meineerde/redmine
1
0
Fork 0
mirror of https://github.com/meineerde/redmine.git synced 2025-10-17 17:01:01 +00:00
Code Issues Releases Wiki Activity

"View differences" buttons are shown in the repository page even without "Browse repository" permission (#30731).

Browse Source 
Patch by Go MAEDA.

git-svn-id: http://svn.redmine.org/redmine/trunk@18013 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang 2019-03-30 06:13:08 +00:00
parent 32dce42b71
commit 805aef85de
2 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/views/repositories/_revisions.html.erb
View File

@ -20,7 +20,7 @@ end %>
:repository_id => @repository.identifier_param, :path => to_path_param(path)},
:method => :get
) do %>
<% show_diff = revisions.size > 1 %>
<% show_diff = revisions.size > 1 && User.current.allowed_to?(:browse_repository, @repository.project) %>
<%= submit_tag(l(:label_view_diff), :name => nil) if show_diff %>
<table class="list changesets">
<thead><tr>

19
test/functional/repositories_controller_test.rb
View File

@ -182,6 +182,25 @@ class RepositoriesControllerTest < Redmine::RepositoryControllerTest
end
end
def test_show_should_show_diff_button_depending_on_browse_repository_permission
@request.session[:user_id] = 2
role = Role.find(1)
role.add_permission! :browse_repository
get :show, :params => {
:id => 1
}
assert_response :success
assert_select 'input[value="View differences"]'
role.remove_permission! :browse_repository
get :show, :params => {
:id => 1
}
assert_response :success
assert_select 'input[value="View differences"]', :count => 0
end
def test_revisions
get :revisions, :params => {
:id => 1,