"View differences" buttons are shown in the repository page even without "Browse repository" permission (#30731).

Patch by Go MAEDA.

git-svn-id: http://svn.redmine.org/redmine/trunk@18013 e93f8b46-1217-0410-a6f0-8f06a7374b81

1 files changed, 19 insertions, 0 deletions

diff --git a/test/functional/repositories_controller_test.rb b/test/functional/repositories_controller_test.rb
index 74701e2e8..19debb4dc 100644
--- a/test/functional/repositories_controller_test.rb
+++ b/test/functional/repositories_controller_test.rb
@@ -182,6 +182,25 @@ class RepositoriesControllerTest < Redmine::RepositoryControllerTest
     end
   end
 
+  def test_show_should_show_diff_button_depending_on_browse_repository_permission
+    @request.session[:user_id] = 2
+    role = Role.find(1)
+
+    role.add_permission! :browse_repository
+    get :show, :params => {
+      :id => 1
+    }
+    assert_response :success
+    assert_select 'input[value="View differences"]'
+
+    role.remove_permission! :browse_repository
+    get :show, :params => {
+      :id => 1
+    }
+    assert_response :success
+    assert_select 'input[value="View differences"]', :count => 0
+  end
+
   def test_revisions
     get :revisions, :params => {
         :id => 1,