From: Marius Balteanu <marius.balteanu@zitec.com>
Date: Thu, 16 Jun 2022 15:10:25 +0000 (+0000)
Subject: Ensure @category_id@ is valid within the issue's project (#37171).
X-Git-Tag: 5.1.0~562
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=e5550d5ed45e1cb8a6556b7198ac78de8869c7fe;p=redmine.git

Ensure @category_id@ is valid within the issue's project (#37171).

Patch by Holger Just.


git-svn-id: https://svn.redmine.org/redmine/trunk@21637 e93f8b46-1217-0410-a6f0-8f06a7374b81
---

diff --git a/app/models/issue.rb b/app/models/issue.rb
index 1ad09e0aa..4e4355f56 100644
--- a/app/models/issue.rb
+++ b/app/models/issue.rb
@@ -759,6 +759,12 @@ class Issue < ActiveRecord::Base
       end
     end
 
+    if project && category_id
+      unless project.issue_category_ids.include?(category_id)
+        errors.add :category_id, :inclusion
+      end
+    end
+
     # Checks that the issue can not be added/moved to a disabled tracker
     if project && (tracker_id_changed? || project_id_changed?)
       if tracker && !project.trackers.include?(tracker)
diff --git a/test/unit/issue_test.rb b/test/unit/issue_test.rb
index a0d9485c2..0c09ef5e1 100644
--- a/test/unit/issue_test.rb
+++ b/test/unit/issue_test.rb
@@ -1721,6 +1721,14 @@ class IssueTest < ActiveSupport::TestCase
     assert issue.save
   end
 
+  def test_should_not_be_able_to_set_an_invalid_category_id
+    issue = Issue.new(:project_id => 1, :tracker_id => 1, :author_id => 1,
+                      :status_id => 1, :category_id => 3,
+                      :subject => 'New issue')
+    assert !issue.save
+    assert_not_equal [], issue.errors[:category_id]
+  end
+
   def test_allowed_target_projects_should_include_projects_with_issue_tracking_enabled
     assert_include Project.find(2), Issue.allowed_target_projects(User.find(2))
   end