Ignore archived project memberships when calculating issue query visibility (#28180).

Patch by Holger Just.

git-svn-id: http://svn.redmine.org/redmine/trunk@17257 e93f8b46-1217-0410-a6f0-8f06a7374b81

diff --git a/app/models/query.rb b/app/models/query.rb
index 6c20cd992a3bd50309e9a26b385910930f89b80c..319a0b8a8fdd26fbac65c37e603694fede6546f3 100644 (file)
--- a/app/models/query.rb
+++ b/app/models/query.rb
@@ -319,9 +319,10 @@ class Query < ActiveRecord::Base
           " INNER JOIN #{table_name_prefix}queries_roles#{table_name_suffix} qr on qr.query_id = q.id" +
           " INNER JOIN #{MemberRole.table_name} mr ON mr.role_id = qr.role_id" +
           " INNER JOIN #{Member.table_name} m ON m.id = mr.member_id AND m.user_id = ?" +
+          " INNER JOIN #{Project.table_name} p ON p.id = m.project_id AND p.status <> ?" +
           " WHERE q.project_id IS NULL OR q.project_id = m.project_id))" +
         " OR #{table_name}.user_id = ?",
-        VISIBILITY_PUBLIC, VISIBILITY_ROLES, user.id, user.id)
+        VISIBILITY_PUBLIC, VISIBILITY_ROLES, user.id, Project::STATUS_ARCHIVED, user.id)
     elsif user.logged?
       scope.where("#{table_name}.visibility = ? OR #{table_name}.user_id = ?", VISIBILITY_PUBLIC, user.id)
     else
@@ -340,7 +341,7 @@ class Query < ActiveRecord::Base
       if project
         (user.roles_for_project(project) & roles).any?
       else
-        Member.where(:user_id => user.id).joins(:roles).where(:member_roles => {:role_id => roles.map(&:id)}).any?
+        user.memberships.joins(:member_roles).where(:member_roles => {:role_id => roles.map(&:id)}).any?
       end
     else
       user == self.user

diff --git a/test/unit/query_test.rb b/test/unit/query_test.rb
index cdf008a1f8dd210866319fce53da839f59a769ab..bb5effdef625fda18dd0dc33f6617e78e0a54df3 100644 (file)
--- a/test/unit/query_test.rb
+++ b/test/unit/query_test.rb
@@ -1790,6 +1790,11 @@ class QueryTest < ActiveSupport::TestCase
 
     assert q.visible?(User.find(1))
     assert IssueQuery.visible(User.find(1)).find_by_id(q.id)
+
+    # Should ignore archived project memberships
+    Project.find(1).archive
+    assert !q.visible?(User.find(3))
+    assert_nil IssueQuery.visible(User.find(3)).find_by_id(q.id)
   end
 
   def test_query_with_private_visibility_should_be_visible_to_owner