Merged r6163, r6171, r6172, r6174 from trunk.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/branches/1.2-stable@6175 e93f8b46-1217-0410-a6f0-8f06a7374b81

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 5c1215b4f5fd289136907b9df13c88d10536f4fa..e3f768645e37ca84592ed5ece75b7dd4b8cf4804 100644 (file)
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -18,6 +18,8 @@
 require 'uri'
 require 'cgi'
 
+class Unauthorized < Exception; end
+
 class ApplicationController < ActionController::Base
   include Redmine::I18n
 
@@ -41,6 +43,7 @@ class ApplicationController < ActionController::Base
   protect_from_forgery
 
   rescue_from ActionController::InvalidAuthenticityToken, :with => :invalid_authenticity_token
+  rescue_from ::Unauthorized, :with => :deny_access
 
   include Redmine::Search::Controller
   include Redmine::MenuManager::MenuController

diff --git a/app/helpers/queries_helper.rb b/app/helpers/queries_helper.rb
index 61a1846d8128b50d8c9da62e62c77b9f497c6637..31a363d2802abc7d52914ee7c826a12e1dd37101 100644 (file)
--- a/app/helpers/queries_helper.rb
+++ b/app/helpers/queries_helper.rb
@@ -70,6 +70,7 @@ module QueriesHelper
       cond = "project_id IS NULL"
       cond << " OR project_id = #{@project.id}" if @project
       @query = Query.find(params[:query_id], :conditions => cond)
+      raise ::Unauthorized unless @query.visible?
       @query.project = @project
       session[:query] = {:id => @query.id, :project_id => @query.project_id}
       sort_clear

diff --git a/app/models/query.rb b/app/models/query.rb
index 678fca9d905785b8735730fa66b889db83d3d754..786751c8c3e39acb71b632da0fb935a346f5eee8 100644 (file)
--- a/app/models/query.rb
+++ b/app/models/query.rb
@@ -165,6 +165,11 @@ class Query < ActiveRecord::Base
           ["o", "c", "!*", "*", "t", "w"].include? operator_for(field)
     end if filters
   end
+  
+  # Returns true if the query is visible to +user+ or the current user.
+  def visible?(user=User.current)
+    self.is_public? || self.user_id == user.id
+  end
 
   def editable_by?(user)
     return false unless user

diff --git a/test/functional/application_controller_test.rb b/test/functional/application_controller_test.rb
index 57f3e091cd25936d62c5a074da91a096dffebcf1..8431e67025f6632876ff378c8d414d8302ae9eff 100644 (file)
--- a/test/functional/application_controller_test.rb
+++ b/test/functional/application_controller_test.rb
@@ -18,9 +18,6 @@
 require File.expand_path('../../test_helper', __FILE__)
 require 'application_controller'
 
-# Re-raise errors caught by the controller.
-class ApplicationController; def rescue_action(e) raise e end; end
-
 class ApplicationControllerTest < ActionController::TestCase
   include Redmine::I18n
   

diff --git a/test/functional/calendars_controller_test.rb b/test/functional/calendars_controller_test.rb
index a8c0e2af1a8c22e14d04077178a341c9e9dbe36b..bb12316c78540ae8c08f2dc29d328633d064e524 100644 (file)
--- a/test/functional/calendars_controller_test.rb
+++ b/test/functional/calendars_controller_test.rb
@@ -19,7 +19,7 @@ class CalendarsControllerTest < ActionController::TestCase
 
   context "GET :show" do
     should "run custom queries" do
-      @query = Query.generate_default!
+      @query = Query.generate_default!(:is_public => true)
       
       get :show, :query_id => @query.id
       assert_response :success

diff --git a/test/functional/issues_controller_test.rb b/test/functional/issues_controller_test.rb
index eeb3de267bf38d768c984a8bdd6364541d1d1f5d..36497acc6650d97bb356041cd70f9de8aade63e9 100644 (file)
--- a/test/functional/issues_controller_test.rb
+++ b/test/functional/issues_controller_test.rb
@@ -18,9 +18,6 @@
 require File.expand_path('../../test_helper', __FILE__)
 require 'issues_controller'
 
-# Re-raise errors caught by the controller.
-class IssuesController; def rescue_action(e) raise e end; end
-
 class IssuesControllerTest < ActionController::TestCase
   fixtures :projects,
            :users,
@@ -193,6 +190,30 @@ class IssuesControllerTest < ActionController::TestCase
     assert_not_nil assigns(:issues)
     assert_not_nil assigns(:issue_count_by_group)
   end
+  
+  def test_private_query_should_not_be_available_to_other_users
+    q = Query.create!(:name => "private", :user => User.find(2), :is_public => false, :project => nil)
+    @request.session[:user_id] = 3
+    
+    get :index, :query_id => q.id
+    assert_response 403
+  end
+  
+  def test_private_query_should_be_available_to_its_user
+    q = Query.create!(:name => "private", :user => User.find(2), :is_public => false, :project => nil)
+    @request.session[:user_id] = 2
+    
+    get :index, :query_id => q.id
+    assert_response :success
+  end
+  
+  def test_public_query_should_be_available_to_other_users
+    q = Query.create!(:name => "private", :user => User.find(2), :is_public => true, :project => nil)
+    @request.session[:user_id] = 3
+    
+    get :index, :query_id => q.id
+    assert_response :success
+  end
 
   def test_index_sort_by_field_not_included_in_columns
     Setting.issue_list_default_columns = %w(subject author)

diff --git a/test/functional/issues_controller_transaction_test.rb b/test/functional/issues_controller_transaction_test.rb
index db783b6a056ae584eeaae2d42364551ffb1fa8a0..18a2cc59841ab1e3d8443844debcd8cbf265ea66 100644 (file)
--- a/test/functional/issues_controller_transaction_test.rb
+++ b/test/functional/issues_controller_transaction_test.rb
@@ -18,9 +18,6 @@
 require File.expand_path('../../test_helper', __FILE__)
 require 'issues_controller'
 
-# Re-raise errors caught by the controller.
-class IssuesController; def rescue_action(e) raise e end; end
-
 class IssuesControllerTransactionTest < ActionController::TestCase
   fixtures :projects,
            :users,