Redmine

    return render_403 if !@issue.visible?

  def visible?(user=User.current)

    user.allowed_to?(:view_issues, self.project) || user.allowed_to?(:add_issues, self.project) && (author == user || assigned_to == user || watched_by?(user))

  def project_statement(own=nil)

    if own

      wt = Watcher.table_name

      uc = User.current.id.to_s

      project_clauses << '('+Project.allowed_to_condition(User.current, :view_issues)+' OR '+Project.allowed_to_condition(User.current, :add_issues)+

        " AND (#{Issue.table_name}.author_id=#{uc} OR "+

              "#{Issue.table_name}.assigned_to_id=#{uc} OR "+

              "#{Issue.table_name}.id IN (SELECT #{wt}.watchable_id FROM #{wt} WHERE #{wt}.watchable_type='Issue' AND user_id=#{uc}))"+")"

    else

      project_clauses << Project.allowed_to_condition(User.current, :view_issues)

    end

    (filters_clauses << project_statement(true)).join(' AND ')

      roles.any? {|role| (project.is_public? || role.member?) && role.allowed_to?(action)}

      roles.any? {|r| r.allowed_to?(action)} || (self.logged? ? Role.non_member.allowed_to?(action) : Role.anonymous.allowed_to?(action))

  map.permission :view_project, {:projects => [:show]}, :public => true

                                  :activities => [:index],

    map.permission :add_issues, {:issues => [:new, :create, :update_form, :index, :show]}

    map.permission :comment_news, {:activities => [:index], :news => :add_comment}

    map.permission :browse_repository, {:activities => [:index], :repositories => [:show, :browse, :entry, :annotate, :changes, :diff, :stats, :graph]}

    map.permission :view_changesets, {:activities => [:index], :repositories => [:show, :revisions, :revision]}

    map.permission :add_messages, {:activities => [:index], :messages => [:new, :reply, :quote]}

  assigned_to_id: 12

issues_014:

  created_on: <%= 5.days.ago.to_date.to_s(:db) %>

  project_id: 5

  updated_on: <%= 2.days.ago.to_date.to_s(:db) %>

  priority_id: 5

  subject: Test own message

  id: 14

  fixed_version_id: 

  category_id: 

  description: Test own message

  tracker_id: 1

  assigned_to_id: 

  author_id: 12

  status_id: 1

  root_id: 14

  lft: 1

  rgt: 2

member_roles_012: 

  id: 12

  role_id: 6

  member_id: 11

  inherited_from: 11

members_011: 

  id: 11

  created_on: 2006-07-19 19:35:33 +02:00

  project_id: 5

  user_id: 12

  mail_notification: false

roles_006: 

  name: Reporter2

  id: 6

  builtin: 0

  permissions: |

    --- 

    - :add_issues

  position: 6

users_012: 

  id: 12

  created_on: 2006-07-19 19:33:19 +02:00

  status: 1

  last_login_on: 

  language: 'ru'

  hashed_password: 1

  updated_on: 2006-07-19 19:33:19 +02:00

  admin: false

  mail: vasia@foo.bar

  lastname: Vasia

  firstname: Pupkin

  auth_source_id: 

  mail_notification: false

  login: vasia

  type: User

watchers_004: 

  watchable_type: Issue

  watchable_id: 9

  user_id: 12

    Role.find(1).remove_permission!(:add_issues)

  def test_show_own_issue_by_author

    @request.session[:user_id] = 12

    get :show, :id => 14

    assert_response :success

  end

  def test_show_own_issue_by_assigned

    @request.session[:user_id] = 12

    get :show, :id => 6

    assert_response :success

  end

  def test_show_own_issue_by_watcher

    @request.session[:user_id] = 12

    get :show, :id => 9

    assert_response :success

  end

  def test_show_should_deny_access_without_permission

    @request.session[:user_id] = 12

    get :show, :id => 10

    assert_response 403

  end

  fixtures :issues, :users, :watchers

  def test_visible_file_for_issue

    # Set "Add issue", unset "View issue" on default for user #12

    # author

    a = Attachment.new(:container => Issue.find(14), :file => uploaded_test_file("testfile.txt", ""), :author => User.find(2))

    assert a.save

    assert_equal true, a.visible?(User.find(12))

    # assigned to

    a = Attachment.new(:container => Issue.find(6), :file => uploaded_test_file("testfile.txt", ""), :author => User.find(2))

    assert a.save

    assert_equal true, a.visible?(User.find(12))

    # watcher

    a = Attachment.new(:container => Issue.find(9), :file => uploaded_test_file("testfile.txt", ""), :author => User.find(2))

    assert a.save

    assert_equal true, a.visible?(User.find(12))

    # other

    a = Attachment.new(:container => Issue.find(10), :file => uploaded_test_file("testfile.txt", ""), :author => User.find(2))

    assert a.save

    assert_equal false, a.visible?(User.find(12))

    Role.find(6).add_permission!(:view_issues)

    assert_equal true, a.visible?(User.find(12))

  end

  def test_visible

    user=User.find(12)

    issue = Issue.new(:project_id => 5, :tracker_id => 1, :author_id => 2, :status_id => 1, :priority => IssuePriority.all.first, :subject => 'test_own', :description => 'IssueTest#test_own', :estimated_hours => '5:30')

    assert issue.save

    issue.reload

    # Test for user, with "View_issue"

    assert_equal true, issue.visible?(User.find(8))

    # Test for user, without "View issue", but with "Add issue"

    assert_equal false, issue.visible?(user)

    # Test for assinged user

    issue.assigned_to=user

    assert_equal true, issue.visible?(user)

    # Test for watcher

    issue.assigned_to=nil

    issue.add_watcher(user)

    assert_equal true, issue.visible?(user)

    # Test for author

    issue = Issue.new(:project_id => 5, :tracker_id => 1, :author_id => 12, :status_id => 1, :priority => IssuePriority.all.first, :subject => 'test_own', :description => 'IssueTest#test_own', :estimated_hours => '5:30')

    assert issue.save

    issue.reload

    assert_equal true, issue.visible?(user)

  end

    assert_equal 6, groups.inject(0) {|sum, group| sum + group['total'].to_i}

      Role.non_member.remove_permission!(:add_issues)

          user.allowed_to?(self.class.attachable_options[:view_permission], self.project) || is_a?(Issue) && self.visible?(user)