Redmine

  <% if @safe_attributes.include?('start_date') || @safe_attributes.include?('due_date') %>

    <li><%= context_menu_link "#{l(:field_start_date)} / #{l(:field_due_date)}", '#', :onclick => "showModal('bulk_update_date', '350px'); return false;" %></li>

    <div id="bulk_update_date" style="display:none;">

      <h3 class="title"><%= "#{l(:field_start_date)}/#{l(:field_due_date)}" %></h3>

      <%= form_tag(bulk_update_issues_path(:ids => @issue_ids, :back_url => @back), :id => 'bulk_update_date') do %>

        <% if @safe_attributes.include?('start_date') %>

        <p>

          <label for='issue_start_date'><%= l(:field_start_date) %></label>

          <%= date_field_tag 'issue[start_date]', '', :value => (@issue ? @issue.start_date : nil), :size => 10 %><%= calendar_for('issue_start_date') %>

          <label class="inline"><%= check_box_tag 'issue[start_date]', 'none', false, :id => nil, :data => {:disables => '#issue_start_date'} %><%= l(:button_clear) %></label>

        </p>

        <% end %>

        <% if @safe_attributes.include?('due_date') %>

        <p>

          <label for='issue_due_date'><%= l(:field_due_date) %></label>

          <%= date_field_tag 'issue[due_date]', '', :value => (@issue ? @issue.due_date : nil), :size => 10 %><%= calendar_for('issue_due_date') %>

          <label class="inline"><%= check_box_tag 'issue[due_date]', 'none', false, :id => nil, :data => {:disables => '#issue_due_date'} %><%= l(:button_clear) %></label>

        </p>

        <% end %>

        <p class="buttons">

            <%= button_tag l(:button_submit), :name => nil, :onclick => "hideModal(this);$('form#bulk_update_date').submit();", :data => { :disable_with => false } %>

            <%= link_to_function l(:button_cancel), "hideModal(this);" %>

          </p>

      <% end %>

    </div>

  <% end %>

<%= javascript_tag do %>

$('input[data-disables]').change(function() {

  if ($(this).prop('checked')){

    $($(this).data('disables')).attr('disabled', true).val('');

  } else {

    $($(this).data('disables')).attr('disabled', false);

  }

});

<% end %>

    issue = Issue.find(1)

        :ids => [issue.id]

    # Start date / Due date

    assert_select 'a[href=?]', '#', :text => 'Start date / Due date', :onclick => "showModal('bulk_update_date', '350px'); return false;"

    assert_select 'div#bulk_update_date' do

      assert_select "input[name='issue[start_date]'][value=?]", issue.start_date.to_s

      assert_select "input[name='issue[due_date]'][value=?]", issue.due_date.to_s

    end

  def test_context_menu_should_not_include_a_date_form_if_date_attributes_are_unsafe

    issue = Issue.find(1)

    # Change start_date and due_date to unsafe attributes

    issue.tracker.core_fields = []

    issue.tracker.save

    @request.session[:user_id] = 2

    get :issues, :params => {

        :ids => [issue.id]

      }

    assert_response :success

    assert_select 'a[href=?]', '#', {:text => 'Date', :onclick => "showModal('bulk_update_date', '350px'); return false;", :count => 0}

  end