From 27bcd879f31450bf32397864b4d36d2bacc8ee6d Mon Sep 17 00:00:00 2001
From: Jean-Philippe Lang <jp_lang@yahoo.fr>
Date: Sat, 9 May 2015 10:10:28 +0000
Subject: Can't bulk edit own time entries with "Edit own time entries"
 (#18580).

git-svn-id: http://svn.redmine.org/redmine/trunk@14242 e93f8b46-1217-0410-a6f0-8f06a7374b81
---
 app/controllers/timelog_controller.rb | 1 +
 1 file changed, 1 insertion(+)

(limited to 'app/controllers/timelog_controller.rb')

diff --git a/app/controllers/timelog_controller.rb b/app/controllers/timelog_controller.rb
index 8a8cfeeea..a8d48a707 100644
--- a/app/controllers/timelog_controller.rb
+++ b/app/controllers/timelog_controller.rb
@@ -234,6 +234,7 @@ private
   def find_time_entries
     @time_entries = TimeEntry.where(:id => params[:id] || params[:ids]).to_a
     raise ActiveRecord::RecordNotFound if @time_entries.empty?
+    raise Unauthorized unless @time_entries.all? {|t| t.editable_by?(User.current)}
     @projects = @time_entries.collect(&:project).compact.uniq
     @project = @projects.first if @projects.size == 1
   rescue ActiveRecord::RecordNotFound
-- 
cgit v1.2.3