From 1a3ee38c2e3ca077d3efb409567e0466bf1f1f41 Mon Sep 17 00:00:00 2001 From: Marius Balteanu Date: Thu, 16 Jun 2022 21:43:58 +0000 Subject: Respect field visibility when showing associated issue fields (#37255). Patch by Holger Just. git-svn-id: https://svn.redmine.org/redmine/trunk@21645 e93f8b46-1217-0410-a6f0-8f06a7374b81 --- test/functional/timelog_controller_test.rb | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) (limited to 'test') diff --git a/test/functional/timelog_controller_test.rb b/test/functional/timelog_controller_test.rb index 51fc9c310..15c15e7c0 100644 --- a/test/functional/timelog_controller_test.rb +++ b/test/functional/timelog_controller_test.rb @@ -1466,6 +1466,28 @@ class TimelogControllerTest < Redmine::ControllerTest assert_select 'td.issue_cf_2', :text => 'filter_on_issue_custom_field' end + def test_index_should_not_disclose_issue_data + category = IssueCategory.find 2 + issue = + Issue.generate!( + :project_id => 1, :tracker_id => 1, + :custom_field_values => {2 => 'filter_on_issue_custom_field'} + ) + entry = TimeEntry.generate!(:issue => issue, :hours => 2.5) + session[:user_id] = 3 + issue.update_columns is_private: true, category_id: category.id + assert_not issue.visible?(User.find(3)) + # since the issue is not visible, its custom fields and associated ojects should not be visible either + + get :index, :params => { + :c => %w(issue issue.cf_2 issue.category) + } + assert_response :success + assert_select 'td.issue', :text => /#{issue.subject}/, :count => 0 + assert_select 'td.issue-category', :text => /#{category.name}/, :count => 0 + assert_select 'td.issue_cf_2', :text => 'filter_on_issue_custom_field', :count => 0 + end + def test_index_with_time_entry_custom_field_column field = TimeEntryCustomField.generate!(:field_format => 'string') entry = TimeEntry.generate!(:hours => 2.5, :custom_field_values => {field.id => 'CF Value'}) -- cgit v1.2.3