jro_apps/redmine Commit - r5346:f16cddd57ae8

Private issues (#7414)....

Jean-Philippe Lang -

r5346:f16cddd57ae8

parent child

Context file:

r5346:f16cddd57ae8

Collapse all files

db/migrate/20110412065600_add_issues_is_private.rb created 644 +9 0

@@ -0,0 +1,9
	1	class AddIssuesIsPrivate < ActiveRecord::Migration
	2	def self.up
	3	add_column :issues, :is_private, :boolean, :default => false, :null => false
	4	end
	5
	6	def self.down
	7	remove_column :issues, :is_private
	8	end
	9	end

app/helpers/issues_helper.rb +12 -3

               def render_issue_subject_with_tree(issue)
                 s = ''
-                ancestors = issue.root? ? [] : issue.ancestors.all
+                ancestors = issue.root? ? [] : issue.ancestors.visible.all
                 ancestors.each do |ancestor|
                   s << '<div>' + content_tag('p', link_to_issue(ancestor))
                 end
-                s << '<div>' + content_tag('h3', h(issue.subject))
+                s << '<div>'
+                subject = h(issue.subject)
+                if issue.is_private?
+                  subject = content_tag('span', l(:field_is_private), :class => 'private') + ' ' + subject
+                end
+                s << content_tag('h3', subject)
                 s << '</div>' * (ancestors.size + 1)
                 s
               end
               def render_descendants_tree(issue)
                 s = '<form><table class="list issues">'
-                issue_list(issue.descendants.sort_by(&:lft)) do |child, level|
+                issue_list(issue.descendants.visible.sort_by(&:lft)) do |child, level|
                   s << content_tag('tr',
                          content_tag('td', check_box_tag("ids[]", child.id, false, :id => nil), :class => 'checkbox') +
                          content_tag('td', link_to_issue(child, :truncate => 60), :class => 'subject') +
                     label = l(:field_parent_issue)
                     value = "##{detail.value}" unless detail.value.blank?
                     old_value = "##{detail.old_value}" unless detail.old_value.blank?
+                  when detail.prop_key == 'is_private'
+                    value = l(detail.value == "0" ? :general_text_No : :general_text_Yes) unless detail.value.blank?
+                    old_value = l(detail.old_value == "0" ? :general_text_No : :general_text_Yes) unless detail.old_value.blank?
                   end
                 when 'cf'
                   custom_field = CustomField.find_by_id(detail.prop_key)

app/models/issue.rb +13 -2

               def self.visible_condition(user, options={})
                 Project.allowed_to_condition(user, :view_issues, options) do |role, user|
                   case role.issues_visibility
-                  when 'default'
+                  when 'all'
                     nil
+                  when 'default'
+                    "(#{table_name}.is_private = #{connection.quoted_false} OR #{table_name}.author_id = #{user.id} OR #{table_name}.assigned_to_id = #{user.id})"
                   when 'own'
                     "(#{table_name}.author_id = #{user.id} OR #{table_name}.assigned_to_id = #{user.id})"
                   else
               def visible?(usr=nil)
                 (usr || User.current).allowed_to?(:view_issues, self.project) do |role, user|
                   case role.issues_visibility
-                  when 'default'
+                  when 'all'
                     true
+                  when 'default'
+                    !self.is_private? || self.author == user || self.assigned_to == user
                   when 'own'
                     self.author == user || self.assigned_to == user
                   else
                 'done_ratio',
                 :if => lambda {|issue, user| issue.new_statuses_allowed_to(user).any? }
+              safe_attributes 'is_private',
+                :if => lambda {|issue, user|
+                  user.allowed_to?(:set_issues_private, issue.project) ||
+                    (issue.author == user && user.allowed_to?(:set_own_issues_private, issue.project))
+                }
               # Safely sets attributes
               # Should be called from controllers instead of #attributes=
               # attr_accessible is too rough because we still want things like
                 s << ' overdue' if overdue?
                 s << ' child' if child?
                 s << ' parent' unless leaf?
+                s << ' private' if is_private?
                 s << ' created-by-me' if User.current.logged? && author_id == User.current.id
                 s << ' assigned-to-me' if User.current.logged? && assigned_to_id == User.current.id
                 s

app/models/journal_detail.rb +18 0

@@ -17,4 +17,22
17		17
18	class JournalDetail < ActiveRecord::Base	18	class JournalDetail < ActiveRecord::Base
19	belongs_to :journal	19	belongs_to :journal
		20	before_save :normalize_values
		21
		22	private
		23
		24	def normalize_values
		25	self.value = normalize(value)
		26	self.old_value = normalize(old_value)
		27	end
		28
		29	def normalize(v)
		30	if v == true
		31	"1"
		32	elsif v == false
		33	"0"
		34	else
		35	v
		36	end
		37	end
20	end	38	end

app/models/role.rb +2 -1

               BUILTIN_ANONYMOUS  = 2
               ISSUES_VISIBILITY_OPTIONS = [
-                ['default', :label_issues_visibility_all],
+                ['all', :label_issues_visibility_all],
+                ['default', :label_issues_visibility_public],
                 ['own', :label_issues_visibility_own]
               ]

app/views/issues/_form.rhtml +5 0

             <%= call_hook(:view_issues_form_details_top, { :issue => @issue, :form => f }) %>
             <div id="issue_descr_fields" <%= 'style="display:none"' unless @issue.new_record? || @issue.errors.any? %>>
+            <% if @issue.safe_attribute_names.include?('is_private') %>
+            <p style="float:right; margin-right:1em;">
+              <label class="inline" for="issue_is_private"><%= f.check_box :is_private, :no_label => true %> <%= l(:field_is_private) %></label>
+            </p>
+            <% end %>
             <p><%= f.select :tracker_id, @project.trackers.collect {|t| [t.name, t.id]}, :required => true %></p>
             <%= observe_field :issue_tracker_id, :url => { :action => :new, :project_id => @project, :id => @issue },
                                                  :update => :attributes,

config/locales/en.yml +4 0

               field_visible: Visible
               field_warn_on_leaving_unsaved: "Warn me when leaving a page with unsaved text"
               field_issues_visibility: Issues visibility
+              field_is_private: Private
               setting_app_title: Application title
               setting_app_subtitle: Application subtitle
               permission_add_issues: Add issues
               permission_edit_issues: Edit issues
               permission_manage_issue_relations: Manage issue relations
+              permission_set_issues_private: Set issues public or private
+              permission_set_own_issues_private: Set own issues public or private
               permission_add_issue_notes: Add notes
               permission_edit_issue_notes: Edit notes
               permission_edit_own_issue_notes: Edit own notes
               label_additional_workflow_transitions_for_author: Additional transitions allowed when the user is the author
               label_additional_workflow_transitions_for_assignee: Additional transitions allowed when the user is the assignee
               label_issues_visibility_all: All issues
+              label_issues_visibility_public: All non private issues
               label_issues_visibility_own: Issues created by or assigned to the user
               button_login: Login

config/locales/fr.yml +4 0

               field_visible: Visible
               field_warn_on_leaving_unsaved: "M'avertir lorsque je quitte une page contenant du texte non sauvegardé"
               field_issues_visibility: Visibilité des demandes
+              field_is_private: Privée
               setting_app_title: Titre de l'application
               setting_app_subtitle: Sous-titre de l'application
               permission_add_issues: Créer des demandes
               permission_edit_issues: Modifier les demandes
               permission_manage_issue_relations: Gérer les relations
+              permission_set_issues_private: Rendre les demandes publiques ou privées
+              permission_set_own_issues_private: Rendre ses propres demandes publiques ou privées
               permission_add_issue_notes: Ajouter des notes
               permission_edit_issue_notes: Modifier les notes
               permission_edit_own_issue_notes: Modifier ses propres notes
               label_additional_workflow_transitions_for_author: Autorisations supplémentaires lorsque l'utilisateur a créé la demande
               label_additional_workflow_transitions_for_assignee: Autorisations supplémentaires lorsque la demande est assignée à l'utilisateur
               label_issues_visibility_all: Toutes les demandes
+              label_issues_visibility_public: Toutes les demandes non privées
               label_issues_visibility_own: Demandes créées par ou assignées à l'utilisateur
               button_login: Connexion

lib/redmine.rb +2 0

                 map.permission :edit_issues, {:issues => [:edit, :update, :bulk_edit, :bulk_update, :update_form], :journals => [:new]}
                 map.permission :manage_issue_relations, {:issue_relations => [:new, :destroy]}
                 map.permission :manage_subtasks, {}
+                map.permission :set_issues_private, {}
+                map.permission :set_own_issues_private, {}
                 map.permission :add_issue_notes, {:issues => [:edit, :update], :journals => [:new]}
                 map.permission :edit_issue_notes, {:journals => :edit}, :require => :loggedin
                 map.permission :edit_own_issue_notes, {:journals => :edit}, :require => :loggedin

lib/redmine/default_data/loader.rb +3 -2

-            # redMine - project management software
+            # Redmine - project management software
-            # Copyright (C) 2006-2007  Jean-Philippe Lang
+            # Copyright (C) 2006-2011  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
                       Role.transaction do
                         # Roles
                         manager = Role.create! :name => l(:default_role_manager),
+                                               :issues_visibility => 'all',
                                                :position => 1
                         manager.permissions = manager.setable_permissions.collect {|p| p.name}
                         manager.save!

public/stylesheets/application.css +1 0

             div.issue div.subject p {margin: 0; margin-bottom: 0.1em; font-size: 90%; color: #999;}
             div.issue div.subject>div>p { margin-top: 0.5em; }
             div.issue div.subject h3 {margin: 0; margin-bottom: 0.1em;}
+            div.issue span.private { position:relative; bottom: 2px; text-transform: uppercase; background: #d22; color: #fff; font-weight:bold; padding: 0px 2px 0px 2px; font-size: 60%; margin-right: 2px; border-radius: 2px; -moz-border-radius: 2px;}
             #issue_tree table.issues, #relations table.issues { border: 0; }
             #issue_tree td.checkbox, #relations td.checkbox {display:none;}

test/fixtures/attachments.yml +13 0

@@ -169,3 +169,16 attachments_014:
169	filename: changeset_utf8.diff	169	filename: changeset_utf8.diff
170	author_id: 2	170	author_id: 2
171	content_type: text/x-diff	171	content_type: text/x-diff
		172	attachments_015:
		173	id: 15
		174	created_on: 2010-07-19 21:07:27 +02:00
		175	container_type: Issue
		176	container_id: 14
		177	downloads: 0
		178	disk_filename: 060719210727_changeset_utf8.diff
		179	digest: b91e08d0cf966d5c6ff411bd8c4cc3a2
		180	filesize: 687
		181	filename: private.diff
		182	author_id: 2
		183	content_type: text/x-diff
		184	description: attachement of a private issue

test/fixtures/issues.yml +18 0

@@ -244,3 +244,21 issues_013:
244	root_id: 13	244	root_id: 13
245	lft: 1	245	lft: 1
246	rgt: 2	246	rgt: 2
		247	issues_014:
		248	id: 14
		249	created_on: <%= 15.days.ago.to_date.to_s(:db) %>
		250	project_id: 3
		251	updated_on: <%= 15.days.ago.to_date.to_s(:db) %>
		252	priority_id: 5
		253	subject: Private issue on public project
		254	fixed_version_id:
		255	category_id:
		256	description: This is a private issue
		257	tracker_id: 1
		258	assigned_to_id:
		259	author_id: 2
		260	status_id: 1
		261	is_private: true
		262	root_id: 14
		263	lft: 1
		264	rgt: 2

test/fixtures/roles.yml +1 -1

               name: Manager
               id: 1
               builtin: 0
-              issues_visibility: default
+              issues_visibility: all
               permissions: |
                 ---
                 - :add_project

test/functional/attachments_controller_test.rb +12 0

@@ -86,6 +86,18 class AttachmentsControllerTest < ActionController::TestCase
86	assert_equal 'application/octet-stream', @response.content_type	86	assert_equal 'application/octet-stream', @response.content_type
87	end	87	end
88		88
		89	def test_show_file_from_private_issue_without_permission
		90	get :show, :id => 15
		91	assert_redirected_to '/login?back_url=http%3A%2F%2Ftest.host%2Fattachments%2F15'
		92	end
		93
		94	def test_show_file_from_private_issue_with_permission
		95	@request.session[:user_id] = 2
		96	get :show, :id => 15
		97	assert_response :success
		98	assert_tag 'h2', :content => /private.diff/
		99	end
		100
89	def test_download_text_file	101	def test_download_text_file
90	get :download, :id => 4	102	get :download, :id => 4
91	assert_response :success	103	assert_response :success

test/functional/issues_controller_test.rb +49 0

@@ -92,6 +92,13 class IssuesControllerTest < ActionController::TestCase
92	assert_tag :tag => 'a', :content => /Subproject issue/	92	assert_tag :tag => 'a', :content => /Subproject issue/
93	end	93	end
94		94
		95	def test_index_should_list_visible_issues_only
		96	get :index, :per_page => 100
		97	assert_response :success
		98	assert_not_nil assigns(:issues)
		99	assert_nil assigns(:issues).detect {\|issue\| !issue.visible?}
		100	end
		101
95	def test_index_with_project	102	def test_index_with_project
96	Setting.display_subprojects_issues = 0	103	Setting.display_subprojects_issues = 0
97	get :index, :project_id => 1	104	get :index, :project_id => 1
@@ -317,6 +324,12 class IssuesControllerTest < ActionController::TestCase
317	assert_response :redirect	324	assert_response :redirect
318	end	325	end
319		326
		327	def test_show_should_deny_anonymous_access_to_private_issue
		328	Issue.update_all(["is_private = ?", true], "id = 1")
		329	get :show, :id => 1
		330	assert_response :redirect
		331	end
		332
320	def test_show_should_deny_non_member_access_without_permission	333	def test_show_should_deny_non_member_access_without_permission
321	Role.non_member.remove_permission!(:view_issues)	334	Role.non_member.remove_permission!(:view_issues)
322	@request.session[:user_id] = 9	335	@request.session[:user_id] = 9
@@ -324,6 +337,13 class IssuesControllerTest < ActionController::TestCase
324	assert_response 403	337	assert_response 403
325	end	338	end
326		339
		340	def test_show_should_deny_non_member_access_to_private_issue
		341	Issue.update_all(["is_private = ?", true], "id = 1")
		342	@request.session[:user_id] = 9
		343	get :show, :id => 1
		344	assert_response 403
		345	end
		346
327	def test_show_should_deny_member_access_without_permission	347	def test_show_should_deny_member_access_without_permission
328	Role.find(1).remove_permission!(:view_issues)	348	Role.find(1).remove_permission!(:view_issues)
329	@request.session[:user_id] = 2	349	@request.session[:user_id] = 2
@@ -331,6 +351,35 class IssuesControllerTest < ActionController::TestCase
331	assert_response 403	351	assert_response 403
332	end	352	end
333		353
		354	def test_show_should_deny_member_access_to_private_issue_without_permission
		355	Issue.update_all(["is_private = ?", true], "id = 1")
		356	@request.session[:user_id] = 3
		357	get :show, :id => 1
		358	assert_response 403
		359	end
		360
		361	def test_show_should_allow_author_access_to_private_issue
		362	Issue.update_all(["is_private = ?, author_id = 3", true], "id = 1")
		363	@request.session[:user_id] = 3
		364	get :show, :id => 1
		365	assert_response :success
		366	end
		367
		368	def test_show_should_allow_assignee_access_to_private_issue
		369	Issue.update_all(["is_private = ?, assigned_to_id = 3", true], "id = 1")
		370	@request.session[:user_id] = 3
		371	get :show, :id => 1
		372	assert_response :success
		373	end
		374
		375	def test_show_should_allow_member_access_to_private_issue_with_permission
		376	Issue.update_all(["is_private = ?", true], "id = 1")
		377	User.find(3).roles_for_project(Project.find(1)).first.update_attribute :issues_visibility, 'all'
		378	@request.session[:user_id] = 3
		379	get :show, :id => 1
		380	assert_response :success
		381	end
		382
334	def test_show_should_not_disclose_relations_to_invisible_issues	383	def test_show_should_not_disclose_relations_to_invisible_issues
335	Setting.cross_project_issue_relations = '1'	384	Setting.cross_project_issue_relations = '1'
336	IssueRelation.create!(:issue_from => Issue.find(1), :issue_to => Issue.find(2), :relation_type => 'relates')	385	IssueRelation.create!(:issue_from => Issue.find(1), :issue_to => Issue.find(2), :relation_type => 'relates')

test/unit/issue_test.rb +7 -2

                 issues = Issue.visible(User.anonymous).all
                 assert issues.any?
                 assert_nil issues.detect {|issue| !issue.project.is_public?}
+                assert_nil issues.detect {|issue| issue.is_private?}
                 assert_visibility_match User.anonymous, issues
               end
                 issues = Issue.visible(user).all
                 assert issues.any?
                 assert_nil issues.detect {|issue| !issue.project.is_public?}
+                assert_nil issues.detect {|issue| issue.is_private?}
                 assert_visibility_match user, issues
               end
                 user = User.find(9)
                 # User should see issues of projects for which he has view_issues permissions only
                 Role.non_member.remove_permission!(:view_issues)
-                Member.create!(:principal => user, :project_id => 2, :role_ids => [1])
+                Member.create!(:principal => user, :project_id => 3, :role_ids => [2])
                 issues = Issue.visible(user).all
                 assert issues.any?
-                assert_nil issues.detect {|issue| issue.project_id != 2}
+                assert_nil issues.detect {|issue| issue.project_id != 3}
+                assert_nil issues.detect {|issue| issue.is_private?}
                 assert_visibility_match user, issues
               end
                 assert issues.any?
                 # Admin should see issues on private projects that he does not belong to
                 assert issues.detect {|issue| !issue.project.is_public?}
+                # Admin should see private issues of other users
+                assert issues.detect {|issue| issue.is_private? && issue.author != user}
                 assert_visibility_match user, issues
               end

vendor/plugins/acts_as_attachable/lib/acts_as_attachable.rb +3 -1

             # Redmine - project management software
-            # Copyright (C) 2006-2008  Jean-Philippe Lang
+            # Copyright (C) 2006-2011  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
                     end
                     def attachments_visible?(user=User.current)
+                      (respond_to?(:visible?) ? visible?(user) : true) &&
                         user.allowed_to?(self.class.attachable_options[:view_permission], self.project)
                     end
                     def attachments_deletable?(user=User.current)
+                      (respond_to?(:visible?) ? visible?(user) : true) &&
                         user.allowed_to?(self.class.attachable_options[:delete_permission], self.project)
                     end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages