Redmine

  <% if @issue && (@safe_attributes.include?('start_date') || @safe_attributes.include?('due_date')) %>

    <% modal_id = "update-dates-modal-#{Time.current.to_i}" %>

    <li><%= context_menu_link [(l(:field_start_date) if @safe_attributes.include?('start_date')), (l(:field_due_date) if @safe_attributes.include?('due_date'))].compact.join(' / '),

                              '#', :onclick => "showModal('#{modal_id}', '350px'); return false;" %></li>

    <div id="<%= modal_id %>" style="display:none;">

      <%= form_tag(issue_path(:id => @issue.id, :back_url => @back), :method => :patch, :id => nil) do %>

        <% if @safe_attributes.include?('start_date') %>

        <p>

          <label for='issue_start_date'><%= l(:field_start_date) %></label>

          <%= date_field_tag 'issue[start_date]', '', :value => @issue.start_date, :size => 10, :id => nil %><%= calendar_for('issue_start_date') %>

        </p>

        <% end %>

        <% if @safe_attributes.include?('due_date') %>

        <p>

          <label for='issue_due_date'><%= l(:field_due_date) %></label>

          <%= date_field_tag 'issue[due_date]', '', :value => @issue.due_date, :size => 10, :id => nil %><%= calendar_for('issue_due_date') %>

        </p>

        <% end %>

        <p class="buttons">

          <%= button_tag l(:button_submit), :name => nil, :onclick => "hideModal(this);$(this).closest('form').submit();", :data => { :disable_with => false } %>

          <%= link_to_function l(:button_cancel), "hideModal(this);" %>

        </p>

      <% end %>

    </div>

  <% end %>

    issue = Issue.find(1)

        :ids => [issue.id]

    # Start date / Due date

    assert_select 'a[href=?]', '#', :text => 'Start date / Due date'

    assert_select 'div[id^=update-dates-modal-]' do

      assert_select 'form[action=?]', "/issues/#{issue.id}"

      assert_select "input[name='issue[start_date]'][value=?]", issue.start_date.to_s

      assert_select "input[name='issue[due_date]'][value=?]", issue.due_date.to_s

    end

  def test_context_menu_should_not_include_a_date_form_if_date_attributes_are_unsafe

    issue = Issue.find(1)

    # Change start_date and due_date to unsafe attributes

    issue.tracker.core_fields = []

    issue.tracker.save

    @request.session[:user_id] = 2

    get :issues, :params => {

        :ids => [issue.id]

      }

    assert_response :success

    assert_select 'a[href=?][onclick=?]', '#', /showModal\('update-dates-modal-/, {:count => 0}

  end