Updating an issue via REST API causes internal server error if invalid project id is specified (#33417).

Patch by Go MAEDA.


git-svn-id: http://svn.redmine.org/redmine/trunk@19777 e93f8b46-1217-0410-a6f0-8f06a7374b81

app/models/issue.rb

@@ -723,7 +723,7 @@ class Issue < ActiveRecord::Base
       errors.add :start_date, :earlier_than_minimum_start_date, :date => format_date(soonest_start)
     end
 
-    if fixed_version
+    if project && fixed_version
       if !assignable_versions.include?(fixed_version)
         errors.add :fixed_version_id, :inclusion
       elsif reopening? && fixed_version.closed?
@@ -738,7 +738,7 @@ class Issue < ActiveRecord::Base
       end
     end
 
-    if assigned_to_id_changed? && assigned_to_id.present?
+    if project && assigned_to_id_changed? && assigned_to_id.present?
       unless assignable_users.include?(assigned_to)
         errors.add :assigned_to_id, :invalid
       end
@@ -938,6 +938,8 @@ class Issue < ActiveRecord::Base
 
   # Users the issue can be assigned to
   def assignable_users
+    return [] if project.nil?
+
     users = project.assignable_users(tracker).to_a
     users << author if author && author.active?
     if assigned_to_id_was.present? && assignee = Principal.find_by_id(assigned_to_id_was)
@@ -949,6 +951,7 @@ class Issue < ActiveRecord::Base
   # Versions that the issue can be assigned to
   def assignable_versions
     return @assignable_versions if @assignable_versions
+    return [] if project.nil?
 
     versions = project.shared_versions.open.to_a
     if fixed_version

test/integration/api_test/issues_test.rb

@@ -663,6 +663,34 @@ class Redmine::ApiTest::IssuesTest < Redmine::ApiTest::Base
     assert_response 422
   end
 
+  test "POST /issues.json with invalid project_id and any assigned_to_id should respond with 422" do
+    post(
+      '/issues.json',
+      :params => {
+        :issue => {
+          :project_id => 999,
+          :assigned_to_id => 1,
+          :subject => 'API'
+        }
+      },
+      :headers => credentials('jsmith'))
+    assert_response 422
+  end
+
+  test "POST /issues.json with invalid project_id and any fixed_version_id should respond with 422" do
+    post(
+      '/issues.json',
+      :params => {
+        :issue => {
+          :project_id => 999,
+          :fixed_version_id => 1,
+          :subject => 'API'
+        }
+      },
+      :headers => credentials('jsmith'))
+    assert_response 422
+  end
+
   test "PUT /issues/:id.xml" do
     assert_difference('Journal.count') do
       put(