jro_apps/redmine Commit - r14021:b54924d48bae

Merged r14388 (#19842)....

Jean-Philippe Lang -

r14021:b54924d48bae

parent child

Context file:

r14021:b54924d48bae

Collapse all files

app/controllers/queries_controller.rb +18 -11

              # Redmine - project management software
              # Copyright (C) 2006-2015  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              class QueriesController < ApplicationController
                menu_item :issues
                before_filter :find_query, :except => [:new, :create, :index]
                before_filter :find_optional_project, :only => [:new, :create]
                accept_api_auth :index
                include QueriesHelper
                def index
                  case params[:format]
                  when 'xml', 'json'
                    @offset, @limit = api_offset_and_limit
                  else
                    @limit = per_page_option
                  end
                  @query_count = IssueQuery.visible.count
                  @query_pages = Paginator.new @query_count, @limit, params['page']
                  @queries = IssueQuery.visible.
                                  order("#{Query.table_name}.name").
                                  limit(@limit).
                                  offset(@offset).
                                  to_a
                  respond_to do |format|
                    format.html {render_error :status => 406}
                    format.api
                  end
                end
                def new
                  @query = IssueQuery.new
                  @query.user = User.current
                  @query.project = @project
-                 @query.visibility = IssueQuery::VISIBILITY_PRIVATE unless User.current.allowed_to?(:manage_public_queries, @project) || User.current.admin?
                  @query.build_from_params(params)
                end
                def create
-                 @query = IssueQuery.new(params[:query])
+                 @query = IssueQuery.new
                  @query.user = User.current
-                 @query.project = params[:query_is_for_all] ? nil : @project
-                 @query.visibility = IssueQuery::VISIBILITY_PRIVATE unless User.current.allowed_to?(:manage_public_queries, @project) || User.current.admin?
-                 @query.build_from_params(params)
-                 @query.column_names = nil if params[:default_columns]
+                 @query.project = @project
+                 update_query_from_params
                  if @query.save
                    flash[:notice] = l(:notice_successful_create)
                    redirect_to_issues(:query_id => @query)
                  else
                    render :action => 'new', :layout => !request.xhr?
                  end
                end
                def edit
                end
                def update
-                 @query.attributes = params[:query]
-                 @query.project = nil if params[:query_is_for_all]
-                 @query.visibility = IssueQuery::VISIBILITY_PRIVATE unless User.current.allowed_to?(:manage_public_queries, @project) || User.current.admin?
-                 @query.build_from_params(params)
-                 @query.column_names = nil if params[:default_columns]
+                 update_query_from_params
                  if @query.save
                    flash[:notice] = l(:notice_successful_update)
                    redirect_to_issues(:query_id => @query)
                  else
                    render :action => 'edit'
                  end
                end
                def destroy
                  @query.destroy
                  redirect_to_issues(:set_filter => 1)
                end
              private
                def find_query
                  @query = IssueQuery.find(params[:id])
                  @project = @query.project
                  render_403 unless @query.editable_by?(User.current)
                rescue ActiveRecord::RecordNotFound
                  render_404
                end
                def find_optional_project
                  @project = Project.find(params[:project_id]) if params[:project_id]
                  render_403 unless User.current.allowed_to?(:save_queries, @project, :global => true)
                rescue ActiveRecord::RecordNotFound
                  render_404
                end
+               def update_query_from_params
+                 @query.project = params[:query_is_for_all] ? nil : @project
+                 @query.build_from_params(params)
+                 @query.column_names = nil if params[:default_columns]
+                 @query.sort_criteria = params[:query] && params[:query][:sort_criteria]
+                 @query.name = params[:query] && params[:query][:name]
+                 if User.current.allowed_to?(:manage_public_queries, @query.project) || User.current.admin?
+                   @query.visibility = (params[:query] && params[:query][:visibility]) || IssueQuery::VISIBILITY_PRIVATE
+                 else
+                   @query.visibility = IssueQuery::VISIBILITY_PRIVATE
+                 end
+                 @query
+               end
                def redirect_to_issues(options)
                  if params[:gantt]
                    if @project
                      redirect_to project_gantt_path(@project, options)
                    else
                      redirect_to issues_gantt_path(options)
                    end
                  else
                    redirect_to _project_issues_path(@project, options)
                  end
                end
              end

app/models/query.rb +2 0

              # Redmine - project management software
              # Copyright (C) 2006-2015  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              class QueryColumn
                attr_accessor :name, :sortable, :groupable, :default_order
                include Redmine::I18n
                def initialize(name, options={})
                  self.name = name
                  self.sortable = options[:sortable]
                  self.groupable = options[:groupable] || false
                  if groupable == true
                    self.groupable = name.to_s
                  end
                  self.default_order = options[:default_order]
                  @inline = options.key?(:inline) ? options[:inline] : true
                  @caption_key = options[:caption] || "field_#{name}".to_sym
                  @frozen = options[:frozen]
                end
                def caption
                  case @caption_key
                  when Symbol
                    l(@caption_key)
                  when Proc
                    @caption_key.call
                  else
                    @caption_key
                  end
                end
                # Returns true if the column is sortable, otherwise false
                def sortable?
                  !@sortable.nil?
                end
                def sortable
                  @sortable.is_a?(Proc) ? @sortable.call : @sortable
                end
                def inline?
                  @inline
                end
                def frozen?
                  @frozen
                end
                def value(object)
                  object.send name
                end
                def value_object(object)
                  object.send name
                end
                def css_classes
                  name
                end
              end
              class QueryCustomFieldColumn < QueryColumn
                def initialize(custom_field)
                  self.name = "cf_#{custom_field.id}".to_sym
                  self.sortable = custom_field.order_statement || false
                  self.groupable = custom_field.group_statement || false
                  @inline = true
                  @cf = custom_field
                end
                def caption
                  @cf.name
                end
                def custom_field
                  @cf
                end
                def value_object(object)
                  if custom_field.visible_by?(object.project, User.current)
                    cv = object.custom_values.select {|v| v.custom_field_id == @cf.id}
                    cv.size > 1 ? cv.sort {|a,b| a.value.to_s <=> b.value.to_s} : cv.first
                  else
                    nil
                  end
                end
                def value(object)
                  raw = value_object(object)
                  if raw.is_a?(Array)
                    raw.map {|r| @cf.cast_value(r.value)}
                  elsif raw
                    @cf.cast_value(raw.value)
                  else
                    nil
                  end
                end
                def css_classes
                  @css_classes ||= "#{name} #{@cf.field_format}"
                end
              end
              class QueryAssociationCustomFieldColumn < QueryCustomFieldColumn
                def initialize(association, custom_field)
                  super(custom_field)
                  self.name = "#{association}.cf_#{custom_field.id}".to_sym
                  # TODO: support sorting/grouping by association custom field
                  self.sortable = false
                  self.groupable = false
                  @association = association
                end
                def value_object(object)
                  if assoc = object.send(@association)
                    super(assoc)
                  end
                end
                def css_classes
                  @css_classes ||= "#{@association}_cf_#{@cf.id} #{@cf.field_format}"
                end
              end
              class Query < ActiveRecord::Base
                class StatementInvalid < ::ActiveRecord::StatementInvalid
                end
                VISIBILITY_PRIVATE = 0
                VISIBILITY_ROLES   = 1
                VISIBILITY_PUBLIC  = 2
                belongs_to :project
                belongs_to :user
                has_and_belongs_to_many :roles, :join_table => "#{table_name_prefix}queries_roles#{table_name_suffix}", :foreign_key => "query_id"
                serialize :filters
                serialize :column_names
                serialize :sort_criteria, Array
                serialize :options, Hash
                attr_protected :project_id, :user_id
                validates_presence_of :name
                validates_length_of :name, :maximum => 255
                validates :visibility, :inclusion => { :in => [VISIBILITY_PUBLIC, VISIBILITY_ROLES, VISIBILITY_PRIVATE] }
                validate :validate_query_filters
                validate do |query|
                  errors.add(:base, l(:label_role_plural) + ' ' + l('activerecord.errors.messages.blank')) if query.visibility == VISIBILITY_ROLES && roles.blank?
                end
                after_save do |query|
                  if query.visibility_changed? && query.visibility != VISIBILITY_ROLES
                    query.roles.clear
                  end
                end
                class_attribute :operators
                self.operators = {
                  "="   => :label_equals,
                  "!"   => :label_not_equals,
                  "o"   => :label_open_issues,
                  "c"   => :label_closed_issues,
                  "!*"  => :label_none,
                  "*"   => :label_any,
                  ">="  => :label_greater_or_equal,
                  "<="  => :label_less_or_equal,
                  "><"  => :label_between,
                  "<t+" => :label_in_less_than,
                  ">t+" => :label_in_more_than,
                  "><t+"=> :label_in_the_next_days,
                  "t+"  => :label_in,
                  "t"   => :label_today,
                  "ld"  => :label_yesterday,
                  "w"   => :label_this_week,
                  "lw"  => :label_last_week,
                  "l2w" => [:label_last_n_weeks, {:count => 2}],
                  "m"   => :label_this_month,
                  "lm"  => :label_last_month,
                  "y"   => :label_this_year,
                  ">t-" => :label_less_than_ago,
                  "<t-" => :label_more_than_ago,
                  "><t-"=> :label_in_the_past_days,
                  "t-"  => :label_ago,
                  "~"   => :label_contains,
                  "!~"  => :label_not_contains,
                  "=p"  => :label_any_issues_in_project,
                  "=!p" => :label_any_issues_not_in_project,
                  "!p"  => :label_no_issues_in_project
                }
                class_attribute :operators_by_filter_type
                self.operators_by_filter_type = {
                  :list => [ "=", "!" ],
                  :list_status => [ "o", "=", "!", "c", "*" ],
                  :list_optional => [ "=", "!", "!*", "*" ],
                  :list_subprojects => [ "*", "!*", "=" ],
                  :date => [ "=", ">=", "<=", "><", "<t+", ">t+", "><t+", "t+", "t", "ld", "w", "lw", "l2w", "m", "lm", "y", ">t-", "<t-", "><t-", "t-", "!*", "*" ],
                  :date_past => [ "=", ">=", "<=", "><", ">t-", "<t-", "><t-", "t-", "t", "ld", "w", "lw", "l2w", "m", "lm", "y", "!*", "*" ],
                  :string => [ "=", "~", "!", "!~", "!*", "*" ],
                  :text => [  "~", "!~", "!*", "*" ],
                  :integer => [ "=", ">=", "<=", "><", "!*", "*" ],
                  :float => [ "=", ">=", "<=", "><", "!*", "*" ],
                  :relation => ["=", "=p", "=!p", "!p", "!*", "*"],
                  :tree => ["=", "~", "!*", "*"]
                }
                class_attribute :available_columns
                self.available_columns = []
                class_attribute :queried_class
                def queried_table_name
                  @queried_table_name ||= self.class.queried_class.table_name
                end
                def initialize(attributes=nil, *args)
                  super attributes
                  @is_for_all = project.nil?
                end
                # Builds the query from the given params
                def build_from_params(params)
                  if params[:fields] || params[:f]
                    self.filters = {}
                    add_filters(params[:fields] || params[:f], params[:operators] || params[:op], params[:values] || params[:v])
                  else
                    available_filters.keys.each do |field|
                      add_short_filter(field, params[field]) if params[field]
                    end
                  end
                  self.group_by = params[:group_by] || (params[:query] && params[:query][:group_by])
                  self.column_names = params[:c] || (params[:query] && params[:query][:column_names])
                  self
                end
                # Builds a new query from the given params and attributes
                def self.build_from_params(params, attributes={})
                  new(attributes).build_from_params(params)
                end
                def validate_query_filters
                  filters.each_key do |field|
                    if values_for(field)
                      case type_for(field)
                      when :integer
                        add_filter_error(field, :invalid) if values_for(field).detect {|v| v.present? && !v.match(/^[+-]?\d+$/) }
                      when :float
                        add_filter_error(field, :invalid) if values_for(field).detect {|v| v.present? && !v.match(/^[+-]?\d+(\.\d*)?$/) }
                      when :date, :date_past
                        case operator_for(field)
                        when "=", ">=", "<=", "><"
                          add_filter_error(field, :invalid) if values_for(field).detect {|v|
                            v.present? && (!v.match(/\A\d{4}-\d{2}-\d{2}(T\d{2}((:)?\d{2}){0,2}(Z|\d{2}:?\d{2})?)?\z/) || parse_date(v).nil?)
                          }
                        when ">t-", "<t-", "t-", ">t+", "<t+", "t+", "><t+", "><t-"
                          add_filter_error(field, :invalid) if values_for(field).detect {|v| v.present? && !v.match(/^\d+$/) }
                        end
                      end
                    end
                    add_filter_error(field, :blank) unless
                        # filter requires one or more values
                        (values_for(field) and !values_for(field).first.blank?) or
                        # filter doesn't require any value
                        ["o", "c", "!*", "*", "t", "ld", "w", "lw", "l2w", "m", "lm", "y"].include? operator_for(field)
                  end if filters
                end
                def add_filter_error(field, message)
                  m = label_for(field) + " " + l(message, :scope => 'activerecord.errors.messages')
                  errors.add(:base, m)
                end
                def editable_by?(user)
                  return false unless user
                  # Admin can edit them all and regular users can edit their private queries
                  return true if user.admin? || (is_private? && self.user_id == user.id)
                  # Members can not edit public queries that are for all project (only admin is allowed to)
                  is_public? && !@is_for_all && user.allowed_to?(:manage_public_queries, project)
                end
                def trackers
                  @trackers ||= project.nil? ? Tracker.sorted.to_a : project.rolled_up_trackers
                end
                # Returns a hash of localized labels for all filter operators
                def self.operators_labels
                  operators.inject({}) {|h, operator| h[operator.first] = l(*operator.last); h}
                end
                # Returns a representation of the available filters for JSON serialization
                def available_filters_as_json
                  json = {}
                  available_filters.each do |field, options|
                    json[field] = options.slice(:type, :name, :values).stringify_keys
                  end
                  json
                end
                def all_projects
                  @all_projects ||= Project.visible.to_a
                end
                def all_projects_values
                  return @all_projects_values if @all_projects_values
                  values = []
                  Project.project_tree(all_projects) do |p, level|
                    prefix = (level > 0 ? ('--' * level + ' ') : '')
                    values << ["#{prefix}#{p.name}", p.id.to_s]
                  end
                  @all_projects_values = values
                end
                # Adds available filters
                def initialize_available_filters
                  # implemented by sub-classes
                end
                protected :initialize_available_filters
                # Adds an available filter
                def add_available_filter(field, options)
                  @available_filters ||= ActiveSupport::OrderedHash.new
                  @available_filters[field] = options
                  @available_filters
                end
                # Removes an available filter
                def delete_available_filter(field)
                  if @available_filters
                    @available_filters.delete(field)
                  end
                end
                # Return a hash of available filters
                def available_filters
                  unless @available_filters
                    initialize_available_filters
                    @available_filters.each do |field, options|
                      options[:name] ||= l(options[:label] || "field_#{field}".gsub(/_id$/, ''))
                    end
                  end
                  @available_filters
                end
                def add_filter(field, operator, values=nil)
                  # values must be an array
                  return unless values.nil? || values.is_a?(Array)
                  # check if field is defined as an available filter
                  if available_filters.has_key? field
                    filter_options = available_filters[field]
                    filters[field] = {:operator => operator, :values => (values || [''])}
                  end
                end
                def add_short_filter(field, expression)
                  return unless expression && available_filters.has_key?(field)
                  field_type = available_filters[field][:type]
                  operators_by_filter_type[field_type].sort.reverse.detect do |operator|
                    next unless expression =~ /^#{Regexp.escape(operator)}(.*)$/
                    values = $1
                    add_filter field, operator, values.present? ? values.split('|') : ['']
                  end || add_filter(field, '=', expression.split('|'))
                end
                # Add multiple filters using +add_filter+
                def add_filters(fields, operators, values)
                  if fields.is_a?(Array) && operators.is_a?(Hash) && (values.nil? || values.is_a?(Hash))
                    fields.each do |field|
                      add_filter(field, operators[field], values && values[field])
                    end
                  end
                end
                def has_filter?(field)
                  filters and filters[field]
                end
                def type_for(field)
                  available_filters[field][:type] if available_filters.has_key?(field)
                end
                def operator_for(field)
                  has_filter?(field) ? filters[field][:operator] : nil
                end
                def values_for(field)
                  has_filter?(field) ? filters[field][:values] : nil
                end
                def value_for(field, index=0)
                  (values_for(field) || [])[index]
                end
                def label_for(field)
                  label = available_filters[field][:name] if available_filters.has_key?(field)
                  label ||= l("field_#{field.to_s.gsub(/_id$/, '')}", :default => field)
                end
                def self.add_available_column(column)
                  self.available_columns << (column) if column.is_a?(QueryColumn)
                end
                # Returns an array of columns that can be used to group the results
                def groupable_columns
                  available_columns.select {|c| c.groupable}
                end
                # Returns a Hash of columns and the key for sorting
                def sortable_columns
                  available_columns.inject({}) {|h, column|
                    h[column.name.to_s] = column.sortable
                    h
                  }
                end
                def columns
                  # preserve the column_names order
                  cols = (has_default_columns? ? default_columns_names : column_names).collect do |name|
                     available_columns.find { |col| col.name == name }
                  end.compact
                  available_columns.select(&:frozen?) | cols
                end
                def inline_columns
                  columns.select(&:inline?)
                end
                def block_columns
                  columns.reject(&:inline?)
                end
                def available_inline_columns
                  available_columns.select(&:inline?)
                end
                def available_block_columns
                  available_columns.reject(&:inline?)
                end
                def default_columns_names
                  []
                end
                def column_names=(names)
                  if names
                    names = names.select {|n| n.is_a?(Symbol) || !n.blank? }
                    names = names.collect {|n| n.is_a?(Symbol) ? n : n.to_sym }
                    # Set column_names to nil if default columns
                    if names == default_columns_names
                      names = nil
                    end
                  end
                  write_attribute(:column_names, names)
                end
                def has_column?(column)
                  column_names && column_names.include?(column.is_a?(QueryColumn) ? column.name : column)
                end
                def has_custom_field_column?
                  columns.any? {|column| column.is_a? QueryCustomFieldColumn}
                end
                def has_default_columns?
                  column_names.nil? || column_names.empty?
                end
                def sort_criteria=(arg)
                  c = []
                  if arg.is_a?(Hash)
                    arg = arg.keys.sort.collect {|k| arg[k]}
                  end
+                 if arg
                  c = arg.select {|k,o| !k.to_s.blank?}.slice(0,3).collect {|k,o| [k.to_s, (o == 'desc' || o == false) ? 'desc' : 'asc']}
+                 end
                  write_attribute(:sort_criteria, c)
                end
                def sort_criteria
                  read_attribute(:sort_criteria) || []
                end
                def sort_criteria_key(arg)
                  sort_criteria && sort_criteria[arg] && sort_criteria[arg].first
                end
                def sort_criteria_order(arg)
                  sort_criteria && sort_criteria[arg] && sort_criteria[arg].last
                end
                def sort_criteria_order_for(key)
                  sort_criteria.detect {|k, order| key.to_s == k}.try(:last)
                end
                # Returns the SQL sort order that should be prepended for grouping
                def group_by_sort_order
                  if grouped? && (column = group_by_column)
                    order = (sort_criteria_order_for(column.name) || column.default_order).try(:upcase)
                    column.sortable.is_a?(Array) ?
                      column.sortable.collect {|s| "#{s} #{order}"}.join(',') :
                      "#{column.sortable} #{order}"
                  end
                end
                # Returns true if the query is a grouped query
                def grouped?
                  !group_by_column.nil?
                end
                def group_by_column
                  groupable_columns.detect {|c| c.groupable && c.name.to_s == group_by}
                end
                def group_by_statement
                  group_by_column.try(:groupable)
                end
                def project_statement
                  project_clauses = []
                  if project && !project.descendants.active.empty?
                    ids = [project.id]
                    if has_filter?("subproject_id")
                      case operator_for("subproject_id")
                      when '='
                        # include the selected subprojects
                        ids += values_for("subproject_id").each(&:to_i)
                      when '!*'
                        # main project only
                      else
                        # all subprojects
                        ids += project.descendants.collect(&:id)
                      end
                    elsif Setting.display_subprojects_issues?
                      ids += project.descendants.collect(&:id)
                    end
                    project_clauses << "#{Project.table_name}.id IN (%s)" % ids.join(',')
                  elsif project
                    project_clauses << "#{Project.table_name}.id = %d" % project.id
                  end
                  project_clauses.any? ? project_clauses.join(' AND ') : nil
                end
                def statement
                  # filters clauses
                  filters_clauses = []
                  filters.each_key do |field|
                    next if field == "subproject_id"
                    v = values_for(field).clone
                    next unless v and !v.empty?
                    operator = operator_for(field)
                    # "me" value substitution
                    if %w(assigned_to_id author_id user_id watcher_id).include?(field)
                      if v.delete("me")
                        if User.current.logged?
                          v.push(User.current.id.to_s)
                          v += User.current.group_ids.map(&:to_s) if field == 'assigned_to_id'
                        else
                          v.push("0")
                        end
                      end
                    end
                    if field == 'project_id'
                      if v.delete('mine')
                        v += User.current.memberships.map(&:project_id).map(&:to_s)
                      end
                    end
                    if field =~ /cf_(\d+)$/
                      # custom field
                      filters_clauses << sql_for_custom_field(field, operator, v, $1)
                    elsif respond_to?("sql_for_#{field}_field")
                      # specific statement
                      filters_clauses << send("sql_for_#{field}_field", field, operator, v)
                    else
                      # regular field
                      filters_clauses << '(' + sql_for_field(field, operator, v, queried_table_name, field) + ')'
                    end
                  end if filters and valid?
                  if (c = group_by_column) && c.is_a?(QueryCustomFieldColumn)
                    # Excludes results for which the grouped custom field is not visible
                    filters_clauses << c.custom_field.visibility_by_project_condition
                  end
                  filters_clauses << project_statement
                  filters_clauses.reject!(&:blank?)
                  filters_clauses.any? ? filters_clauses.join(' AND ') : nil
                end
                private
                def sql_for_custom_field(field, operator, value, custom_field_id)
                  db_table = CustomValue.table_name
                  db_field = 'value'
                  filter = @available_filters[field]
                  return nil unless filter
                  if filter[:field].format.target_class && filter[:field].format.target_class <= User
                    if value.delete('me')
                      value.push User.current.id.to_s
                    end
                  end
                  not_in = nil
                  if operator == '!'
                    # Makes ! operator work for custom fields with multiple values
                    operator = '='
                    not_in = 'NOT'
                  end
                  customized_key = "id"
                  customized_class = queried_class
                  if field =~ /^(.+)\.cf_/
                    assoc = $1
                    customized_key = "#{assoc}_id"
                    customized_class = queried_class.reflect_on_association(assoc.to_sym).klass.base_class rescue nil
                    raise "Unknown #{queried_class.name} association #{assoc}" unless customized_class
                  end
                  where = sql_for_field(field, operator, value, db_table, db_field, true)
                  if operator =~ /[<>]/
                    where = "(#{where}) AND #{db_table}.#{db_field} <> ''"
                  end
                  "#{queried_table_name}.#{customized_key} #{not_in} IN (" +
                    "SELECT #{customized_class.table_name}.id FROM #{customized_class.table_name}" +
                    " LEFT OUTER JOIN #{db_table} ON #{db_table}.customized_type='#{customized_class}' AND #{db_table}.customized_id=#{customized_class.table_name}.id AND #{db_table}.custom_field_id=#{custom_field_id}" +
                    " WHERE (#{where}) AND (#{filter[:field].visibility_by_project_condition}))"
                end
                # Helper method to generate the WHERE sql for a +field+, +operator+ and a +value+
                def sql_for_field(field, operator, value, db_table, db_field, is_custom_filter=false)
                  sql = ''
                  case operator
                  when "="
                    if value.any?
                      case type_for(field)
                      when :date, :date_past
                        sql = date_clause(db_table, db_field, parse_date(value.first), parse_date(value.first), is_custom_filter)
                      when :integer
                        if is_custom_filter
                          sql = "(#{db_table}.#{db_field} <> '' AND CAST(CASE #{db_table}.#{db_field} WHEN '' THEN '0' ELSE #{db_table}.#{db_field} END AS decimal(30,3)) = #{value.first.to_i})"
                        else
                          sql = "#{db_table}.#{db_field} = #{value.first.to_i}"
                        end
                      when :float
                        if is_custom_filter
                          sql = "(#{db_table}.#{db_field} <> '' AND CAST(CASE #{db_table}.#{db_field} WHEN '' THEN '0' ELSE #{db_table}.#{db_field} END AS decimal(30,3)) BETWEEN #{value.first.to_f - 1e-5} AND #{value.first.to_f + 1e-5})"
                        else
                          sql = "#{db_table}.#{db_field} BETWEEN #{value.first.to_f - 1e-5} AND #{value.first.to_f + 1e-5}"
                        end
                      else
                        sql = "#{db_table}.#{db_field} IN (" + value.collect{|val| "'#{self.class.connection.quote_string(val)}'"}.join(",") + ")"
                      end
                    else
                      # IN an empty set
                      sql = "1=0"
                    end
                  when "!"
                    if value.any?
                      sql = "(#{db_table}.#{db_field} IS NULL OR #{db_table}.#{db_field} NOT IN (" + value.collect{|val| "'#{self.class.connection.quote_string(val)}'"}.join(",") + "))"
                    else
                      # NOT IN an empty set
                      sql = "1=1"
                    end
                  when "!*"
                    sql = "#{db_table}.#{db_field} IS NULL"
                    sql << " OR #{db_table}.#{db_field} = ''" if is_custom_filter
                  when "*"
                    sql = "#{db_table}.#{db_field} IS NOT NULL"
                    sql << " AND #{db_table}.#{db_field} <> ''" if is_custom_filter
                  when ">="
                    if [:date, :date_past].include?(type_for(field))
                      sql = date_clause(db_table, db_field, parse_date(value.first), nil, is_custom_filter)
                    else
                      if is_custom_filter
                        sql = "(#{db_table}.#{db_field} <> '' AND CAST(CASE #{db_table}.#{db_field} WHEN '' THEN '0' ELSE #{db_table}.#{db_field} END AS decimal(30,3)) >= #{value.first.to_f})"
                      else
                        sql = "#{db_table}.#{db_field} >= #{value.first.to_f}"
                      end
                    end
                  when "<="
                    if [:date, :date_past].include?(type_for(field))
                      sql = date_clause(db_table, db_field, nil, parse_date(value.first), is_custom_filter)
                    else
                      if is_custom_filter
                        sql = "(#{db_table}.#{db_field} <> '' AND CAST(CASE #{db_table}.#{db_field} WHEN '' THEN '0' ELSE #{db_table}.#{db_field} END AS decimal(30,3)) <= #{value.first.to_f})"
                      else
                        sql = "#{db_table}.#{db_field} <= #{value.first.to_f}"
                      end
                    end
                  when "><"
                    if [:date, :date_past].include?(type_for(field))
                      sql = date_clause(db_table, db_field, parse_date(value[0]), parse_date(value[1]), is_custom_filter)
                    else
                      if is_custom_filter
                        sql = "(#{db_table}.#{db_field} <> '' AND CAST(CASE #{db_table}.#{db_field} WHEN '' THEN '0' ELSE #{db_table}.#{db_field} END AS decimal(30,3)) BETWEEN #{value[0].to_f} AND #{value[1].to_f})"
                      else
                        sql = "#{db_table}.#{db_field} BETWEEN #{value[0].to_f} AND #{value[1].to_f}"
                      end
                    end
                  when "o"
                    sql = "#{queried_table_name}.status_id IN (SELECT id FROM #{IssueStatus.table_name} WHERE is_closed=#{self.class.connection.quoted_false})" if field == "status_id"
                  when "c"
                    sql = "#{queried_table_name}.status_id IN (SELECT id FROM #{IssueStatus.table_name} WHERE is_closed=#{self.class.connection.quoted_true})" if field == "status_id"
                  when "><t-"
                    # between today - n days and today
                    sql = relative_date_clause(db_table, db_field, - value.first.to_i, 0, is_custom_filter)
                  when ">t-"
                    # >= today - n days
                    sql = relative_date_clause(db_table, db_field, - value.first.to_i, nil, is_custom_filter)
                  when "<t-"
                    # <= today - n days
                    sql = relative_date_clause(db_table, db_field, nil, - value.first.to_i, is_custom_filter)
                  when "t-"
                    # = n days in past
                    sql = relative_date_clause(db_table, db_field, - value.first.to_i, - value.first.to_i, is_custom_filter)
                  when "><t+"
                    # between today and today + n days
                    sql = relative_date_clause(db_table, db_field, 0, value.first.to_i, is_custom_filter)
                  when ">t+"
                    # >= today + n days
                    sql = relative_date_clause(db_table, db_field, value.first.to_i, nil, is_custom_filter)
                  when "<t+"
                    # <= today + n days
                    sql = relative_date_clause(db_table, db_field, nil, value.first.to_i, is_custom_filter)
                  when "t+"
                    # = today + n days
                    sql = relative_date_clause(db_table, db_field, value.first.to_i, value.first.to_i, is_custom_filter)
                  when "t"
                    # = today
                    sql = relative_date_clause(db_table, db_field, 0, 0, is_custom_filter)
                  when "ld"
                    # = yesterday
                    sql = relative_date_clause(db_table, db_field, -1, -1, is_custom_filter)
                  when "w"
                    # = this week
                    first_day_of_week = l(:general_first_day_of_week).to_i
                    day_of_week = Date.today.cwday
                    days_ago = (day_of_week >= first_day_of_week ? day_of_week - first_day_of_week : day_of_week + 7 - first_day_of_week)
                    sql = relative_date_clause(db_table, db_field, - days_ago, - days_ago + 6, is_custom_filter)
                  when "lw"
                    # = last week
                    first_day_of_week = l(:general_first_day_of_week).to_i
                    day_of_week = Date.today.cwday
                    days_ago = (day_of_week >= first_day_of_week ? day_of_week - first_day_of_week : day_of_week + 7 - first_day_of_week)
                    sql = relative_date_clause(db_table, db_field, - days_ago - 7, - days_ago - 1, is_custom_filter)
                  when "l2w"
                    # = last 2 weeks
                    first_day_of_week = l(:general_first_day_of_week).to_i
                    day_of_week = Date.today.cwday
                    days_ago = (day_of_week >= first_day_of_week ? day_of_week - first_day_of_week : day_of_week + 7 - first_day_of_week)
                    sql = relative_date_clause(db_table, db_field, - days_ago - 14, - days_ago - 1, is_custom_filter)
                  when "m"
                    # = this month
                    date = Date.today
                    sql = date_clause(db_table, db_field, date.beginning_of_month, date.end_of_month, is_custom_filter)
                  when "lm"
                    # = last month
                    date = Date.today.prev_month
                    sql = date_clause(db_table, db_field, date.beginning_of_month, date.end_of_month, is_custom_filter)
                  when "y"
                    # = this year
                    date = Date.today
                    sql = date_clause(db_table, db_field, date.beginning_of_year, date.end_of_year, is_custom_filter)
                  when "~"
                    sql = "LOWER(#{db_table}.#{db_field}) LIKE '%#{self.class.connection.quote_string(value.first.to_s.downcase)}%'"
                  when "!~"
                    sql = "LOWER(#{db_table}.#{db_field}) NOT LIKE '%#{self.class.connection.quote_string(value.first.to_s.downcase)}%'"
                  else
                    raise "Unknown query operator #{operator}"
                  end
                  return sql
                end
                # Adds a filter for the given custom field
                def add_custom_field_filter(field, assoc=nil)
                  options = field.format.query_filter_options(field, self)
                  if field.format.target_class && field.format.target_class <= User
                    if options[:values].is_a?(Array) && User.current.logged?
                      options[:values].unshift ["<< #{l(:label_me)} >>", "me"]
                    end
                  end
                  filter_id = "cf_#{field.id}"
                  filter_name = field.name
                  if assoc.present?
                    filter_id = "#{assoc}.#{filter_id}"
                    filter_name = l("label_attribute_of_#{assoc}", :name => filter_name)
                  end
                  add_available_filter filter_id, options.merge({
                    :name => filter_name,
                    :field => field
                  })
                end
                # Adds filters for the given custom fields scope
                def add_custom_fields_filters(scope, assoc=nil)
                  scope.visible.where(:is_filter => true).sorted.each do |field|
                    add_custom_field_filter(field, assoc)
                  end
                end
                # Adds filters for the given associations custom fields
                def add_associations_custom_fields_filters(*associations)
                  fields_by_class = CustomField.visible.where(:is_filter => true).group_by(&:class)
                  associations.each do |assoc|
                    association_klass = queried_class.reflect_on_association(assoc).klass
                    fields_by_class.each do |field_class, fields|
                      if field_class.customized_class <= association_klass
                        fields.sort.each do |field|
                          add_custom_field_filter(field, assoc)
                        end
                      end
                    end
                  end
                end
                def quoted_time(time, is_custom_filter)
                  if is_custom_filter
                    # Custom field values are stored as strings in the DB
                    # using this format that does not depend on DB date representation
                    time.strftime("%Y-%m-%d %H:%M:%S")
                  else
                    self.class.connection.quoted_date(time)
                  end
                end
                # Returns a SQL clause for a date or datetime field.
                def date_clause(table, field, from, to, is_custom_filter)
                  s = []
                  if from
                    if from.is_a?(Date)
                      from = Time.local(from.year, from.month, from.day).yesterday.end_of_day
                    else
                      from = from - 1 # second
                    end
                    if self.class.default_timezone == :utc
                      from = from.utc
                    end
                    s << ("#{table}.#{field} > '%s'" % [quoted_time(from, is_custom_filter)])
                  end
                  if to
                    if to.is_a?(Date)
                      to = Time.local(to.year, to.month, to.day).end_of_day
                    end
                    if self.class.default_timezone == :utc
                      to = to.utc
                    end
                    s << ("#{table}.#{field} <= '%s'" % [quoted_time(to, is_custom_filter)])
                  end
                  s.join(' AND ')
                end
                # Returns a SQL clause for a date or datetime field using relative dates.
                def relative_date_clause(table, field, days_from, days_to, is_custom_filter)
                  date_clause(table, field, (days_from ? Date.today + days_from : nil), (days_to ? Date.today + days_to : nil), is_custom_filter)
                end
                # Returns a Date or Time from the given filter value
                def parse_date(arg)
                  if arg.to_s =~ /\A\d{4}-\d{2}-\d{2}T/
                    Time.parse(arg) rescue nil
                  else
                    Date.parse(arg) rescue nil
                  end
                end
                # Additional joins required for the given sort options
                def joins_for_order_statement(order_options)
                  joins = []
                  if order_options
                    if order_options.include?('authors')
                      joins << "LEFT OUTER JOIN #{User.table_name} authors ON authors.id = #{queried_table_name}.author_id"
                    end
                    order_options.scan(/cf_\d+/).uniq.each do |name|
                      column = available_columns.detect {|c| c.name.to_s == name}
                      join = column && column.custom_field.join_for_order_statement
                      if join
                        joins << join
                      end
                    end
                  end
                  joins.any? ? joins.join(' ') : nil
                end
              end

app/views/queries/_form.html.erb +8 -6

              <%= error_messages_for 'query' %>
              <div class="box">
              <div class="tabular">
              <%= hidden_field_tag 'gantt', '1' if params[:gantt] %>
              <p><label for="query_name"><%=l(:field_name)%></label>
              <%= text_field 'query', 'name', :size => 80 %></p>
-             <% if User.current.admin? || User.current.allowed_to?(:manage_public_queries, @project) %>
+             <% if User.current.admin? || User.current.allowed_to?(:manage_public_queries, @query.project) %>
              <p><label><%=l(:field_visible)%></label>
                <label class="block"><%= radio_button 'query', 'visibility', Query::VISIBILITY_PRIVATE %> <%= l(:label_visibility_private) %></label>
+               <label class="block"><%= radio_button 'query', 'visibility', Query::VISIBILITY_PUBLIC %> <%= l(:label_visibility_public) %></label>
                <label class="block"><%= radio_button 'query', 'visibility', Query::VISIBILITY_ROLES %> <%= l(:label_visibility_roles) %>:</label>
                <% Role.givable.sorted.each do |role| %>
                  <label class="block role-visibility"><%= check_box_tag 'query[role_ids][]', role.id, @query.roles.include?(role), :id => nil %> <%= role.name %></label>
                <% end %>
-               <label class="block"><%= radio_button 'query', 'visibility', Query::VISIBILITY_PUBLIC %> <%= l(:label_visibility_public) %></label>
                <%= hidden_field_tag 'query[role_ids][]', '' %>
              </p>
              <% end %>
              <p><label for="query_is_for_all"><%=l(:field_is_for_all)%></label>
-             <%= check_box_tag 'query_is_for_all', 1, @query.project.nil?,
-                   :disabled => (!@query.new_record? && (@query.project.nil? || (@query.is_public? && !User.current.admin?))) %></p>
+             <%= check_box_tag 'query_is_for_all', 1, @query.project.nil?, :class => (User.current.admin? ? '' : 'disable-unless-private') %></p>
              <% unless params[:gantt] %>
              <fieldset><legend><%= l(:label_options) %></legend>
              <p><label for="query_default_columns"><%=l(:label_default_columns)%></label>
              <%= check_box_tag 'default_columns', 1, @query.has_default_columns?, :id => 'query_default_columns',
                    :onclick => 'if (this.checked) {$("#columns").hide();} else {$("#columns").show();}' %></p>
              <p><label for="query_group_by"><%= l(:field_group_by) %></label>
              <%= select 'query', 'group_by', @query.groupable_columns.collect {|c| [c.caption, c.name.to_s]}, :include_blank => true %></p>
              <p><label><%= l(:button_show) %></label>
              <%= available_block_columns_tags(@query) %></p>
              </fieldset>
              <% else %>
              <fieldset><legend><%= l(:label_options) %></legend>
                <p><label><%= l(:button_show) %></label>
                <label class="inline"><%= check_box_tag "query[draw_relations]", "1", @query.draw_relations %> <%= l(:label_related_issues) %></label>
                <label class="inline"><%= check_box_tag "query[draw_progress_line]", "1", @query.draw_progress_line %> <%= l(:label_gantt_progress_line) %></label>
                </p>
              </fieldset>
              <% end %>
              </div>
              <fieldset id="filters"><legend><%= l(:label_filter_plural) %></legend>
              <%= render :partial => 'queries/filters', :locals => {:query => query}%>
              </fieldset>
              <% unless params[:gantt] %>
              <fieldset><legend><%= l(:label_sort) %></legend>
              <% 3.times do |i| %>
              <%= i+1 %>:
              <%= label_tag "query_sort_criteria_attribute_" + i.to_s,
                            l(:description_query_sort_criteria_attribute), :class => "hidden-for-sighted" %>
              <%= select_tag("query[sort_criteria][#{i}][]",
                             options_for_select([[]] + query.available_columns.select(&:sortable?).collect {|column| [column.caption, column.name.to_s]}, @query.sort_criteria_key(i)),
                             :id => "query_sort_criteria_attribute_" + i.to_s)%>
              <%= label_tag "query_sort_criteria_direction_" + i.to_s,
                            l(:description_query_sort_criteria_direction), :class => "hidden-for-sighted" %>
              <%= select_tag("query[sort_criteria][#{i}][]",
                              options_for_select([[], [l(:label_ascending), 'asc'], [l(:label_descending), 'desc']], @query.sort_criteria_order(i)),
                              :id => "query_sort_criteria_direction_" + i.to_s) %>
              <br />
              <% end %>
              </fieldset>
              <% end %>
              <% unless params[:gantt] %>
              <%= content_tag 'fieldset', :id => 'columns', :style => (query.has_default_columns? ? 'display:none;' : nil) do %>
              <legend><%= l(:field_column_names) %></legend>
              <%= render_query_columns_selection(query) %>
              <% end %>
              <% end %>
              </div>
              <%= javascript_tag do %>
              $(document).ready(function(){
                $("input[name='query[visibility]']").change(function(){
-                 var checked = $('#query_visibility_1').is(':checked');
-                 $("input[name='query[role_ids][]'][type=checkbox]").attr('disabled', !checked);
+                 var roles_checked = $('#query_visibility_1').is(':checked');
+                 var private_checked = $('#query_visibility_0').is(':checked');
+                 $("input[name='query[role_ids][]'][type=checkbox]").attr('disabled', !roles_checked);
+                 if (!private_checked) $("input.disable-unless-private").attr('checked', false);
+                 $("input.disable-unless-private").attr('disabled', !private_checked);
                }).trigger('change');
              });
              <% end %>

test/functional/queries_controller_test.rb +67 -6

              # Redmine - project management software
              # Copyright (C) 2006-2015  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              require File.expand_path('../../test_helper', __FILE__)
              class QueriesControllerTest < ActionController::TestCase
                fixtures :projects, :users, :members, :member_roles, :roles, :trackers, :issue_statuses, :issue_categories, :enumerations, :issues, :custom_fields, :custom_values, :queries, :enabled_modules
                def setup
                  User.current = nil
                end
                def test_index
                  get :index
                  # HTML response not implemented
                  assert_response 406
                end
                def test_new_project_query
                  @request.session[:user_id] = 2
                  get :new, :project_id => 1
                  assert_response :success
                  assert_template 'new'
                  assert_select 'input[name=?][value="0"][checked=checked]', 'query[visibility]'
                  assert_select 'input[name=query_is_for_all][type=checkbox]:not([checked]):not([disabled])'
                  assert_select 'select[name=?]', 'c[]' do
                    assert_select 'option[value=tracker]'
                    assert_select 'option[value=subject]'
                  end
                end
                def test_new_global_query
                  @request.session[:user_id] = 2
                  get :new
                  assert_response :success
                  assert_template 'new'
                  assert_select 'input[name=?]', 'query[visibility]', 0
                  assert_select 'input[name=query_is_for_all][type=checkbox][checked]:not([disabled])'
                end
                def test_new_on_invalid_project
                  @request.session[:user_id] = 2
                  get :new, :project_id => 'invalid'
                  assert_response 404
                end
                def test_create_project_public_query
                  @request.session[:user_id] = 2
                  post :create,
                       :project_id => 'ecookbook',
                       :default_columns => '1',
                       :f => ["status_id", "assigned_to_id"],
                       :op => {"assigned_to_id" => "=", "status_id" => "o"},
                       :v => { "assigned_to_id" => ["1"], "status_id" => ["1"]},
                       :query => {"name" => "test_new_project_public_query", "visibility" => "2"}
                  q = Query.find_by_name('test_new_project_public_query')
                  assert_redirected_to :controller => 'issues', :action => 'index', :project_id => 'ecookbook', :query_id => q
                  assert q.is_public?
                  assert q.has_default_columns?
                  assert q.valid?
                end
                def test_create_project_private_query
                  @request.session[:user_id] = 3
                  post :create,
                       :project_id => 'ecookbook',
                       :default_columns => '1',
                       :fields => ["status_id", "assigned_to_id"],
                       :operators => {"assigned_to_id" => "=", "status_id" => "o"},
                       :values => { "assigned_to_id" => ["1"], "status_id" => ["1"]},
-                      :query => {"name" => "test_new_project_private_query", "visibility" => "2"}
+                      :query => {"name" => "test_new_project_private_query", "visibility" => "0"}
                  q = Query.find_by_name('test_new_project_private_query')
                  assert_redirected_to :controller => 'issues', :action => 'index', :project_id => 'ecookbook', :query_id => q
                  assert !q.is_public?
                  assert q.has_default_columns?
                  assert q.valid?
                end
                def test_create_global_private_query_with_custom_columns
                  @request.session[:user_id] = 3
                  post :create,
                       :fields => ["status_id", "assigned_to_id"],
                       :operators => {"assigned_to_id" => "=", "status_id" => "o"},
                       :values => { "assigned_to_id" => ["me"], "status_id" => ["1"]},
-                      :query => {"name" => "test_new_global_private_query", "visibility" => "2"},
+                      :query => {"name" => "test_new_global_private_query", "visibility" => "0"},
                       :c => ["", "tracker", "subject", "priority", "category"]
                  q = Query.find_by_name('test_new_global_private_query')
                  assert_redirected_to :controller => 'issues', :action => 'index', :project_id => nil, :query_id => q
                  assert !q.is_public?
                  assert !q.has_default_columns?
                  assert_equal [:id, :tracker, :subject, :priority, :category], q.columns.collect {|c| c.name}
                  assert q.valid?
                end
                def test_create_global_query_with_custom_filters
                  @request.session[:user_id] = 3
                  post :create,
                       :fields => ["assigned_to_id"],
                       :operators => {"assigned_to_id" => "="},
                       :values => { "assigned_to_id" => ["me"]},
                       :query => {"name" => "test_new_global_query"}
                  q = Query.find_by_name('test_new_global_query')
                  assert_redirected_to :controller => 'issues', :action => 'index', :project_id => nil, :query_id => q
+                 assert !q.is_public?
                  assert !q.has_filter?(:status_id)
                  assert_equal ['assigned_to_id'], q.filters.keys
                  assert q.valid?
                end
                def test_create_with_sort
                  @request.session[:user_id] = 1
                  post :create,
                       :default_columns => '1',
                       :operators => {"status_id" => "o"},
                       :values => {"status_id" => ["1"]},
                       :query => {:name => "test_new_with_sort",
                                  :visibility => "2",
                                  :sort_criteria => {"0" => ["due_date", "desc"], "1" => ["tracker", ""]}}
                  query = Query.find_by_name("test_new_with_sort")
                  assert_not_nil query
                  assert_equal [['due_date', 'desc'], ['tracker', 'asc']], query.sort_criteria
                end
                def test_create_with_failure
                  @request.session[:user_id] = 2
                  assert_no_difference '::Query.count' do
                    post :create, :project_id => 'ecookbook', :query => {:name => ''}
                  end
                  assert_response :success
                  assert_template 'new'
                  assert_select 'input[name=?]', 'query[name]'
                end
                def test_create_global_query_from_gantt
                  @request.session[:user_id] = 1
                  assert_difference 'IssueQuery.count' do
                    post :create,
                         :gantt => 1,
                         :operators => {"status_id" => "o"},
                         :values => {"status_id" => ["1"]},
                         :query => {:name => "test_create_from_gantt",
                                    :draw_relations => '1',
                                    :draw_progress_line => '1'}
                    assert_response 302
                  end
                  query = IssueQuery.order('id DESC').first
                  assert_redirected_to "/issues/gantt?query_id=#{query.id}"
                  assert_equal true, query.draw_relations
                  assert_equal true, query.draw_progress_line
                end
                def test_create_project_query_from_gantt
                  @request.session[:user_id] = 1
                  assert_difference 'IssueQuery.count' do
                    post :create,
                         :project_id => 'ecookbook',
                         :gantt => 1,
                         :operators => {"status_id" => "o"},
                         :values => {"status_id" => ["1"]},
                         :query => {:name => "test_create_from_gantt",
                                    :draw_relations => '0',
                                    :draw_progress_line => '0'}
                    assert_response 302
                  end
                  query = IssueQuery.order('id DESC').first
                  assert_redirected_to "/projects/ecookbook/issues/gantt?query_id=#{query.id}"
                  assert_equal false, query.draw_relations
                  assert_equal false, query.draw_progress_line
                end
+               def test_create_project_public_query_should_force_private_without_manage_public_queries_permission
+                 @request.session[:user_id] = 3
+                 query = new_record(Query) do
+                   post :create,
+                        :project_id => 'ecookbook',
+                        :query => {"name" => "name", "visibility" => "2"}
+                   assert_response 302
+                 end
+                 assert_not_nil query.project
+                 assert_equal Query::VISIBILITY_PRIVATE, query.visibility
+               end
+               def test_create_global_public_query_should_force_private_without_manage_public_queries_permission
+                 @request.session[:user_id] = 3
+                 query = new_record(Query) do
+                   post :create,
+                        :project_id => 'ecookbook', :query_is_for_all => '1',
+                        :query => {"name" => "name", "visibility" => "2"}
+                   assert_response 302
+                 end
+                 assert_nil query.project
+                 assert_equal Query::VISIBILITY_PRIVATE, query.visibility
+               end
+               def test_create_project_public_query_with_manage_public_queries_permission
+                 @request.session[:user_id] = 2
+                 query = new_record(Query) do
+                   post :create,
+                        :project_id => 'ecookbook',
+                        :query => {"name" => "name", "visibility" => "2"}
+                   assert_response 302
+                 end
+                 assert_not_nil query.project
+                 assert_equal Query::VISIBILITY_PUBLIC, query.visibility
+               end
+               def test_create_global_public_query_should_force_private_with_manage_public_queries_permission
+                 @request.session[:user_id] = 2
+                 query = new_record(Query) do
+                   post :create,
+                        :project_id => 'ecookbook', :query_is_for_all => '1',
+                        :query => {"name" => "name", "visibility" => "2"}
+                   assert_response 302
+                 end
+                 assert_nil query.project
+                 assert_equal Query::VISIBILITY_PRIVATE, query.visibility
+               end
+               def test_create_global_public_query_by_admin
+                 @request.session[:user_id] = 1
+                 query = new_record(Query) do
+                   post :create,
+                        :project_id => 'ecookbook', :query_is_for_all => '1',
+                        :query => {"name" => "name", "visibility" => "2"}
+                   assert_response 302
+                 end
+                 assert_nil query.project
+                 assert_equal Query::VISIBILITY_PUBLIC, query.visibility
+               end
                def test_edit_global_public_query
                  @request.session[:user_id] = 1
                  get :edit, :id => 4
                  assert_response :success
                  assert_template 'edit'
                  assert_select 'input[name=?][value="2"][checked=checked]', 'query[visibility]'
-                 assert_select 'input[name=query_is_for_all][type=checkbox][checked=checked][disabled=disabled]'
+                 assert_select 'input[name=query_is_for_all][type=checkbox][checked=checked]'
                end
                def test_edit_global_private_query
                  @request.session[:user_id] = 3
                  get :edit, :id => 3
                  assert_response :success
                  assert_template 'edit'
                  assert_select 'input[name=?]', 'query[visibility]', 0
-                 assert_select 'input[name=query_is_for_all][type=checkbox][checked=checked][disabled=disabled]'
+                 assert_select 'input[name=query_is_for_all][type=checkbox][checked=checked]'
                end
                def test_edit_project_private_query
                  @request.session[:user_id] = 3
                  get :edit, :id => 2
                  assert_response :success
                  assert_template 'edit'
                  assert_select 'input[name=?]', 'query[visibility]', 0
-                 assert_select 'input[name=query_is_for_all][type=checkbox]:not([checked]):not([disabled])'
+                 assert_select 'input[name=query_is_for_all][type=checkbox]:not([checked])'
                end
                def test_edit_project_public_query
                  @request.session[:user_id] = 2
                  get :edit, :id => 1
                  assert_response :success
                  assert_template 'edit'
                  assert_select 'input[name=?][value="2"][checked=checked]', 'query[visibility]'
-                 assert_select 'input[name=query_is_for_all][type=checkbox][disabled=disabled]:not([checked])'
+                 assert_select 'input[name=query_is_for_all][type=checkbox]:not([checked])'
                end
                def test_edit_sort_criteria
                  @request.session[:user_id] = 1
                  get :edit, :id => 5
                  assert_response :success
                  assert_template 'edit'
                  assert_select 'select[name=?]', 'query[sort_criteria][0][]' do
                    assert_select 'option[value=priority][selected=selected]'
                    assert_select 'option[value=desc][selected=selected]'
                  end
                end
                def test_edit_invalid_query
                  @request.session[:user_id] = 2
                  get :edit, :id => 99
                  assert_response 404
                end
                def test_udpate_global_private_query
                  @request.session[:user_id] = 3
                  put :update,
                       :id => 3,
                       :default_columns => '1',
                       :fields => ["status_id", "assigned_to_id"],
                       :operators => {"assigned_to_id" => "=", "status_id" => "o"},
                       :values => { "assigned_to_id" => ["me"], "status_id" => ["1"]},
                       :query => {"name" => "test_edit_global_private_query", "visibility" => "2"}
                  assert_redirected_to :controller => 'issues', :action => 'index', :query_id => 3
                  q = Query.find_by_name('test_edit_global_private_query')
                  assert !q.is_public?
                  assert q.has_default_columns?
                  assert q.valid?
                end
                def test_update_global_public_query
                  @request.session[:user_id] = 1
                  put :update,
                       :id => 4,
                       :default_columns => '1',
                       :fields => ["status_id", "assigned_to_id"],
                       :operators => {"assigned_to_id" => "=", "status_id" => "o"},
                       :values => { "assigned_to_id" => ["1"], "status_id" => ["1"]},
                       :query => {"name" => "test_edit_global_public_query", "visibility" => "2"}
                  assert_redirected_to :controller => 'issues', :action => 'index', :query_id => 4
                  q = Query.find_by_name('test_edit_global_public_query')
                  assert q.is_public?
                  assert q.has_default_columns?
                  assert q.valid?
                end
                def test_update_with_failure
                  @request.session[:user_id] = 1
                  put :update, :id => 4, :query => {:name => ''}
                  assert_response :success
                  assert_template 'edit'
                end
                def test_destroy
                  @request.session[:user_id] = 2
                  delete :destroy, :id => 1
                  assert_redirected_to :controller => 'issues', :action => 'index', :project_id => 'ecookbook', :set_filter => 1, :query_id => nil
                  assert_nil Query.find_by_id(1)
                end
                def test_backslash_should_be_escaped_in_filters
                  @request.session[:user_id] = 2
                  get :new, :subject => 'foo/bar'
                  assert_response :success
                  assert_template 'new'
                  assert_include 'addFilter("subject", "=", ["foo\/bar"]);', response.body
                end
              end

test/test_helper.rb +9 0

              # Redmine - project management software
              # Copyright (C) 2006-2015  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              if ENV["COVERAGE"]
                require 'simplecov'
                require File.expand_path(File.dirname(__FILE__) + "/coverage/html_formatter")
                SimpleCov.formatter = Redmine::Coverage::HtmlFormatter
                SimpleCov.start 'rails'
              end
              ENV["RAILS_ENV"] = "test"
              require File.expand_path(File.dirname(__FILE__) + "/../config/environment")
              require 'rails/test_help'
              require Rails.root.join('test', 'mocks', 'open_id_authentication_mock.rb').to_s
              require File.expand_path(File.dirname(__FILE__) + '/object_helpers')
              include ObjectHelpers
              require 'net/ldap'
              require 'mocha/setup'
              Redmine::SudoMode.disable!
              class ActionView::TestCase
                helper :application
                include ApplicationHelper
              end
              class ActiveSupport::TestCase
                include ActionDispatch::TestProcess
                self.use_transactional_fixtures = true
                self.use_instantiated_fixtures  = false
                def uploaded_test_file(name, mime)
                  fixture_file_upload("files/#{name}", mime, true)
                end
                # Mock out a file
                def self.mock_file
                  file = 'a_file.png'
                  file.stubs(:size).returns(32)
                  file.stubs(:original_filename).returns('a_file.png')
                  file.stubs(:content_type).returns('image/png')
                  file.stubs(:read).returns(false)
                  file
                end
                def mock_file
                  self.class.mock_file
                end
                def mock_file_with_options(options={})
                  file = ''
                  file.stubs(:size).returns(32)
                  original_filename = options[:original_filename] || nil
                  file.stubs(:original_filename).returns(original_filename)
                  content_type = options[:content_type] || nil
                  file.stubs(:content_type).returns(content_type)
                  file.stubs(:read).returns(false)
                  file
                end
                # Use a temporary directory for attachment related tests
                def set_tmp_attachments_directory
                  Dir.mkdir "#{Rails.root}/tmp/test" unless File.directory?("#{Rails.root}/tmp/test")
                  unless File.directory?("#{Rails.root}/tmp/test/attachments")
                    Dir.mkdir "#{Rails.root}/tmp/test/attachments"
                  end
                  Attachment.storage_path = "#{Rails.root}/tmp/test/attachments"
                end
                def set_fixtures_attachments_directory
                  Attachment.storage_path = "#{Rails.root}/test/fixtures/files"
                end
                def with_settings(options, &block)
                  saved_settings = options.keys.inject({}) do |h, k|
                    h[k] = case Setting[k]
                      when Symbol, false, true, nil
                        Setting[k]
                      else
                        Setting[k].dup
                      end
                    h
                  end
                  options.each {|k, v| Setting[k] = v}
                  yield
                ensure
                  saved_settings.each {|k, v| Setting[k] = v} if saved_settings
                end
                # Yields the block with user as the current user
                def with_current_user(user, &block)
                  saved_user = User.current
                  User.current = user
                  yield
                ensure
                  User.current = saved_user
                end
                def with_locale(locale, &block)
                  saved_localed = ::I18n.locale
                  ::I18n.locale = locale
                  yield
                ensure
                  ::I18n.locale = saved_localed
                end
                def self.ldap_configured?
                  @test_ldap = Net::LDAP.new(:host => '127.0.0.1', :port => 389)
                  return @test_ldap.bind
                rescue Exception => e
                  # LDAP is not listening
                  return nil
                end
                def self.convert_installed?
                  Redmine::Thumbnail.convert_available?
                end
                def convert_installed?
                  self.class.convert_installed?
                end
                # Returns the path to the test +vendor+ repository
                def self.repository_path(vendor)
                  path = Rails.root.join("tmp/test/#{vendor.downcase}_repository").to_s
                  # Unlike ruby, JRuby returns Rails.root with backslashes under Windows
                  path.tr("\\", "/")
                end
                # Returns the url of the subversion test repository
                def self.subversion_repository_url
                  path = repository_path('subversion')
                  path = '/' + path unless path.starts_with?('/')
                  "file://#{path}"
                end
                # Returns true if the +vendor+ test repository is configured
                def self.repository_configured?(vendor)
                  File.directory?(repository_path(vendor))
                end
                def repository_path_hash(arr)
                  hs = {}
                  hs[:path]  = arr.join("/")
                  hs[:param] = arr.join("/")
                  hs
                end
                def sqlite?
                  ActiveRecord::Base.connection.adapter_name =~ /sqlite/i
                end
                def mysql?
                  ActiveRecord::Base.connection.adapter_name =~ /mysql/i
                end
                def postgresql?
                  ActiveRecord::Base.connection.adapter_name =~ /postgresql/i
                end
                def quoted_date(date)
                  date = Date.parse(date) if date.is_a?(String)
                  ActiveRecord::Base.connection.quoted_date(date)
                end
+             	# Asserts that a new record for the given class is created
+             	# and returns it
+               def new_record(klass, &block)
+                 assert_difference "#{klass}.count" do
+                   yield
+                 end
+                 klass.order(:id => :desc).first
+               end
                def assert_save(object)
                  saved = object.save
                  message = "#{object.class} could not be saved"
                  errors = object.errors.full_messages.map {|m| "- #{m}"}
                  message << ":\n#{errors.join("\n")}" if errors.any?
                  assert_equal true, saved, message
                end
                def assert_select_error(arg)
                  assert_select '#errorExplanation', :text => arg
                end
                def assert_include(expected, s, message=nil)
                  assert s.include?(expected), (message || "\"#{expected}\" not found in \"#{s}\"")
                end
                def assert_not_include(expected, s, message=nil)
                  assert !s.include?(expected), (message || "\"#{expected}\" found in \"#{s}\"")
                end
                def assert_select_in(text, *args, &block)
                  d = Nokogiri::HTML(CGI::unescapeHTML(String.new(text))).root
                  assert_select(d, *args, &block)
                end
                def assert_select_email(*args, &block)
                  email = ActionMailer::Base.deliveries.last
                  assert_not_nil email
                  html_body = email.parts.detect {|part| part.content_type.include?('text/html')}.try(&:body)
                  assert_not_nil html_body
                  assert_select_in html_body.encoded, *args, &block
                end
                def assert_mail_body_match(expected, mail, message=nil)
                  if expected.is_a?(String)
                    assert_include expected, mail_body(mail), message
                  else
                    assert_match expected, mail_body(mail), message
                  end
                end
                def assert_mail_body_no_match(expected, mail, message=nil)
                  if expected.is_a?(String)
                    assert_not_include expected, mail_body(mail), message
                  else
                    assert_no_match expected, mail_body(mail), message
                  end
                end
                def mail_body(mail)
                  mail.parts.first.body.encoded
                end
                # Returns the lft value for a new root issue
                def new_issue_lft
 
                end
              end
              module Redmine
                class RoutingTest < ActionDispatch::IntegrationTest
                  def should_route(arg)
                    arg = arg.dup
                    request = arg.keys.detect {|key| key.is_a?(String)}
                    raise ArgumentError unless request
                    options = arg.slice!(request)
                    raise ArgumentError unless request =~ /\A(GET|POST|PUT|PATCH|DELETE)\s+(.+)\z/
                    method, path = $1.downcase.to_sym, $2
                    raise ArgumentError unless arg.values.first =~ /\A(.+)#(.+)\z/
                    controller, action = $1, $2
                    assert_routing(
                      {:method => method, :path => path},
                      options.merge(:controller => controller, :action => action)
                    )
                  end
                end
                class IntegrationTest < ActionDispatch::IntegrationTest
                  def log_user(login, password)
                    User.anonymous
                    get "/login"
                    assert_equal nil, session[:user_id]
                    assert_response :success
                    assert_template "account/login"
                    post "/login", :username => login, :password => password
                    assert_equal login, User.find(session[:user_id]).login
                  end
                  def credentials(user, password=nil)
                    {'HTTP_AUTHORIZATION' => ActionController::HttpAuthentication::Basic.encode_credentials(user, password || user)}
                  end
                end
                module ApiTest
                  API_FORMATS = %w(json xml).freeze
                  # Base class for API tests
                  class Base < Redmine::IntegrationTest
                    def setup
                      Setting.rest_api_enabled = '1'
                    end
                    def teardown
                      Setting.rest_api_enabled = '0'
                    end
                    # Uploads content using the XML API and returns the attachment token
                    def xml_upload(content, credentials)
                      upload('xml', content, credentials)
                    end
                    # Uploads content using the JSON API and returns the attachment token
                    def json_upload(content, credentials)
                      upload('json', content, credentials)
                    end
                    def upload(format, content, credentials)
                      set_tmp_attachments_directory
                      assert_difference 'Attachment.count' do
                        post "/uploads.#{format}", content, {"CONTENT_TYPE" => 'application/octet-stream'}.merge(credentials)
                        assert_response :created
                      end
                      data = response_data
                      assert_kind_of Hash, data['upload']
                      token = data['upload']['token']
                      assert_not_nil token
                      token
                    end
                    # Parses the response body based on its content type
                    def response_data
                      unless response.content_type.to_s =~ /^application\/(.+)/
                        raise "Unexpected response type: #{response.content_type}"
                      end
                      format = $1
                      case format
                      when 'xml'
                        Hash.from_xml(response.body)
                      when 'json'
                        ActiveSupport::JSON.decode(response.body)
                      else
                        raise "Unknown response format: #{format}"
                      end
                    end
                  end
                  class Routing < Redmine::RoutingTest
                    def should_route(arg)
                      arg = arg.dup
                      request = arg.keys.detect {|key| key.is_a?(String)}
                      raise ArgumentError unless request
                      options = arg.slice!(request)
                      API_FORMATS.each do |format|
                        format_request = request.sub /$/, ".#{format}"
                        super options.merge(format_request => arg[request], :format => format)
                      end
                    end
                  end
                end
              end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages