meineerde/redmine
1
0
Fork 0
mirror of https://github.com/meineerde/redmine.git synced 2025-12-24 09:21:12 +00:00
Code Issues Releases Wiki Activity

Ignore archived project memberships when calculating issue query visibility (#28180).

Browse Source 
Patch by Holger Just.


git-svn-id: http://svn.redmine.org/redmine/trunk@17257 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Go MAEDA 2018-04-07 00:26:54 +00:00
parent 97a5e99de8
commit e5a8bcfd72
2 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
app/models/query.rb
View File

@ -319,9 +319,10 @@ class Query < ActiveRecord::Base
" INNER JOIN #{table_name_prefix}queries_roles#{table_name_suffix} qr on qr.query_id = q.id" +
" INNER JOIN #{MemberRole.table_name} mr ON mr.role_id = qr.role_id" +
" INNER JOIN #{Member.table_name} m ON m.id = mr.member_id AND m.user_id = ?" +
" INNER JOIN #{Project.table_name} p ON p.id = m.project_id AND p.status <> ?" +
" WHERE q.project_id IS NULL OR q.project_id = m.project_id))" +
" OR #{table_name}.user_id = ?",
VISIBILITY_PUBLIC, VISIBILITY_ROLES, user.id, user.id)
VISIBILITY_PUBLIC, VISIBILITY_ROLES, user.id, Project::STATUS_ARCHIVED, user.id)
elsif user.logged?
scope.where("#{table_name}.visibility = ? OR #{table_name}.user_id = ?", VISIBILITY_PUBLIC, user.id)
else
@ -340,7 +341,7 @@ class Query < ActiveRecord::Base
if project
(user.roles_for_project(project) & roles).any?
else
Member.where(:user_id => user.id).joins(:roles).where(:member_roles => {:role_id => roles.map(&:id)}).any?
user.memberships.joins(:member_roles).where(:member_roles => {:role_id => roles.map(&:id)}).any?
end
else
user == self.user

5
test/unit/query_test.rb
View File

@ -1790,6 +1790,11 @@ class QueryTest < ActiveSupport::TestCase
assert q.visible?(User.find(1))
assert IssueQuery.visible(User.find(1)).find_by_id(q.id)
# Should ignore archived project memberships
Project.find(1).archive
assert !q.visible?(User.find(3))
assert_nil IssueQuery.visible(User.find(3)).find_by_id(q.id)
end
def test_query_with_private_visibility_should_be_visible_to_owner