Nemcio/Redmine
1
0
Fork 0
mirror of https://github.com/redmine/redmine.git synced 2025-11-07 22:05:56 +01:00
Code Issues Packages Projects Releases Activity

Fixed that Issues API may disclose changesets that are not visible (#21136).

Browse Source 
git-svn-id: http://svn.redmine.org/redmine/trunk@14794 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang
2015-11-04 18:17:07 +00:00
parent 747247d81b
commit a196aaa2a9
2 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
app/views/issues/show.api.rsb
View File

@@ -40,14 +40,14 @@ api.issue do
end if include_in_api_response?('relations') && @relations.present?
api.array :changesets do
@issue.changesets.each do |changeset|
@changesets.each do |changeset|
api.changeset :revision => changeset.revision do
api.user(:id => changeset.user_id, :name => changeset.user.name) unless changeset.user.nil?
api.comments changeset.comments
api.committed_on changeset.committed_on
end
end
end if include_in_api_response?('changesets') && User.current.allowed_to?(:view_changesets, @project)
end if include_in_api_response?('changesets')
api.array :journals do
@journals.each do |journal|

14
test/integration/api_test/issues_test.rb
View File

@@ -336,6 +336,20 @@ class Redmine::ApiTest::IssuesTest < Redmine::ApiTest::Base
end
end
test "GET /issues/:id.xml should not disclose associated changesets from projects the user has no access to" do
project = Project.generate!(:is_public => false)
repository = Repository::Subversion.create!(:project => project, :url => "svn://localhost")
Issue.find(1).changesets << Changeset.generate!(:repository => repository)
assert Issue.find(1).changesets.any?
get '/issues/1.xml?include=changesets', {}, credentials('jsmith')
# the user jsmith has no permission to view the associated changeset
assert_select 'issue changesets[type=array]' do
assert_select 'changeset', 0
end
end
test "POST /issues.xml should create an issue with the attributes" do
payload = <<-XML