From: Jean-Philippe Lang <jp_lang@yahoo.fr>
Date: Sun, 8 Nov 2015 08:56:55 +0000 (+0000)
Subject: Merged r14795 and r14796 (#21150).
X-Git-Tag: 3.0.6~5
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=5bd5738750b083ca6a42e56f6f4138652b00a801;p=redmine.git

Merged r14795 and r14796 (#21150).

git-svn-id: http://svn.redmine.org/redmine/branches/3.0-stable@14838 e93f8b46-1217-0410-a6f0-8f06a7374b81
---

diff --git a/app/models/time_entry.rb b/app/models/time_entry.rb
index 87d27c1de..5d4a514f9 100644
--- a/app/models/time_entry.rb
+++ b/app/models/time_entry.rb
@@ -69,7 +69,7 @@ class TimeEntry < ActiveRecord::Base
     if attrs
       attrs = super(attrs)
       if issue_id_changed? && issue
-        if user.allowed_to?(:log_time, issue.project)
+        if issue.visible?(user) && user.allowed_to?(:log_time, issue.project)
           if attrs[:project_id].blank? && issue.project_id != project_id
             self.project_id = issue.project_id
           end
diff --git a/app/views/timelog/_form.html.erb b/app/views/timelog/_form.html.erb
index 955c2d06b..317cdb1f1 100644
--- a/app/views/timelog/_form.html.erb
+++ b/app/views/timelog/_form.html.erb
@@ -13,7 +13,9 @@
   <% end %>
   <p>
     <%= f.text_field :issue_id, :size => 6 %>
-    <span id="time_entry_issue"><%= h("#{@time_entry.issue.tracker.name} ##{@time_entry.issue.id}: #{@time_entry.issue.subject}") if @time_entry.issue %></span>
+    <% if @time_entry.issue.try(:visible?) %>
+      <span id="time_entry_issue"><%= "#{@time_entry.issue.tracker.name} ##{@time_entry.issue.id}: #{@time_entry.issue.subject}" %></span>
+    <% end %>
   </p>
   <p><%= f.text_field :spent_on, :size => 10, :required => true %><%= calendar_for('time_entry_spent_on') %></p>
   <p><%= f.text_field :hours, :size => 6, :required => true %></p>
diff --git a/test/functional/timelog_controller_test.rb b/test/functional/timelog_controller_test.rb
index 1d925f6bf..d01605c3b 100644
--- a/test/functional/timelog_controller_test.rb
+++ b/test/functional/timelog_controller_test.rb
@@ -212,6 +212,23 @@ class TimelogControllerTest < ActionController::TestCase
     end
   end
 
+  def test_create_on_issue_that_is_not_visible_should_not_disclose_subject
+    issue = Issue.generate!(:subject => "issue_that_is_not_visible", :is_private => true)
+    assert !issue.visible?(User.find(3))
+
+    @request.session[:user_id] = 3
+    assert_no_difference 'TimeEntry.count' do
+      post :create, :time_entry => {
+        :project_id => '', :issue_id => issue.id.to_s,
+        :activity_id => '11', :spent_on => '2008-03-14', :hours => '7.3'
+      }
+    end
+    assert_select_error /Issue is invalid/
+    assert_select "input[name=?][value=?]", "time_entry[issue_id]", issue.id.to_s
+    assert_select "#time_entry_issue", 0
+    assert !response.body.include?('issue_that_is_not_visible')
+  end
+
   def test_create_and_continue_at_project_level
     @request.session[:user_id] = 2
     assert_difference 'TimeEntry.count' do