From: Go MAEDA <maeda@farend.jp>
Date: Sun, 18 Oct 2020 02:28:27 +0000 (+0000)
Subject: Invalid links to versions with sharing in project tree (#32860).
X-Git-Tag: 4.2.0~668
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=ba016c5d77c6a79782e7dd086b4ef2a0b26688ed;p=redmine.git

Invalid links to versions with sharing in project tree (#32860).

Patch by Alexander Meindl.


git-svn-id: http://svn.redmine.org/redmine/trunk@20149 e93f8b46-1217-0410-a6f0-8f06a7374b81
---

diff --git a/app/helpers/versions_helper.rb b/app/helpers/versions_helper.rb
index 219ced3d3..36b1b511d 100644
--- a/app/helpers/versions_helper.rb
+++ b/app/helpers/versions_helper.rb
@@ -31,11 +31,11 @@ module VersionsHelper
     options = {:fixed_version_id => version, :set_filter => 1}.merge(options)
     project =
       case version.sharing
-      when 'hierarchy', 'tree'
-        if version.project && version.project.root.visible?
+      when 'tree'
+        if version.project && version.project.root.visible? && User.current.allowed_to?(:view_issues, version.project.root)
           version.project.root
         else
-          version.project
+          nil
         end
       when 'system'
         nil
diff --git a/test/helpers/version_helper_test.rb b/test/helpers/version_helper_test.rb
index a0a16d341..0eb895e47 100644
--- a/test/helpers/version_helper_test.rb
+++ b/test/helpers/version_helper_test.rb
@@ -42,7 +42,7 @@ class VersionsHelperTest < Redmine::HelperTest
   def test_version_filtered_issues_path_sharing_hierarchy
     version = Version.new(:name => 'test', :sharing => 'hierarchy')
     version.project = Project.find(5)
-    assert_match '/projects/ecookbook/issues?', version_filtered_issues_path(version)
+    assert_match '/projects/private-child/issues?', version_filtered_issues_path(version)
   end
 
   def test_version_filtered_issues_path_sharing_tree
@@ -51,6 +51,14 @@ class VersionsHelperTest < Redmine::HelperTest
     assert_match '/projects/ecookbook/issues?', version_filtered_issues_path(version)
   end
 
+  def test_version_filtered_issues_path_sharing_tree_without_permission_to_root_project
+    EnabledModule.where("name = 'issue_tracking' AND project_id = 1").delete_all
+    version = Version.new(:name => 'test', :sharing => 'tree')
+    version.project = Project.find(5)
+    assert_no_match '/projects/ecookbook/issues?', version_filtered_issues_path(version)
+    assert_match '/issues?', version_filtered_issues_path(version)
+  end
+
   def test_version_filtered_issues_path_sharing_system
     version = Version.new(:name => 'test', :sharing => 'system')
     version.project = Project.find(5)