meineerde/redmine
1
0
Fork 0
mirror of https://github.com/meineerde/redmine.git synced 2026-03-11 03:33:07 +00:00
Code Issues Releases Wiki Activity

Merged r21641 to 5.0-stable (#37187).

Browse Source 
git-svn-id: https://svn.redmine.org/redmine/branches/5.0-stable@21652 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Marius Balteanu 2022-06-17 10:25:15 +00:00
parent fd8d8ba18c
commit 7c8df4c29d
2 changed files with 46 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
app/models/mail_handler.rb
View File

@ -22,6 +22,8 @@ class MailHandler < ActionMailer::Base
include Redmine::I18n
class UnauthorizedAction < StandardError; end
class NotAllowedInProject < UnauthorizedAction; end
class InsufficientPermissions < UnauthorizedAction; end
class MissingInformation < StandardError; end
attr_reader :email, :user, :handler_options
@ -182,9 +184,13 @@ class MailHandler < ActionMailer::Base
# Creates a new issue
def receive_issue
project = target_project
# Never receive emails to projects where adding issues is not possible
raise NotAllowedInProject, "not possible to add issues to project [#{project.name}]" unless project.allows_to?(:add_issues)
# check permission
unless handler_options[:no_permission_check]
raise UnauthorizedAction, "not allowed to add issues to project [#{project.name}]" unless user.allowed_to?(:add_issues, project)
raise InsufficientPermissions, "not allowed to add issues to project [#{project.name}]" unless user.allowed_to?(:add_issues, project)
end
issue = Issue.new(:author => user, :project => project)
@ -223,10 +229,14 @@ class MailHandler < ActionMailer::Base
return nil
end
# Never receive emails to projects where adding issue notes is not possible
project = issue.project
raise NotAllowedInProject, "not possible to add notes to project [#{project.name}]" unless project.allows_to?(:add_issue_notes)
# check permission
unless handler_options[:no_permission_check]
unless issue.notes_addable?
raise UnauthorizedAction, "not allowed to add notes on issues to project [#{issue.project.name}]"
raise InsufficientPermissions, "not allowed to add notes on issues to project [#{issue.project.name}]"
end
end
@ -274,8 +284,12 @@ class MailHandler < ActionMailer::Base
return nil
end
# Never receive emails to projects where adding messages is not possible
project = message.project
raise NotAllowedInProject, "not possible to add messages to project [#{project.name}]" unless project.allows_to?(:add_messages)
unless handler_options[:no_permission_check]
raise UnauthorizedAction, "not allowed to add messages to project [#{message.project.name}]" unless user.allowed_to?(:add_messages, message.project)
raise InsufficientPermissions, "not allowed to add messages to project [#{message.project.name}]" unless user.allowed_to?(:add_messages, message.project)
end
if !message.locked?

29
test/unit/mail_handler_test.rb
View File

@ -403,6 +403,35 @@ class MailHandlerTest < ActiveSupport::TestCase
end
end
def test_no_issue_on_closed_project_without_permission_check
Project.find(2).close
assert_no_difference 'User.count' do
assert_no_difference 'Issue.count' do
submit_email(
'ticket_by_unknown_user.eml',
:issue => {:project => 'onlinestore'},
:no_permission_check => '1',
:unknown_user => 'accept'
)
end
end
ensure
Project.find(2).reopen
end
def test_no_issue_on_closed_project_without_issue_tracking_module
assert_no_difference 'User.count' do
assert_no_difference 'Issue.count' do
submit_email(
'ticket_by_unknown_user.eml',
:issue => {:project => 'subproject2'},
:no_permission_check => '1',
:unknown_user => 'accept'
)
end
end
end
def test_add_issue_by_created_user
Setting.default_language = 'en'
assert_difference 'User.count' do