|
24 | ['default', :label_issues_visibility_all], | |
|
|
25 | ['own', :label_issues_visibility_own] | |
|
|
26 | ] | |
|
|
22 | 27 | |
|
|
23 | 28 | named_scope :givable, { :conditions => "builtin = 0", :order => 'position' } |
|
|
24 | 29 | named_scope :builtin, lambda { |*args| |
| @@ -43,7 +48,10 class Role < ActiveRecord::Base | |||
|
|
43 | 48 | validates_presence_of :name |
|
|
44 | 49 | validates_uniqueness_of :name |
|
|
45 | 50 | validates_length_of :name, :maximum => 30 |
|
|
46 | ||
|
|
51 | validates_inclusion_of :issues_visibility, | |
|
|
52 | :in => ISSUES_VISIBILITY_OPTIONS.collect(&:first), | |
|
|
53 | :if => lambda {|role| role.respond_to?(:issues_visibility)} | |
|
|
54 | ||
|
|
47 | 55 | def permissions |
|
|
48 | 56 | read_attribute(:permissions) || [] |
|
|
49 | 57 | end |
| @@ -394,10 +394,10 class User < Principal | |||
|
|
394 | 394 | # * a permission Symbol (eg. :edit_project) |
|
|
395 | 395 | # Context can be: |
|
|
396 | 396 | # * a project : returns true if user is allowed to do the specified action on this project |
|
|
397 |
# * a |
|
|
|
397 | # * an array of projects : returns true if user is allowed on every project | |
|
|
398 | 398 | # * nil with options[:global] set : check if user has at least one role allowed for this action, |
|
|
399 | 399 | # or falls back to Non Member / Anonymous permissions depending if the user is logged |
|
|
400 | def allowed_to?(action, context, options={}) | |
|
|
400 | def allowed_to?(action, context, options={}, &block) | |
|
|
401 | 401 | if context && context.is_a?(Project) |
|
|
402 | 402 | # No action allowed on archived projects |
|
|
403 | 403 | return false unless context.active? |
| @@ -408,12 +408,15 class User < Principal | |||
|
|
408 | 408 | |
|
|
409 | 409 | roles = roles_for_project(context) |
|
|
410 | 410 | return false unless roles |
|
|
411 | roles.detect {|role| (context.is_public? || role.member?) && role.allowed_to?(action)} | |
|
|
412 | ||
|
|
411 | roles.detect {|role| | |
|
|
412 | (context.is_public? || role.member?) && | |
|
|
413 | role.allowed_to?(action) && | |
|
|
414 | (block_given? ? yield(role, self) : true) | |
|
|
415 | } | |
|
|
413 | 416 | elsif context && context.is_a?(Array) |
|
|
414 | 417 | # Authorize if user is authorized on every element of the array |
|
|
415 | 418 | context.map do |project| |
|
|
416 | allowed_to?(action,project,options) | |
|
|
419 | allowed_to?(action, project, options, &block) | |
|
|
417 | 420 | end.inject do |memo,allowed| |
|
|
418 | 421 | memo && allowed |
|
|
419 | 422 | end |
| @@ -423,7 +426,11 class User < Principal | |||
|
|
423 | 426 | |
|
|
424 | 427 | # authorize if user has at least one role that has this permission |
|
|
425 | 428 | roles = memberships.collect {|m| m.roles}.flatten.uniq |
|
|
426 |
roles |
|
|
|
429 | roles << (self.logged? ? Role.non_member : Role.anonymous) | |
|
|
430 | roles.detect {|role| | |
|
|
431 | role.allowed_to?(action) && | |
|
|
432 | (block_given? ? yield(role, self) : true) | |
|
|
433 | } | |
|
|
427 | 434 | else |
|
|
428 | 435 | false |
|
|
429 | 436 | end |
| @@ -431,8 +438,8 class User < Principal | |||
|
|
431 | 438 | |
|
|
432 | 439 | # Is the user allowed to do the specified action on any project? |
|
|
433 | 440 | # See allowed_to? for the actions and valid options. |
|
|
434 | def allowed_to_globally?(action, options) | |
|
|
435 | allowed_to?(action, nil, options.reverse_merge(:global => true)) | |
|
|
441 | def allowed_to_globally?(action, options, &block) | |
|
|
442 | allowed_to?(action, nil, options.reverse_merge(:global => true), &block) | |
|
|
436 | 443 | end |
|
|
437 | 444 | |
|
|
438 | 445 | safe_attributes 'login', |
| @@ -1,15 +1,16 | |||
|
|
1 | 1 | <%= error_messages_for 'role' %> |
|
|
2 | 2 | |
|
|
3 | <% unless @role.builtin? %> | |
|
|
4 | 3 | <div class="box"> |
|
|
4 | <% unless @role.builtin? %> | |
|
|
5 | 5 | <p><%= f.text_field :name, :required => true %></p> |
|
|
6 | 6 | <p><%= f.check_box :assignable %></p> |
|
|
7 | <% end %> | |
|
|
8 | <p><%= f.select :issues_visibility, Role::ISSUES_VISIBILITY_OPTIONS.collect {|v| [l(v.last), v.first]} %></p> | |
|
|
7 | 9 | <% if @role.new_record? && @roles.any? %> |
|
|
8 | 10 | <p><label><%= l(:label_copy_workflow_from) %></label> |
|
|
9 | 11 | <%= select_tag(:copy_workflow_from, content_tag("option") + options_from_collection_for_select(@roles, :id, :name)) %></p> |
|
|
10 | 12 | <% end %> |
|
|
11 | 13 | </div> |
|
|
12 | <% end %> | |
|
|
13 | 14 | |
|
|
14 | 15 | <h3><%= l(:label_permissions) %></h3> |
|
|
15 | 16 | <div class="box" id="permissions"> |
| @@ -304,6 +304,7 en: | |||
|
|
304 | 304 | field_text: Text field |
|
|
305 | 305 | field_visible: Visible |
|
|
306 | 306 | field_warn_on_leaving_unsaved: "Warn me when leaving a page with unsaved text" |
|
|
307 | field_issues_visibility: Issues visibility | |
|
|
307 | 308 | |
|
|
308 | 309 | setting_app_title: Application title |
|
|
309 | 310 | setting_app_subtitle: Application subtitle |
| @@ -804,6 +805,8 en: | |||
|
|
804 | 805 | label_user_search: "Search for user:" |
|
|
805 | 806 | label_additional_workflow_transitions_for_author: Additional transitions allowed when the user is the author |
|
|
806 | 807 | label_additional_workflow_transitions_for_assignee: Additional transitions allowed when the user is the assignee |
|
|
808 | label_issues_visibility_all: All issues | |
|
|
809 | label_issues_visibility_own: Issues created by or assigned to the user | |
|
|
807 | 810 | |
|
|
808 | 811 | button_login: Login |
|
|
809 | 812 | button_submit: Submit |
| @@ -308,6 +308,7 fr: | |||
|
|
308 | 308 | field_parent_issue: TΓ’che parente |
|
|
309 | 309 | field_visible: Visible |
|
|
310 | 310 | field_warn_on_leaving_unsaved: "M'avertir lorsque je quitte une page contenant du texte non sauvegardΓ©" |
|
|
311 | field_issues_visibility: VisibilitΓ© des demandes | |
|
|
311 | 312 | |
|
|
312 | 313 | setting_app_title: Titre de l'application |
|
|
313 | 314 | setting_app_subtitle: Sous-titre de l'application |
| @@ -791,6 +792,8 fr: | |||
|
|
791 | 792 | label_user_search: "Rechercher un utilisateur :" |
|
|
792 | 793 | label_additional_workflow_transitions_for_author: Autorisations supplémentaires lorsque l'utilisateur a créé la demande |
|
|
793 | 794 | label_additional_workflow_transitions_for_assignee: Autorisations supplΓ©mentaires lorsque la demande est assignΓ©e Γ l'utilisateur |
|
|
795 | label_issues_visibility_all: Toutes les demandes | |
|
|
796 | label_issues_visibility_own: Demandes créées par ou assignées à l'utilisateur | |
|
|
794 | 797 | |
|
|
795 | 798 | button_login: Connexion |
|
|
796 | 799 | button_submit: Soumettre |
| @@ -3,6 +3,7 roles_001: | |||
|
|
3 | 3 | name: Manager |
|
|
4 | 4 | id: 1 |
|
|
5 | 5 | builtin: 0 |
|
|
6 | issues_visibility: default | |
|
|
6 | 7 | permissions: | |
|
|
7 | 8 | --- |
|
|
8 | 9 | - :add_project |
| @@ -58,6 +59,7 roles_002: | |||
|
|
58 | 59 | name: Developer |
|
|
59 | 60 | id: 2 |
|
|
60 | 61 | builtin: 0 |
|
|
62 | issues_visibility: default | |
|
|
61 | 63 | permissions: | |
|
|
62 | 64 | --- |
|
|
63 | 65 | - :edit_project |
| @@ -102,6 +104,7 roles_003: | |||
|
|
102 | 104 | name: Reporter |
|
|
103 | 105 | id: 3 |
|
|
104 | 106 | builtin: 0 |
|
|
107 | issues_visibility: default | |
|
|
105 | 108 | permissions: | |
|
|
106 | 109 | --- |
|
|
107 | 110 | - :edit_project |
| @@ -140,6 +143,7 roles_004: | |||
|
|
140 | 143 | name: Non member |
|
|
141 | 144 | id: 4 |
|
|
142 | 145 | builtin: 1 |
|
|
146 | issues_visibility: default | |
|
|
143 | 147 | permissions: | |
|
|
144 | 148 | --- |
|
|
145 | 149 | - :view_issues |
| @@ -170,6 +174,7 roles_005: | |||
|
|
170 | 174 | name: Anonymous |
|
|
171 | 175 | id: 5 |
|
|
172 | 176 | builtin: 2 |
|
|
177 | issues_visibility: default | |
|
|
173 | 178 | permissions: | |
|
|
174 | 179 | --- |
|
|
175 | 180 | - :view_issues |
| @@ -65,35 +65,76 class IssueTest < ActiveSupport::TestCase | |||
|
|
65 | 65 | assert_equal 'PostgreSQL', issue.custom_value_for(field).value |
|
|
66 | 66 | end |
|
|
67 | 67 | |
|
|
68 | def assert_visibility_match(user, issues) | |
|
|
69 | assert_equal issues.collect(&:id).sort, Issue.all.select {|issue| issue.visible?(user)}.collect(&:id).sort | |
|
|
70 | end | |
|
|
71 | ||
|
|
68 | 72 | def test_visible_scope_for_anonymous |
|
|
69 | 73 | # Anonymous user should see issues of public projects only |
|
|
70 | 74 | issues = Issue.visible(User.anonymous).all |
|
|
71 | 75 | assert issues.any? |
|
|
72 | 76 | assert_nil issues.detect {|issue| !issue.project.is_public?} |
|
|
77 | assert_visibility_match User.anonymous, issues | |
|
|
78 | end | |
|
|
79 | ||
|
|
80 | def test_visible_scope_for_anonymous_with_own_issues_visibility | |
|
|
81 | Role.anonymous.update_attribute :issues_visibility, 'own' | |
|
|
82 | Issue.create!(:project_id => 1, :tracker_id => 1, :author_id => User.anonymous.id, :subject => 'Issue by anonymous') | |
|
|
83 | ||
|
|
84 | issues = Issue.visible(User.anonymous).all | |
|
|
85 | assert issues.any? | |
|
|
86 | assert_nil issues.detect {|issue| issue.author != User.anonymous} | |
|
|
87 | assert_visibility_match User.anonymous, issues | |
|
|
88 | end | |
|
|
89 | ||
|
|
90 | def test_visible_scope_for_anonymous_without_view_issues_permissions | |
|
|
73 | 91 | # Anonymous user should not see issues without permission |
|
|
74 | 92 | Role.anonymous.remove_permission!(:view_issues) |
|
|
75 | 93 | issues = Issue.visible(User.anonymous).all |
|
|
76 | 94 | assert issues.empty? |
|
|
95 | assert_visibility_match User.anonymous, issues | |
|
|
77 | 96 | end |
|
|
78 | 97 | |
|
|
79 |
def test_visible_scope_for_ |
|
|
|
98 | def test_visible_scope_for_non_member | |
|
|
80 | 99 | user = User.find(9) |
|
|
81 | 100 | assert user.projects.empty? |
|
|
82 | 101 | # Non member user should see issues of public projects only |
|
|
83 | 102 | issues = Issue.visible(user).all |
|
|
84 | 103 | assert issues.any? |
|
|
85 | 104 | assert_nil issues.detect {|issue| !issue.project.is_public?} |
|
|
105 | assert_visibility_match user, issues | |
|
|
106 | end | |
|
|
107 | ||
|
|
108 | def test_visible_scope_for_non_member_with_own_issues_visibility | |
|
|
109 | Role.non_member.update_attribute :issues_visibility, 'own' | |
|
|
110 | Issue.create!(:project_id => 1, :tracker_id => 1, :author_id => 9, :subject => 'Issue by non member') | |
|
|
111 | user = User.find(9) | |
|
|
112 | ||
|
|
113 | issues = Issue.visible(user).all | |
|
|
114 | assert issues.any? | |
|
|
115 | assert_nil issues.detect {|issue| issue.author != user} | |
|
|
116 | assert_visibility_match user, issues | |
|
|
117 | end | |
|
|
118 | ||
|
|
119 | def test_visible_scope_for_non_member_without_view_issues_permissions | |
|
|
86 | 120 | # Non member user should not see issues without permission |
|
|
87 | 121 | Role.non_member.remove_permission!(:view_issues) |
|
|
88 | user.reload | |
|
|
122 | user = User.find(9) | |
|
|
123 | assert user.projects.empty? | |
|
|
89 | 124 | issues = Issue.visible(user).all |
|
|
90 | 125 | assert issues.empty? |
|
|
126 | assert_visibility_match user, issues | |
|
|
127 | end | |
|
|
128 | ||
|
|
129 | def test_visible_scope_for_member | |
|
|
130 | user = User.find(9) | |
|
|
91 | 131 | # User should see issues of projects for which he has view_issues permissions only |
|
|
132 | Role.non_member.remove_permission!(:view_issues) | |
|
|
92 | 133 | Member.create!(:principal => user, :project_id => 2, :role_ids => [1]) |
|
|
93 | user.reload | |
|
|
94 | 134 | issues = Issue.visible(user).all |
|
|
95 | 135 | assert issues.any? |
|
|
96 | 136 | assert_nil issues.detect {|issue| issue.project_id != 2} |
|
|
137 | assert_visibility_match user, issues | |
|
|
97 | 138 | end |
|
|
98 | 139 | |
|
|
99 | 140 | def test_visible_scope_for_admin |
| @@ -104,6 +145,7 class IssueTest < ActiveSupport::TestCase | |||
|
|
104 | 145 | assert issues.any? |
|
|
105 | 146 | # Admin should see issues on private projects that he does not belong to |
|
|
106 | 147 | assert issues.detect {|issue| !issue.project.is_public?} |
|
|
148 | assert_visibility_match user, issues | |
|
|
107 | 149 | end |
|
|
108 | 150 | |
|
|
109 | 151 | def test_visible_scope_with_project |
General Comments 0
You need to be logged in to leave comments.
Login now