diff options
| author | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2019-03-30 06:13:08 +0000 |
|---|---|---|
| committer | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2019-03-30 06:13:08 +0000 |
| commit | 805aef85de116d79e6fa36e3db5d74591df61b52 (patch) | |
| tree | 478a0909d131b1f844d5ca9019dffa1a0faaded7 | |
| parent | 32dce42b71b720f1dc37e5b6f9d795fe7f5e0712 (diff) | |
| download | redmine-805aef85de116d79e6fa36e3db5d74591df61b52.tar.gz redmine-805aef85de116d79e6fa36e3db5d74591df61b52.zip | |
"View differences" buttons are shown in the repository page even without "Browse repository" permission (#30731).
Patch by Go MAEDA.
git-svn-id: http://svn.redmine.org/redmine/trunk@18013 e93f8b46-1217-0410-a6f0-8f06a7374b81
| -rw-r--r-- | app/views/repositories/_revisions.html.erb | 2 | ||||
| -rw-r--r-- | test/functional/repositories_controller_test.rb | 19 |
2 files changed, 20 insertions, 1 deletions
diff --git a/app/views/repositories/_revisions.html.erb b/app/views/repositories/_revisions.html.erb index 914999b34..514380791 100644 --- a/app/views/repositories/_revisions.html.erb +++ b/app/views/repositories/_revisions.html.erb @@ -20,7 +20,7 @@ end %> :repository_id => @repository.identifier_param, :path => to_path_param(path)}, :method => :get ) do %> -<% show_diff = revisions.size > 1 %> +<% show_diff = revisions.size > 1 && User.current.allowed_to?(:browse_repository, @repository.project) %> <%= submit_tag(l(:label_view_diff), :name => nil) if show_diff %> <table class="list changesets"> <thead><tr> diff --git a/test/functional/repositories_controller_test.rb b/test/functional/repositories_controller_test.rb index 74701e2e8..19debb4dc 100644 --- a/test/functional/repositories_controller_test.rb +++ b/test/functional/repositories_controller_test.rb @@ -182,6 +182,25 @@ class RepositoriesControllerTest < Redmine::RepositoryControllerTest end end + def test_show_should_show_diff_button_depending_on_browse_repository_permission + @request.session[:user_id] = 2 + role = Role.find(1) + + role.add_permission! :browse_repository + get :show, :params => { + :id => 1 + } + assert_response :success + assert_select 'input[value="View differences"]' + + role.remove_permission! :browse_repository + get :show, :params => { + :id => 1 + } + assert_response :success + assert_select 'input[value="View differences"]', :count => 0 + end + def test_revisions get :revisions, :params => { :id => 1, |