4 files changed, 18 insertions, 9 deletions
diff --git a/app/controllers/news_controller.rb b/app/controllers/news_controller.rb
index fa6a62244..7f752fbc2 100644
--- a/app/controllers/news_controller.rb
+++ b/app/controllers/news_controller.rb
@@ -22,9 +22,9 @@ class NewsController < ApplicationController
   model_object News
   before_action :find_model_object, :except => [:new, :create, :index]
   before_action :find_project_from_association, :except => [:new, :create, :index]
-  before_action :find_project_by_project_id, :only => [:new, :create]
-  before_action :authorize, :except => [:index]
-  before_action :find_optional_project, :only => :index
+  before_action :find_project_by_project_id, :only => :create
+  before_action :authorize, :except => [:index, :new]
+  before_action :find_optional_project, :only => [:index, :new]
   accept_rss_auth :index
   accept_api_auth :index, :show, :create, :update, :destroy
 
@@ -72,6 +72,8 @@ class NewsController < ApplicationController
   end
 
   def new
+    raise ::Unauthorized unless User.current.allowed_to?(:manage_news, @project, :global => true)
+
     @news = News.new(:project => @project, :author => User.current)
   end
 
@@ -84,7 +86,7 @@ class NewsController < ApplicationController
         format.html do
           render_attachment_warning_if_needed(@news)
           flash[:notice] = l(:notice_successful_create)
-          redirect_to project_news_index_path(@project)
+          redirect_to params[:cross_project] ? news_index_path : project_news_index_path(@project)
         end
         format.api  {render_api_ok}
       end
diff --git a/app/views/news/_form.html.erb b/app/views/news/_form.html.erb
index a441b671d..8ce430732 100644
--- a/app/views/news/_form.html.erb
+++ b/app/views/news/_form.html.erb
@@ -1,6 +1,13 @@
 <%= error_messages_for @news %>
 
 <div class="box tabular">
+<% if @project.nil? %>
+  <p>
+    <label><%= l(:field_project) %> <span class="required">*</span></label>
+    <%= select_tag :project_id, options_for_select(project_tree_options_for_select(Project.allowed_to(:manage_news).to_a), Project.allowed_to(:manage_news).first), {:required => true} %>
+    <%= hidden_field_tag :cross_project, 1, id: nil %>
+  </p>
+<% end %>
 <p><%= f.text_field :title, :required => true, :size => 60 %></p>
 <p><%= f.text_area :summary, :cols => 60, :rows => 2 %></p>
 <p><%= f.text_area :description, :required => true, :cols => 60, :rows => 15, :class => 'wiki-edit',
diff --git a/app/views/news/index.html.erb b/app/views/news/index.html.erb
index 073099f56..3a8f1ccb2 100644
--- a/app/views/news/index.html.erb
+++ b/app/views/news/index.html.erb
@@ -1,19 +1,19 @@
 <div class="contextual">
 <%= link_to(l(:label_news_new),
-            new_project_news_path(@project),
+            (@project ? project_news_index_path(@project) : news_index_path),
             :class => 'icon icon-add',
-            :onclick => 'showAndScrollTo("add-news", "news_title"); return false;') if @project && User.current.allowed_to?(:manage_news, @project) %>
+            :onclick => 'showAndScrollTo("add-news", "news_title"); return false;') if (@project.nil? || (@project && User.current.allowed_to?(:manage_news, @project))) %>
 <%= watcher_link(@project.enabled_module('news'), User.current) if @project && User.current.logged? %>
 </div>
 
 <div id="add-news" style="display:none;">
 <h2><%=l(:label_news_new)%></h2>
-<%= labelled_form_for @news, :url => project_news_index_path(@project),
+<%= labelled_form_for @news, :url => (@project ? project_news_index_path(@project) : news_index_path),
                                            :html => { :id => 'news-form', :multipart => true } do |f| %>
 <%= render :partial => 'news/form', :locals => { :f => f } %>
 <%= submit_tag l(:button_create) %>
 <%= link_to l(:button_cancel), "#", :onclick => '$("#add-news").hide()' %>
-<% end if @project %>
+<% end %>
 </div>
 
 <h2><%=l(:label_news_plural)%></h2>
diff --git a/app/views/news/new.html.erb b/app/views/news/new.html.erb
index cf57140b8..6ac32008d 100644
--- a/app/views/news/new.html.erb
+++ b/app/views/news/new.html.erb
@@ -1,6 +1,6 @@
 <h2><%=l(:label_news_new)%></h2>
 
-<%= labelled_form_for @news, :url => project_news_index_path(@project),
+<%= labelled_form_for @news, :url => (@project ? project_news_index_path(@project) : news_index_path),
                                            :html => { :id => 'news-form', :multipart => true } do |f| %>
   <%= render :partial => 'news/form', :locals => { :f => f } %>
   <%= submit_tag l(:button_create) %>