Commit 4cea676d authored by Holger Just's avatar Holger Just

Merge branch 'release-v1.5.3' into stable-1.x

parents 3f518259 c06cba31
= ChiliProject changelog = ChiliProject changelog
== 2011-10-04 v1.5.3
* Bug #619: Redmine.pm allows anonymous read access to repositories even if Anonymous role prohibits it
== 2011-08-01 v1.5.2 == 2011-08-01 v1.5.2
* Bug #547: Multiple XSS vulnerabilities * Bug #547: Multiple XSS vulnerabilities
...@@ -1520,7 +1524,7 @@ Note: Previous versions referred to Redmine, which ChiliProject forked from in D ...@@ -1520,7 +1524,7 @@ Note: Previous versions referred to Redmine, which ChiliProject forked from in D
* simple SVN browser added (just needs svn binaries in PATH) * simple SVN browser added (just needs svn binaries in PATH)
* comments can now be added on news * comments can now be added on news
* "my page" is now customizable * "my page" is now customizable
* more powerfull and savable filters for issues lists * more powerfull and savable filters for issues lists
* improved issues change history * improved issues change history
* new functionality: move an issue to another project or tracker * new functionality: move an issue to another project or tracker
...@@ -1559,7 +1563,7 @@ Note: Previous versions referred to Redmine, which ChiliProject forked from in D ...@@ -1559,7 +1563,7 @@ Note: Previous versions referred to Redmine, which ChiliProject forked from in D
* token based "lost password" functionality * token based "lost password" functionality
* user self-registration functionality (optional) * user self-registration functionality (optional)
* custom fields now available for issues, users and projects * custom fields now available for issues, users and projects
* new custom field format "text" (displayed as a textarea field) * new custom field format "text" (displayed as a textarea field)
* project & administration drop down menus in navigation bar for quicker access * project & administration drop down menus in navigation bar for quicker access
* text formatting is preserved for long text fields (issues, projects and news descriptions) * text formatting is preserved for long text fields (issues, projects and news descriptions)
* urls and emails are turned into clickable links in long text fields * urls and emails are turned into clickable links in long text fields
......
...@@ -318,7 +318,7 @@ sub access_handler { ...@@ -318,7 +318,7 @@ sub access_handler {
my $project_id = get_project_identifier($r); my $project_id = get_project_identifier($r);
$r->set_handlers(PerlAuthenHandler => [\&OK]) $r->set_handlers(PerlAuthenHandler => [\&OK])
if is_public_project($project_id, $r); if is_public_project($project_id, $r) && anonymous_role_allows_browse_repository($r);
return OK return OK
} }
...@@ -390,6 +390,29 @@ sub is_public_project { ...@@ -390,6 +390,29 @@ sub is_public_project {
$ret; $ret;
} }
sub anonymous_role_allows_browse_repository {
my $r = shift;
my $dbh = connect_database($r);
my $sth = $dbh->prepare(
"SELECT permissions FROM roles WHERE builtin = 2;"
);
$sth->execute();
my $ret = 0;
if (my @row = $sth->fetchrow_array) {
if ($row[0] =~ /:browse_repository/) {
$ret = 1;
}
}
$sth->finish();
undef $sth;
$dbh->disconnect();
undef $dbh;
$ret;
}
# perhaps we should use repository right (other read right) to check public access. # perhaps we should use repository right (other read right) to check public access.
# it could be faster BUT it doesn't work for the moment. # it could be faster BUT it doesn't work for the moment.
# sub is_public_project_by_file { # sub is_public_project_by_file {
......
...@@ -4,9 +4,9 @@ module Redmine ...@@ -4,9 +4,9 @@ module Redmine
module VERSION #:nodoc: module VERSION #:nodoc:
MAJOR = 1 MAJOR = 1
MINOR = 5 MINOR = 5
PATCH = 2 PATCH = 3
TINY = PATCH # Redmine compat TINY = PATCH # Redmine compat
def self.revision def self.revision
revision = nil revision = nil
entries_path = "#{RAILS_ROOT}/.svn/entries" entries_path = "#{RAILS_ROOT}/.svn/entries"
...@@ -31,9 +31,9 @@ module Redmine ...@@ -31,9 +31,9 @@ module Redmine
REVISION = self.revision REVISION = self.revision
ARRAY = [MAJOR, MINOR, PATCH, REVISION].compact ARRAY = [MAJOR, MINOR, PATCH, REVISION].compact
STRING = ARRAY.join('.') STRING = ARRAY.join('.')
def self.to_a; ARRAY end def self.to_a; ARRAY end
def self.to_s; STRING end def self.to_s; STRING end
def self.to_semver def self.to_semver
[MAJOR, MINOR, PATCH].join('.') [MAJOR, MINOR, PATCH].join('.')
end end
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment