Don't consider roles without issue add/edit permissions for determining fields permissions (#15988).

git-svn-id: http://svn.redmine.org/redmine/trunk@13747 e93f8b46-1217-0410-a6f0-8f06a7374b81

3 files changed, 28 insertions, 0 deletions

diff --git a/app/models/issue.rb b/app/models/issue.rb
index 31c427bd6..582973343 100644
--- a/app/models/issue.rb
+++ b/app/models/issue.rb
@@ -539,6 +539,7 @@ class Issue < ActiveRecord::Base
 
     user_real = user || User.current
     roles = user_real.admin ? Role.all.to_a : user_real.roles_for_project(project)
+    roles = roles.select(&:consider_workflow?)
     return {} if roles.empty?
 
     result = {}
diff --git a/app/models/role.rb b/app/models/role.rb
index c6a6b4979..790b0426c 100644
--- a/app/models/role.rb
+++ b/app/models/role.rb
@@ -113,6 +113,10 @@ class Role < ActiveRecord::Base
     !permissions.nil? && permissions.include?(perm.to_sym)
   end
 
+  def consider_workflow?
+    has_permission?(:add_issues) || has_permission?(:edit_issues)
+  end
+
   def <=>(role)
     if role
       if builtin == role.builtin
diff --git a/test/unit/issue_test.rb b/test/unit/issue_test.rb
index 101ae9e2d..5352fb790 100644
--- a/test/unit/issue_test.rb
+++ b/test/unit/issue_test.rb
@@ -914,6 +914,29 @@ class IssueTest < ActiveSupport::TestCase
     assert_equal %w(due_date), issue.read_only_attribute_names(user)
   end
 
+  def test_workflow_rules_should_ignore_roles_without_issue_permissions
+    role = Role.generate! :permissions => [:view_issues, :edit_issues]
+    ignored_role = Role.generate! :permissions => [:view_issues]
+
+    WorkflowPermission.delete_all
+    WorkflowPermission.create!(:old_status_id => 1, :tracker_id => 1,
+                               :role => role, :field_name => 'due_date',
+                               :rule => 'required')
+    WorkflowPermission.create!(:old_status_id => 1, :tracker_id => 1,
+                               :role => role, :field_name => 'start_date',
+                               :rule => 'readonly')
+    WorkflowPermission.create!(:old_status_id => 1, :tracker_id => 1,
+                               :role => role, :field_name => 'done_ratio',
+                               :rule => 'readonly')
+    user = User.generate!
+    User.add_to_project user, Project.find(1), [role, ignored_role]
+
+    issue = Issue.new(:project_id => 1, :tracker_id => 1, :status_id => 1)
+
+    assert_equal %w(due_date), issue.required_attribute_names(user)
+    assert_equal %w(done_ratio start_date), issue.read_only_attribute_names(user).sort
+  end
+
   def test_copy
     issue = Issue.new.copy_from(1)
     assert issue.copy?