Merged r20970 from trunk to 4.1-stable (#35045).

git-svn-id: http://svn.redmine.org/redmine/branches/4.1-stable@20972 e93f8b46-1217-0410-a6f0-8f06a7374b81

diff --git a/app/models/mail_handler.rb b/app/models/mail_handler.rb
index b29a33d808c0f309ebd850aac5395cf0b3403544..b88b1f312a44f96b6a9d992b272848a276e8eb7f 100644 (file)
--- a/app/models/mail_handler.rb
+++ b/app/models/mail_handler.rb
@@ -225,8 +225,7 @@ class MailHandler < ActionMailer::Base
 
     # check permission
     unless handler_options[:no_permission_check]
-      unless user.allowed_to?(:add_issue_notes, issue.project) ||
-               user.allowed_to?(:edit_issues, issue.project)
+      unless issue.notes_addable?
         raise UnauthorizedAction, "not allowed to add notes on issues to project [#{issue.project.name}]"
       end
     end

diff --git a/test/unit/mail_handler_test.rb b/test/unit/mail_handler_test.rb
index 3c749b329d888192b6eaeec52534246bf836489f..35ab6e53aa8ab3ac34b5063c1025d28de3dc588b 100644 (file)
--- a/test/unit/mail_handler_test.rb
+++ b/test/unit/mail_handler_test.rb
@@ -1005,9 +1005,11 @@ class MailHandlerTest < ActiveSupport::TestCase
     end
   end
 
-  def test_reply_to_a_issue_without_permission
+  def test_reply_to_an_issue_without_permission
     set_tmp_attachments_directory
-    Role.all.each {|r| r.remove_permission! :add_issue_notes, :edit_issues}
+    # "add_issue_notes" permission is explicit required to allow users to add notes
+    # "edit_issue" permission no longer includes the "add_issue_notes" permission
+    Role.all.each {|r| r.remove_permission! :add_issue_notes}
     assert_no_difference 'Issue.count' do
       assert_no_difference 'Journal.count' do
         assert_not submit_email('ticket_reply_with_status.eml')