meineerde/redmine
1
0
Fork 0
mirror of https://github.com/meineerde/redmine.git synced 2026-01-31 19:47:14 +00:00
Code Issues Releases Wiki Activity

Adds tests for issue attachment edit by user without edit issue permission on tracker (#35634).

Browse Source 
git-svn-id: http://svn.redmine.org/redmine/trunk@21141 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Marius Balteanu 2021-08-05 23:48:47 +00:00
parent 16b8d3c0be
commit 1146831b3d
2 changed files with 30 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
test/functional/attachments_controller_test.rb
View File

@ -524,6 +524,23 @@ class AttachmentsControllerTest < Redmine::ControllerTest
assert_response 403
end
def test_edit_all_issue_attachment_by_user_without_edit_issue_permission_on_tracker_should_return_404
role = Role.find(2)
role.set_permission_trackers 'edit_issues', [2, 3]
role.save!
@request.session[:user_id] = 2
get(
:edit_all,
:params => {
:object_type => 'issues',
:object_id => '4'
}
)
assert_response 404
end
def test_update_all
@request.session[:user_id] = 2
patch(

13
test/functional/issues_controller_test.rb
View File

@ -3157,6 +3157,19 @@ class IssuesControllerTest < Redmine::ControllerTest
assert_select 'span.badge.badge-private', text: 'Private'
end
def test_show_should_not_display_edit_attachment_icon_for_user_without_edit_issue_permission_on_tracker
role = Role.find(2)
role.set_permission_trackers 'edit_issues', [2, 3]
role.save!
@request.session[:user_id] = 2
get :show, params: {id: 4}
assert_response :success
assert_select 'div.attachments .icon-edit', 0
end
def test_get_new
@request.session[:user_id] = 2
get(