Fixed that relations to issues that are not visible are displayed in the issue history (#1005).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@12014 e93f8b46-1217-0410-a6f0-8f06a7374b81

2 files changed, 22 insertions, 0 deletions

diff --git a/app/models/journal.rb b/app/models/journal.rb
index c14051f83..70ecc54f5 100644
--- a/app/models/journal.rb
+++ b/app/models/journal.rb
@@ -53,12 +53,15 @@ class Journal < ActiveRecord::Base
     (details.empty? && notes.blank?) ? false : super
   end
 
+  # Returns journal details that are visible to user
   def visible_details(user=User.current)
     details.select do |detail|
       if detail.property == 'cf' 
         field_id = detail.prop_key
         field = CustomField.find_by_id(field_id)
         field && field.visible_by?(project, user)
+      elsif detail.property == 'relation'
+        Issue.find_by_id(detail.value || detail.old_value).try(:visible?, user)
       else
         true
       end
diff --git a/test/unit/journal_test.rb b/test/unit/journal_test.rb
index 38d75d723..e3184bf21 100644
--- a/test/unit/journal_test.rb
+++ b/test/unit/journal_test.rb
@@ -175,4 +175,23 @@ class JournalTest < ActiveSupport::TestCase
     assert_equal '0', j.old_value
     assert_equal '0', j.value
   end
+
+  def test_visible_details_should_include_relations_to_visible_issues_only
+    issue = Issue.generate!
+    visible_issue = Issue.generate!
+    IssueRelation.create!(:issue_from => issue, :issue_to => visible_issue, :relation_type => 'relates')
+    hidden_issue = Issue.generate!(:is_private => true)
+    IssueRelation.create!(:issue_from => issue, :issue_to => hidden_issue, :relation_type => 'relates')
+    issue.reload
+    assert_equal 1, issue.journals.size
+    journal = issue.journals.first
+    assert_equal 2, journal.details.size
+
+    visible_details = journal.visible_details(User.anonymous)
+    assert_equal 1, visible_details.size
+    assert_equal visible_issue.id.to_s, visible_details.first.value
+
+    visible_details = journal.visible_details(User.find(2))
+    assert_equal 2, visible_details.size
+  end
 end