jro_apps/redmine Commit - r13202:bdd3ccf8e52c

Adds a role setting for controlling visibility of users: all or members of visible projects (#11724)....

Jean-Philippe Lang -

r13202:bdd3ccf8e52c

parent child

Context file:

r13202:bdd3ccf8e52c

Collapse all files

db/migrate/20141109112308_add_roles_users_visibility.rb created 644 +9 0

@@ -0,0 +1,9
	1	class AddRolesUsersVisibility < ActiveRecord::Migration
	2	def self.up
	3	add_column :roles, :users_visibility, :string, :limit => 30, :default => 'all', :null => false
	4	end
	5
	6	def self.down
	7	remove_column :roles, :users_visibility
	8	end
	9	end

app/controllers/users_controller.rb +5 -7

               end
               def show
+                unless @user.visible?
+                  render_404
+                  return
+                end
                 # show projects based on current user visibility
                 @memberships = @user.memberships.where(Project.visible_condition(User.current)).to_a
                 events = Redmine::Activity::Fetcher.new(User.current, :author => @user).events(nil, nil, :limit => 10)
                 @events_by_day = events.group_by(&:event_date)
-                unless User.current.admin?
-                  if !@user.active? || (@user != User.current  && @memberships.empty? && events.empty?)
-                    render_404
-                    return
-                  end
-                end
                 respond_to do |format|
                   format.html { render :layout => 'base' }
                   format.api

app/controllers/watchers_controller.rb +9 -7

                 else
                   user_ids << params[:user_id]
                 end
-                user_ids.flatten.compact.uniq.each do |user_id|
+                users = User.active.visible.where(:id => user_ids.flatten.compact.uniq)
-                  Watcher.create(:watchable => @watched, :user_id => user_id)
+                users.each do |user|
+                  Watcher.create(:watchable => @watched, :user => user)
                 end
                 respond_to do |format|
                   format.html { redirect_to_referer_or {render :text => 'Watcher added.', :layout => true}}
               def append
                 if params[:watcher].is_a?(Hash)
                   user_ids = params[:watcher][:user_ids] || [params[:watcher][:user_id]]
-                  @users = User.active.where(:id => user_ids).to_a
+                  @users = User.active.visible.where(:id => user_ids).to_a
                 end
                 if @users.blank?
                   render :nothing => true
               end
               def destroy
-                @watched.set_watcher(User.find(params[:user_id]), false)
+                @watched.set_watcher(User.visible.find(params[:user_id]), false)
                 respond_to do |format|
                   format.html { redirect_to :back }
                   format.js
               end
               def users_for_new_watcher
-                users = []
+                scope = nil
                 if params[:q].blank? && @project.present?
-                  users = @project.users.sorted
+                  scope = @project.users
                 else
-                  users = User.active.sorted.like(params[:q]).limit(100)
+                  scope = User.all.limit(100)
                 end
+                users = scope.active.visible.sorted.like(params[:q]).to_a
                 if @watched
                   users -= @watched.watcher_users
                 end

app/models/issue_query.rb +4 -4

                 issue_custom_fields = []
                 if project
-                  principals += project.principals.sort
+                  principals += project.principals.visible
                   unless project.leaf?
                     subprojects = project.descendants.visible.to_a
-                    principals += Principal.member_of(subprojects)
+                    principals += Principal.member_of(subprojects).visible
                   end
                   versions = project.shared_versions.to_a
                   categories = project.issue_categories.to_a
                   issue_custom_fields = project.all_issue_custom_fields
                 else
                   if all_projects.any?
-                    principals += Principal.member_of(all_projects)
+                    principals += Principal.member_of(all_projects).visible
                   end
                   versions = Version.visible.where(:sharing => 'system').to_a
                   issue_custom_fields = IssueCustomField.where(:is_for_all => true)
                   :type => :list_optional, :values => assigned_to_values
                 ) unless assigned_to_values.empty?
-                group_values = Group.givable.collect {|g| [g.name, g.id.to_s] }
+                group_values = Group.givable.visible.collect {|g| [g.name, g.id.to_s] }
                 add_available_filter("member_of_group",
                   :type => :list_optional, :values => group_values
                 ) unless group_values.empty?

app/models/principal.rb +28 0

@@ -38,6 +38,30 class Principal < ActiveRecord::Base
38	# Groups and active users	38	# Groups and active users
39	scope :active, lambda { where(:status => STATUS_ACTIVE) }	39	scope :active, lambda { where(:status => STATUS_ACTIVE) }
40		40
		41	scope :visible, lambda {\|*args\|
		42	user = args.first \|\| User.current
		43
		44	if user.admin?
		45	all
		46	else
		47	view_all_active = false
		48	if user.memberships.to_a.any?
		49	view_all_active = user.memberships.any? {\|m\| m.roles.any? {\|r\| r.users_visibility == 'all'}}
		50	else
		51	view_all_active = user.builtin_role.users_visibility == 'all'
		52	end
		53
		54	if view_all_active
		55	active
		56	else
		57	# self and members of visible projects
		58	active.where("#{table_name}.id = ? OR #{table_name}.id IN (SELECT user_id FROM #{Member.table_name} WHERE project_id IN (?))",
		59	user.id, user.visible_project_ids
		60	)
		61	end
		62	end
		63	}
		64
41	scope :like, lambda {\|q\|	65	scope :like, lambda {\|q\|
42	q = q.to_s	66	q = q.to_s
43	if q.blank?	67	if q.blank?
@@ -84,6 +108,10 class Principal < ActiveRecord::Base
84	to_s	108	to_s
85	end	109	end
86		110
		111	def visible?(user=User.current)
		112	Principal.visible(user).where(:id => id).first == self
		113	end
		114
87	# Return true if the principal is a member of project	115	# Return true if the principal is a member of project
88	def member_of?(project)	116	def member_of?(project)
89	projects.to_a.include?(project)	117	projects.to_a.include?(project)

app/models/role.rb +8 0

                 ['own', :label_issues_visibility_own]
               ]
+              USERS_VISIBILITY_OPTIONS = [
+                ['all', :label_users_visibility_all],
+                ['members_of_visible_projects', :label_users_visibility_members_of_visible_projects]
+              ]
               scope :sorted, lambda { order(:builtin, :position) }
               scope :givable, lambda { order(:position).where(:builtin => 0) }
               scope :builtin, lambda { |*args|
               validates_inclusion_of :issues_visibility,
                 :in => ISSUES_VISIBILITY_OPTIONS.collect(&:first),
                 :if => lambda {|role| role.respond_to?(:issues_visibility)}
+              validates_inclusion_of :users_visibility,
+                :in => USERS_VISIBILITY_OPTIONS.collect(&:first),
+                :if => lambda {|role| role.respond_to?(:users_visibility)}
               # Copies attributes from another role, arg can be an id or a Role
               def copy_from(arg, options={})

app/models/time_entry_query.rb +3 -3

                 principals = []
                 if project
-                  principals += project.principals.sort
+                  principals += project.principals.visible.sort
                   unless project.leaf?
                     subprojects = project.descendants.visible.to_a
                     if subprojects.any?
                       add_available_filter "subproject_id",
                         :type => :list_subprojects,
                         :values => subprojects.collect{|s| [s.name, s.id.to_s] }
-                      principals += Principal.member_of(subprojects)
+                      principals += Principal.member_of(subprojects).visible
                     end
                   end
                 else
                   if all_projects.any?
                     # members of visible projects
-                    principals += Principal.member_of(all_projects)
+                    principals += Principal.member_of(all_projects).visible
                     # project filter
                     project_values = []
                     if User.current.logged? && User.current.memberships.any?

app/models/user.rb +6 0

                 @notified_projects_ids = nil
                 @notified_projects_ids_changed = false
                 @builtin_role = nil
+                @visible_project_ids = nil
                 base_reload(*args)
               end
                 @projects_by_role = hash
               end
+              # Returns the ids of visible projects
+              def visible_project_ids
+                @visible_project_ids ||= Project.visible(self).pluck(:id)
+              end
               # Returns true if user is arg or belongs to arg
               def is_or_belongs_to?(arg)
                 if arg.is_a?(User)

app/views/roles/_form.html.erb +15 -11

@@ -1,18 +1,22
1	<%= error_messages_for 'role' %>	1	<%= error_messages_for 'role' %>
2		2
3	<% unless @role.anonymous? %>
4	<div class="box tabular">	3	<div class="box tabular">
5	<% unless @role.builtin? %>	4	<% unless @role.builtin? %>
6	<p><%= f.text_field :name, :required => true %></p>	5	<p><%= f.text_field :name, :required => true %></p>
7	<p><%= f.check_box :assignable %></p>	6	<p><%= f.check_box :assignable %></p>
8	<% end %>	7	<% end %>
9	<p><%= f.select :issues_visibility, Role::ISSUES_VISIBILITY_OPTIONS.collect {\|v\| [l(v.last), v.first]} %></p>	8
10	<% if @role.new_record? && @roles.any? %>	9	<% unless @role.anonymous? %>
11	<p><label for="copy_workflow_from"><%= l(:label_copy_workflow_from) %></label>	10	<p><%= f.select :issues_visibility, Role::ISSUES_VISIBILITY_OPTIONS.collect {\|v\| [l(v.last), v.first]} %></p>
12	<%= select_tag(:copy_workflow_from, content_tag("option") + options_from_collection_for_select(@roles, :id, :name, params[:copy_workflow_from] \|\| @copy_from.try(:id))) %></p>	11	<% end %>
13	<% end %>	12
		13	<p><%= f.select :users_visibility, Role::USERS_VISIBILITY_OPTIONS.collect {\|v\| [l(v.last), v.first]} %></p>
		14
		15	<% if @role.new_record? && @roles.any? %>
		16	<p><label for="copy_workflow_from"><%= l(:label_copy_workflow_from) %></label>
		17	<%= select_tag(:copy_workflow_from, content_tag("option") + options_from_collection_for_select(@roles, :id, :name, params[:copy_workflow_from] \|\| @copy_from.try(:id))) %></p>
		18	<% end %>
14	</div>	19	</div>
15	<% end %>
16		20
17	<h3><%= l(:label_permissions) %></h3>	21	<h3><%= l(:label_permissions) %></h3>
18	<div class="box tabular" id="permissions">	22	<div class="box tabular" id="permissions">

config/locales/en.yml +3 0

               field_generate_password: Generate password
               field_must_change_passwd: Must change password at next logon
               field_default_status: Default status
+              field_users_visibility: Users visibility
               setting_app_title: Application title
               setting_app_subtitle: Application subtitle
               label_latest_compatible_version: Latest compatible version
               label_unknown_plugin: Unknown plugin
               label_add_projects: Add projects
+              label_users_visibility_all: All active users
+              label_users_visibility_members_of_visible_projects: Members of visible projects
               button_login: Login
               button_submit: Submit

config/locales/fr.yml +3 0

               field_generate_password: Générer un mot de passe
               field_must_change_passwd: Doit changer de mot de passe à la prochaine connexion
               field_default_status: Statut par défaut
+              field_users_visibility: Visibilité des utilisateurs
               setting_app_title: Titre de l'application
               setting_app_subtitle: Sous-titre de l'application
               label_latest_compatible_version: Dernière version compatible
               label_unknown_plugin: Plugin inconnu
               label_add_projects: Ajouter des projets
+              label_users_visibility_all: Tous les utilisateurs actifs
+              label_users_visibility_members_of_visible_projects: Membres des projets visibles
               button_login: Connexion
               button_submit: Soumettre

lib/redmine/default_data/loader.rb +1 0

                         # Roles
                         manager = Role.create! :name => l(:default_role_manager),
                                                :issues_visibility => 'all',
+                                               :users_visibility => 'all',
                                                :position => 1
                         manager.permissions = manager.setable_permissions.collect {|p| p.name}
                         manager.save!

test/fixtures/roles.yml +5 0

               id: 1
               builtin: 0
               issues_visibility: all
+              users_visibility: all
               permissions: |
                 ---
                 - :add_project
               id: 2
               builtin: 0
               issues_visibility: default
+              users_visibility: all
               permissions: |
                 ---
                 - :edit_project
               id: 3
               builtin: 0
               issues_visibility: default
+              users_visibility: all
               permissions: |
                 ---
                 - :edit_project
               id: 4
               builtin: 1
               issues_visibility: default
+              users_visibility: all
               permissions: |
                 ---
                 - :view_issues
               id: 5
               builtin: 2
               issues_visibility: default
+              users_visibility: all
               permissions: |
                 ---
                 - :view_issues

test/functional/users_controller_test.rb +9 -6

                 assert_response 404
               end
-              def test_show_should_not_reveal_users_with_no_visible_activity_or_project
-                @request.session[:user_id] = nil
-                get :show, :id => 9
-                assert_response 404
-              end
               def test_show_inactive_by_admin
                 @request.session[:user_id] = 1
                 get :show, :id => 5
                 assert_not_nil assigns(:user)
               end
+              def test_show_user_who_is_not_visible_should_return_404
+                Role.anonymous.update! :users_visibility => 'members_of_visible_projects'
+                user = User.generate!
+                @request.session[:user_id] = nil
+                get :show, :id => user.id
+                assert_response 404
+              end
               def test_show_displays_memberships_based_on_project_visibility
                 @request.session[:user_id] = 1
                 get :show, :id => 2

test/functional/watchers_controller_test.rb +15 0

@@ -227,6 +227,21 class WatchersControllerTest < ActionController::TestCase
227	assert Issue.find(2).watched_by?(user)	227	assert Issue.find(2).watched_by?(user)
228	end	228	end
229		229
		230	def test_autocomplete_for_user_should_return_visible_users
		231	Role.update_all :users_visibility => 'members_of_visible_projects'
		232
		233	hidden = User.generate!(:lastname => 'autocomplete')
		234	visible = User.generate!(:lastname => 'autocomplete')
		235	User.add_to_project(visible, Project.find(1))
		236
		237	@request.session[:user_id] = 2
		238	xhr :get, :autocomplete_for_user, :q => 'autocomp', :project_id => 'ecookbook'
		239	assert_response :success
		240
		241	assert_include visible, assigns(:users)
		242	assert_not_include hidden, assigns(:users)
		243	end
		244
230	def test_append	245	def test_append
231	@request.session[:user_id] = 2	246	@request.session[:user_id] = 2
232	assert_no_difference 'Watcher.count' do	247	assert_no_difference 'Watcher.count' do

test/unit/principal_test.rb +22 -1

@@ -20,7 +20,7
20	require File.expand_path('../../test_helper', __FILE__)	20	require File.expand_path('../../test_helper', __FILE__)
21		21
22	class PrincipalTest < ActiveSupport::TestCase	22	class PrincipalTest < ActiveSupport::TestCase
23	fixtures :users, :projects, :members, :member_roles	23	fixtures :users, :projects, :members, :member_roles, :roles
24		24
25	def test_active_scope_should_return_groups_and_active_users	25	def test_active_scope_should_return_groups_and_active_users
26	result = Principal.active.to_a	26	result = Principal.active.to_a
@@ -30,6 +30,27 class PrincipalTest < ActiveSupport::TestCase
30	assert_nil result.detect {\|p\| p.is_a?(AnonymousUser)}	30	assert_nil result.detect {\|p\| p.is_a?(AnonymousUser)}
31	end	31	end
32		32
		33	def test_visible_scope_for_admin_should_return_all_principals
		34	admin = User.generate! {\|u\| u.admin = true}
		35	assert_equal Principal.count, Principal.visible(admin).count
		36	end
		37
		38	def test_visible_scope_for_user_with_members_of_visible_projects_visibility_should_return_active_principals
		39	Role.non_member.update! :users_visibility => 'all'
		40	user = User.generate!
		41
		42	expected = Principal.active
		43	assert_equal expected.map(&:id).sort, Principal.visible(user).pluck(:id).sort
		44	end
		45
		46	def test_visible_scope_for_user_with_members_of_visible_projects_visibility_should_return_members_of_visible_projects_and_self
		47	Role.non_member.update! :users_visibility => 'members_of_visible_projects'
		48	user = User.generate!
		49
		50	expected = Project.visible(user).map(&:member_principals).flatten.map(&:principal).uniq << user
		51	assert_equal expected.map(&:id).sort, Principal.visible(user).pluck(:id).sort
		52	end
		53
33	def test_member_of_scope_should_return_the_union_of_all_members	54	def test_member_of_scope_should_return_the_union_of_all_members
34	projects = Project.find([1])	55	projects = Project.find([1])
35	assert_equal [3, 2], Principal.member_of(projects).sort.map(&:id)	56	assert_equal [3, 2], Principal.member_of(projects).sort.map(&:id)

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages