meineerde/redmine
1
0
Fork 0
mirror of https://github.com/meineerde/redmine.git synced 2025-12-19 15:01:14 +00:00
Code Issues Releases Wiki Activity

Information leak in Atom feed (#21419).

Browse Source 
Patch by Jens Krämer.

git-svn-id: http://svn.redmine.org/redmine/trunk@14913 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang 2015-12-04 12:42:13 +00:00
parent 12ede7d07f
commit 7e423fb453
2 changed files with 42 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/views/journals/index.builder
View File

@ -20,7 +20,7 @@ xml.feed "xmlns" => "http://www.w3.org/2005/Atom" do
end end
xml.content "type" => "html" do xml.content "type" => "html" do
xml.text! '<ul>' xml.text! '<ul>'
details_to_strings(change.details, false).each do |string| details_to_strings(change.visible_details, false).each do |string|
xml.text! '<li>' + string + '</li>' xml.text! '<li>' + string + '</li>'
end end
xml.text! '</ul>' xml.text! '</ul>'

42
test/functional/journals_controller_test.rb
View File

@ -19,7 +19,7 @@ require File.expand_path('../../test_helper', __FILE__)
class JournalsControllerTest < ActionController::TestCase class JournalsControllerTest < ActionController::TestCase
fixtures :projects, :users, :members, :member_roles, :roles, :issues, :journals, :journal_details, :enabled_modules, fixtures :projects, :users, :members, :member_roles, :roles, :issues, :journals, :journal_details, :enabled_modules,
:trackers, :issue_statuses, :enumerations, :custom_fields, :custom_values, :custom_fields_projects :trackers, :issue_statuses, :enumerations, :custom_fields, :custom_values, :custom_fields_projects, :projects_trackers
def setup def setup
User.current = nil User.current = nil
@ -51,6 +51,46 @@ class JournalsControllerTest < ActionController::TestCase
assert_not_include journal, assigns(:journals) assert_not_include journal, assigns(:journals)
end end
def test_index_should_show_visible_custom_fields_only
Issue.destroy_all
field_attributes = {:field_format => 'string', :is_for_all => true, :is_filter => true, :trackers => Tracker.all}
@fields = []
@fields << (@field1 = IssueCustomField.create!(field_attributes.merge(:name => 'Field 1', :visible => true)))
@fields << (@field2 = IssueCustomField.create!(field_attributes.merge(:name => 'Field 2', :visible => false, :role_ids => [1, 2])))
@fields << (@field3 = IssueCustomField.create!(field_attributes.merge(:name => 'Field 3', :visible => false, :role_ids => [1, 3])))
@issue = Issue.generate!(
:author_id => 1,
:project_id => 1,
:tracker_id => 1,
:custom_field_values => {@field1.id => 'Value0', @field2.id => 'Value1', @field3.id => 'Value2'}
)
@issue.init_journal(User.find(1))
@issue.update_attribute :custom_field_values, {@field1.id => 'NewValue0', @field2.id => 'NewValue1', @field3.id => 'NewValue2'}
user_with_role_on_other_project = User.generate!
User.add_to_project(user_with_role_on_other_project, Project.find(2), Role.find(3))
users_to_test = {
User.find(1) => [@field1, @field2, @field3],
User.find(3) => [@field1, @field2],
user_with_role_on_other_project => [@field1], # should see field1 only on Project 1
User.generate! => [@field1],
User.anonymous => [@field1]
}
users_to_test.each do |user, visible_fields|
get :index, :format => 'atom', :key => user.rss_key
@fields.each_with_index do |field, i|
if visible_fields.include?(field)
assert_select "content[type=html]", { :text => /NewValue#{i}/, :count => 1 }, "User #{user.id} was not able to view #{field.name} in API"
else
assert_select "content[type=html]", { :text => /NewValue#{i}/, :count => 0 }, "User #{user.id} was able to view #{field.name} in API"
end
end
end
end
def test_diff_for_description_change def test_diff_for_description_change
get :diff, :id => 3, :detail_id => 4 get :diff, :id => 3, :detail_id => 4
assert_response :success assert_response :success