From: Go MAEDA <maeda@farend.jp>
Date: Sat, 31 Jul 2021 00:53:08 +0000 (+0000)
Subject: GroupsController#show should only display visible users (#12795).
X-Git-Tag: 5.0.0~312
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=f479070c39dbf3f088f211a065e1e32da84d7502;p=redmine.git

GroupsController#show should only display visible users (#12795).


git-svn-id: http://svn.redmine.org/redmine/trunk@21113 e93f8b46-1217-0410-a6f0-8f06a7374b81
---

diff --git a/app/views/groups/show.html.erb b/app/views/groups/show.html.erb
index ad7ee2626..001bfe8ad 100644
--- a/app/views/groups/show.html.erb
+++ b/app/views/groups/show.html.erb
@@ -14,7 +14,7 @@
 
 <h3><%= l(:label_member_plural) %></h3>
 <ul>
-<% @group.users.each do |user| %>
+<% @group.users.visible.each do |user| %>
     <li><%= user %></li>
 <% end %>
 </ul>
diff --git a/test/functional/groups_controller_test.rb b/test/functional/groups_controller_test.rb
index efb588198..c62aa5a7d 100644
--- a/test/functional/groups_controller_test.rb
+++ b/test/functional/groups_controller_test.rb
@@ -81,6 +81,20 @@ class GroupsControllerTest < Redmine::ControllerTest
     assert_response 404
   end
 
+  def test_show_should_display_only_visible_users
+    group = Group.find(10)
+    locked_user = User.find(5)
+    group.users << locked_user
+    assert locked_user.locked?
+
+    @request.session[:user_id] = nil
+    get :show, :params => {:id => group.id}
+    assert_response :success
+
+    assert_select 'li', :text => 'User Misc'
+    assert_select 'li', :text => locked_user.name, :count => 0
+  end
+
   def test_new
     get :new
     assert_response :success