diff options
| author | Marius Balteanu <marius.balteanu@zitec.com> | 2022-06-16 21:43:58 +0000 |
|---|---|---|
| committer | Marius Balteanu <marius.balteanu@zitec.com> | 2022-06-16 21:43:58 +0000 |
| commit | 1a3ee38c2e3ca077d3efb409567e0466bf1f1f41 (patch) | |
| tree | 2d2646b60dbe8e66404670713fbb819ec141f2db /test | |
| parent | 04b91b35788eda8a751f8a27d7a8a4bdd47a6e21 (diff) | |
| download | redmine-1a3ee38c2e3ca077d3efb409567e0466bf1f1f41.tar.gz redmine-1a3ee38c2e3ca077d3efb409567e0466bf1f1f41.zip | |
Respect field visibility when showing associated issue fields (#37255).
Patch by Holger Just.
git-svn-id: https://svn.redmine.org/redmine/trunk@21645 e93f8b46-1217-0410-a6f0-8f06a7374b81
Diffstat (limited to 'test')
| -rw-r--r-- | test/functional/timelog_controller_test.rb | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/test/functional/timelog_controller_test.rb b/test/functional/timelog_controller_test.rb index 51fc9c310..15c15e7c0 100644 --- a/test/functional/timelog_controller_test.rb +++ b/test/functional/timelog_controller_test.rb @@ -1466,6 +1466,28 @@ class TimelogControllerTest < Redmine::ControllerTest assert_select 'td.issue_cf_2', :text => 'filter_on_issue_custom_field' end + def test_index_should_not_disclose_issue_data + category = IssueCategory.find 2 + issue = + Issue.generate!( + :project_id => 1, :tracker_id => 1, + :custom_field_values => {2 => 'filter_on_issue_custom_field'} + ) + entry = TimeEntry.generate!(:issue => issue, :hours => 2.5) + session[:user_id] = 3 + issue.update_columns is_private: true, category_id: category.id + assert_not issue.visible?(User.find(3)) + # since the issue is not visible, its custom fields and associated ojects should not be visible either + + get :index, :params => { + :c => %w(issue issue.cf_2 issue.category) + } + assert_response :success + assert_select 'td.issue', :text => /#{issue.subject}/, :count => 0 + assert_select 'td.issue-category', :text => /#{category.name}/, :count => 0 + assert_select 'td.issue_cf_2', :text => 'filter_on_issue_custom_field', :count => 0 + end + def test_index_with_time_entry_custom_field_column field = TimeEntryCustomField.generate!(:field_format => 'string') entry = TimeEntry.generate!(:hours => 2.5, :custom_field_values => {field.id => 'CF Value'}) |