diff options
| author | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2015-11-08 08:54:15 +0000 |
|---|---|---|
| committer | Jean-Philippe Lang <jp_lang@yahoo.fr> | 2015-11-08 08:54:15 +0000 |
| commit | bff6ff9273cf4a0a6578d49ee7230850edde3e41 (patch) | |
| tree | ef33f8a3a02773dd95dd4abfa3ef790246124c5a | |
| parent | dee154a6ddcade9fd5499b277dabba400662f90d (diff) | |
| download | redmine-bff6ff9273cf4a0a6578d49ee7230850edde3e41.tar.gz redmine-bff6ff9273cf4a0a6578d49ee7230850edde3e41.zip | |
Merged r14795 and r14796 (#21150).
git-svn-id: http://svn.redmine.org/redmine/branches/3.1-stable@14837 e93f8b46-1217-0410-a6f0-8f06a7374b81
| -rw-r--r-- | app/models/time_entry.rb | 2 | ||||
| -rw-r--r-- | app/views/timelog/_form.html.erb | 4 | ||||
| -rw-r--r-- | test/functional/timelog_controller_test.rb | 17 |
3 files changed, 21 insertions, 2 deletions
diff --git a/app/models/time_entry.rb b/app/models/time_entry.rb index 062e9c80b..682dce137 100644 --- a/app/models/time_entry.rb +++ b/app/models/time_entry.rb @@ -95,7 +95,7 @@ class TimeEntry < ActiveRecord::Base if attrs attrs = super(attrs) if issue_id_changed? && issue - if user.allowed_to?(:log_time, issue.project) + if issue.visible?(user) && user.allowed_to?(:log_time, issue.project) if attrs[:project_id].blank? && issue.project_id != project_id self.project_id = issue.project_id end diff --git a/app/views/timelog/_form.html.erb b/app/views/timelog/_form.html.erb index cf665cb63..1a973e33a 100644 --- a/app/views/timelog/_form.html.erb +++ b/app/views/timelog/_form.html.erb @@ -13,7 +13,9 @@ <% end %> <p> <%= f.text_field :issue_id, :size => 6 %> - <span id="time_entry_issue"><%= "#{@time_entry.issue.tracker.name} ##{@time_entry.issue.id}: #{@time_entry.issue.subject}" if @time_entry.issue %></span> + <% if @time_entry.issue.try(:visible?) %> + <span id="time_entry_issue"><%= "#{@time_entry.issue.tracker.name} ##{@time_entry.issue.id}: #{@time_entry.issue.subject}" %></span> + <% end %> </p> <p><%= f.text_field :spent_on, :size => 10, :required => true %><%= calendar_for('time_entry_spent_on') %></p> <p><%= f.text_field :hours, :size => 6, :required => true %></p> diff --git a/test/functional/timelog_controller_test.rb b/test/functional/timelog_controller_test.rb index 68fde87f0..7ce39caab 100644 --- a/test/functional/timelog_controller_test.rb +++ b/test/functional/timelog_controller_test.rb @@ -219,6 +219,23 @@ class TimelogControllerTest < ActionController::TestCase end end + def test_create_on_issue_that_is_not_visible_should_not_disclose_subject + issue = Issue.generate!(:subject => "issue_that_is_not_visible", :is_private => true) + assert !issue.visible?(User.find(3)) + + @request.session[:user_id] = 3 + assert_no_difference 'TimeEntry.count' do + post :create, :time_entry => { + :project_id => '', :issue_id => issue.id.to_s, + :activity_id => '11', :spent_on => '2008-03-14', :hours => '7.3' + } + end + assert_select_error /Issue is invalid/ + assert_select "input[name=?][value=?]", "time_entry[issue_id]", issue.id.to_s + assert_select "#time_entry_issue", 0 + assert !response.body.include?('issue_that_is_not_visible') + end + def test_create_and_continue_at_project_level @request.session[:user_id] = 2 assert_difference 'TimeEntry.count' do |