From: Jean-Philippe Lang <jp_lang@yahoo.fr>
Date: Sun, 8 Nov 2015 09:05:46 +0000 (+0000)
Subject: Merged r14794 (#21136).
X-Git-Tag: 3.1.2~4
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=1c97ce41ffacb490426e8fb9608850949b437145;p=redmine.git

Merged r14794 (#21136).

git-svn-id: http://svn.redmine.org/redmine/branches/3.1-stable@14841 e93f8b46-1217-0410-a6f0-8f06a7374b81
---

diff --git a/app/views/issues/show.api.rsb b/app/views/issues/show.api.rsb
index f057b4c63..577a885c2 100644
--- a/app/views/issues/show.api.rsb
+++ b/app/views/issues/show.api.rsb
@@ -40,14 +40,14 @@ api.issue do
   end if include_in_api_response?('relations') && @relations.present?
 
   api.array :changesets do
-    @issue.changesets.each do |changeset|
+    @changesets.each do |changeset|
       api.changeset :revision => changeset.revision do
         api.user(:id => changeset.user_id, :name => changeset.user.name) unless changeset.user.nil?
         api.comments changeset.comments
         api.committed_on changeset.committed_on
       end
     end
-  end if include_in_api_response?('changesets') && User.current.allowed_to?(:view_changesets, @project)
+  end if include_in_api_response?('changesets')
 
   api.array :journals do
     @journals.each do |journal|
diff --git a/test/integration/api_test/issues_test.rb b/test/integration/api_test/issues_test.rb
index 08543ab15..298cc80e8 100644
--- a/test/integration/api_test/issues_test.rb
+++ b/test/integration/api_test/issues_test.rb
@@ -336,6 +336,20 @@ class Redmine::ApiTest::IssuesTest < Redmine::ApiTest::Base
     end
   end
 
+  test "GET /issues/:id.xml should not disclose associated changesets from projects the user has no access to" do
+    project = Project.generate!(:is_public => false)
+    repository = Repository::Subversion.create!(:project => project, :url => "svn://localhost")
+    Issue.find(1).changesets << Changeset.generate!(:repository => repository)
+    assert Issue.find(1).changesets.any?
+
+    get '/issues/1.xml?include=changesets', {}, credentials('jsmith')
+
+    # the user jsmith has no permission to view the associated changeset
+    assert_select 'issue changesets[type=array]' do
+      assert_select 'changeset', 0
+    end
+  end
+
   test "POST /issues.xml should create an issue with the attributes" do
 
 payload = <<-XML