Skip to content

O
OHR Support
Commit cd55529e authored by Jean-Philippe Lang's avatar Jean-Philippe Lang
Browse files
Options

Fixed that 'My page' blocks may display issues that the user is no longer allowed to view (#2590). 

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@2322 e93f8b46-1217-0410-a6f0-8f06a7374b81
parent 837f0743
Hide whitespace changes
Inline Side-by-side
Showing with 9 additions and 6 deletions
app/models/issue.rb
View file @ cd55529e
......@@ -51,6 +51,9 @@ class Issue < ActiveRecord::Base
validates_inclusion_of :done_ratio, :in => 0..100
validates_numericality_of :estimated_hours, :allow_nil => true
named_scope :visible, lambda {|*args| { :include => :project,
:conditions => Project.allowed_to_condition(args.first || User.current, :view_issues) } }
def after_initialize
if new_record?
# set default values for new records only
......
app/views/my/blocks/_issuesassignedtome.rhtml
View file @ cd55529e
<h3><%=l(:label_assigned_to_me_issues)%></h3>
<% assigned_issues = Issue.find(:all,
:conditions => ["assigned_to_id=? AND #{IssueStatus.table_name}.is_closed=? AND #{Project.table_name}.status=#{Project::STATUS_ACTIVE}", user.id, false],
<% assigned_issues = Issue.visible.find(:all,
:conditions => ["assigned_to_id=? AND #{IssueStatus.table_name}.is_closed=?", user.id, false],
:limit => 10,
:include => [ :status, :project, :tracker, :priority ],
:order => "#{Enumeration.table_name}.position DESC, #{Issue.table_name}.updated_on DESC") %>
......
app/views/my/blocks/_issuesreportedbyme.rhtml
View file @ cd55529e
<h3><%=l(:label_reported_issues)%></h3>
<% reported_issues = Issue.find(:all,
:conditions => ["author_id=? AND #{Project.table_name}.status=#{Project::STATUS_ACTIVE}", user.id],
<% reported_issues = Issue.visible.find(:all,
:conditions => { :author_id => user.id },
:limit => 10,
:include => [ :status, :project, :tracker ],
:order => "#{Issue.table_name}.updated_on DESC") %>
......
app/views/my/blocks/_issueswatched.rhtml
View file @ cd55529e
<h3><%=l(:label_watched_issues)%></h3>
<% watched_issues = Issue.find(:all,
<% watched_issues = Issue.visible.find(:all,
:include => [:status, :project, :tracker, :watchers],
:limit => 10,
:conditions => ["#{Watcher.table_name}.user_id = ? AND #{Project.table_name}.status=#{Project::STATUS_ACTIVE}", user.id],
:conditions => ["#{Watcher.table_name}.user_id = ?", user.id],
:order => "#{Issue.table_name}.updated_on DESC") %>
<%= render :partial => 'issues/list_simple', :locals => { :issues => watched_issues } %>
<% if watched_issues.length > 0 %>
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment