summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGo MAEDA <maeda@farend.jp>2021-04-25 13:06:48 +0000
committerGo MAEDA <maeda@farend.jp>2021-04-25 13:06:48 +0000
commitd03a718e6efca0493d8b42bd4ba356d736a77f49 (patch)
treed2f31a0cd984b0ad4c5c69a0fc0ab1890162d0fa
parent3605e313abe1f3fee2b25c85acd4b240013e1e86 (diff)
downloadredmine-d03a718e6efca0493d8b42bd4ba356d736a77f49.tar.gz
redmine-d03a718e6efca0493d8b42bd4ba356d736a77f49.zip
Merged r20970 from trunk to 4.2-stable (#35045).
git-svn-id: http://svn.redmine.org/redmine/branches/4.2-stable@20971 e93f8b46-1217-0410-a6f0-8f06a7374b81
-rw-r--r--app/models/mail_handler.rb3
-rw-r--r--test/unit/mail_handler_test.rb6
2 files changed, 5 insertions, 4 deletions
diff --git a/app/models/mail_handler.rb b/app/models/mail_handler.rb
index 102cd8b75..fd2e25fb5 100644
--- a/app/models/mail_handler.rb
+++ b/app/models/mail_handler.rb
@@ -225,8 +225,7 @@ class MailHandler < ActionMailer::Base
# check permission
unless handler_options[:no_permission_check]
- unless user.allowed_to?(:add_issue_notes, issue.project) ||
- user.allowed_to?(:edit_issues, issue.project)
+ unless issue.notes_addable?
raise UnauthorizedAction, "not allowed to add notes on issues to project [#{issue.project.name}]"
end
end
diff --git a/test/unit/mail_handler_test.rb b/test/unit/mail_handler_test.rb
index 836df11d6..3fd3ce072 100644
--- a/test/unit/mail_handler_test.rb
+++ b/test/unit/mail_handler_test.rb
@@ -1051,9 +1051,11 @@ class MailHandlerTest < ActiveSupport::TestCase
end
end
- def test_reply_to_a_issue_without_permission
+ def test_reply_to_an_issue_without_permission
set_tmp_attachments_directory
- Role.all.each {|r| r.remove_permission! :add_issue_notes, :edit_issues}
+ # "add_issue_notes" permission is explicit required to allow users to add notes
+ # "edit_issue" permission no longer includes the "add_issue_notes" permission
+ Role.all.each {|r| r.remove_permission! :add_issue_notes}
assert_no_difference 'Issue.count' do
assert_no_difference 'Journal.count' do
assert_not submit_email('ticket_reply_with_status.eml')