meineerde/redmine
1
0
Fork 0
mirror of https://github.com/meineerde/redmine.git synced 2026-01-31 19:47:14 +00:00
Code Issues Releases Wiki Activity

"Add news" button on global news index is displayed for users without permission (#35308).

Browse Source 
Patch by Alexander Meindl and Mizuki ISHIKAWA.


git-svn-id: http://svn.redmine.org/redmine/trunk@21014 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Go MAEDA 2021-05-29 06:44:54 +00:00
parent 5ac8f70d10
commit 1918943020
2 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/views/news/index.html.erb
View File

@ -1,8 +1,8 @@
<div class="contextual">
<%= link_to(l(:label_news_new),
(@project ? project_news_index_path(@project) : news_index_path),
:class => 'icon icon-add',
:onclick => 'showAndScrollTo("add-news", "news_title"); return false;') if (@project.nil? || (@project && User.current.allowed_to?(:manage_news, @project))) %>
:class => 'icon icon-add add-news-link',
:onclick => 'showAndScrollTo("add-news", "news_title"); return false;') if User.current.allowed_to?(:manage_news, @project, global: true) %>
<%= watcher_link(@project.enabled_module('news'), User.current) if @project && User.current.logged? %>
</div>

12
test/functional/news_controller_test.rb
View File

@ -53,6 +53,18 @@ class NewsControllerTest < Redmine::ControllerTest
assert_response 403
end
def test_index_without_manage_news_permission_should_not_display_add_news_link
user = User.find(2)
@request.session[:user_id] = user.id
Role.all.each {|r| r.remove_permission! :manage_news}
get :index
assert_select '.add-news-link', count: 0
user.members.first.roles.first.add_permission! :manage_news
get :index
assert_select '.add-news-link', count: 1
end
def test_show
get(:show, :params => {:id => 1})
assert_response :success