Nemcio/Redmine
1
0
Fork 0
mirror of https://github.com/redmine/redmine.git synced 2025-11-12 08:16:03 +01:00
Code Issues Packages Projects Releases Activity

Merged r16569 (#25791).

Browse Source 
git-svn-id: http://svn.redmine.org/redmine/branches/3.3-stable@16616 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang
2017-06-06 20:54:14 +00:00
parent c07a140f61
commit b02b7369a0
2 changed files with 26 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
app/models/issue.rb
View File

@@ -72,7 +72,7 @@ class Issue < ActiveRecord::Base
validates :estimated_hours, :numericality => {:greater_than_or_equal_to => 0, :allow_nil => true, :message => :invalid} validates :estimated_hours, :numericality => {:greater_than_or_equal_to => 0, :allow_nil => true, :message => :invalid}
validates :start_date, :date => true validates :start_date, :date => true
validates :due_date, :date => true validates :due_date, :date => true
validate :validate_issue, :validate_required_fields validate :validate_issue, :validate_required_fields, :validate_permissions
attr_protected :id attr_protected :id
scope :visible, lambda {|*args| scope :visible, lambda {|*args|
@@ -490,6 +490,7 @@ class Issue < ActiveRecord::Base
# attr_accessible is too rough because we still want things like # attr_accessible is too rough because we still want things like
# Issue.new(:project => foo) to work # Issue.new(:project => foo) to work
def safe_attributes=(attrs, user=User.current) def safe_attributes=(attrs, user=User.current)
@attributes_set_by = user
return unless attrs.is_a?(Hash) return unless attrs.is_a?(Hash)
attrs = attrs.deep_dup attrs = attrs.deep_dup
@@ -745,6 +746,14 @@ class Issue < ActiveRecord::Base
end end
end end
def validate_permissions
if @attributes_set_by && new_record? && copy?
unless allowed_target_trackers(@attributes_set_by).include?(tracker)
errors.add :tracker, :invalid
end
end
end
# Overrides Redmine::Acts::Customizable::InstanceMethods#validate_custom_field_values # Overrides Redmine::Acts::Customizable::InstanceMethods#validate_custom_field_values
# so that custom values that are not editable are not validated (eg. a custom field that # so that custom values that are not editable are not validated (eg. a custom field that
# is marked as required should not trigger a validation error if the user is not allowed # is marked as required should not trigger a validation error if the user is not allowed

16
test/functional/issues_controller_test.rb
View File

@@ -3081,6 +3081,22 @@ class IssuesControllerTest < ActionController::TestCase
assert_equal 1, issue.status_id assert_equal 1, issue.status_id
end end
def test_create_as_copy_should_fail_without_add_issue_permission_on_original_tracker
role = Role.find(2)
role.set_permission_trackers :add_issues, [1, 3]
role.save!
Role.non_member.remove_permission! :add_issues
issue = Issue.generate!(:project_id => 1, :tracker_id => 2)
@request.session[:user_id] = 3
assert_no_difference 'Issue.count' do
post :create, :project_id => 1, :copy_from => issue.id,
:issue => {:project_id => '1'}
end
assert_select_error 'Tracker is invalid'
end
def test_create_as_copy_should_copy_attachments def test_create_as_copy_should_copy_attachments
@request.session[:user_id] = 2 @request.session[:user_id] = 2
issue = Issue.find(3) issue = Issue.find(3)