Ensure that only visible watchers on issues can be queried (#29133).

Contributed by Holger Just and Mizuki ISHIKAWA.


git-svn-id: http://svn.redmine.org/redmine/trunk@17436 e93f8b46-1217-0410-a6f0-8f06a7374b81

1 files changed, 20 insertions, 2 deletions

diff --git a/app/models/issue_query.rb b/app/models/issue_query.rb
index 6bb2bc217..c042a2ac9 100644
--- a/app/models/issue_query.rb
+++ b/app/models/issue_query.rb
@@ -382,8 +382,26 @@ class IssueQuery < Query
 
   def sql_for_watcher_id_field(field, operator, value)
     db_table = Watcher.table_name
-    "#{Issue.table_name}.id #{ operator == '=' ? 'IN' : 'NOT IN' } (SELECT #{db_table}.watchable_id FROM #{db_table} WHERE #{db_table}.watchable_type='Issue' AND " +
-      sql_for_field(field, '=', value, db_table, 'user_id') + ')'
+
+    me, others = value.partition { |id| ['0', User.current.id.to_s].include?(id) }
+    sql = if others.any?
+      "SELECT #{Issue.table_name}.id FROM #{Issue.table_name} " +
+      "INNER JOIN #{db_table} ON #{Issue.table_name}.id = #{db_table}.watchable_id AND #{db_table}.watchable_type = 'Issue' " +
+      "LEFT OUTER JOIN #{Project.table_name} ON #{Project.table_name}.id = #{Issue.table_name}.project_id " +
+      "WHERE (" +
+        sql_for_field(field, '=', me, db_table, 'user_id') +
+      ') OR (' +
+        Project.allowed_to_condition(User.current, :view_issue_watchers) +
+        ' AND ' +
+        sql_for_field(field, '=', others, db_table, 'user_id') +
+      ')'
+    else
+      "SELECT #{db_table}.watchable_id FROM #{db_table} " +
+      "WHERE #{db_table}.watchable_type='Issue' AND " +
+      sql_for_field(field, '=', me, db_table, 'user_id')
+    end
+
+    "#{Issue.table_name}.id #{ operator == '=' ? 'IN' : 'NOT IN' } (#{sql})"
   end
 
   def sql_for_member_of_group_field(field, operator, value)