From 03de39b3b84e300edf6d1ab0f99ed4bab452dfc6 Mon Sep 17 00:00:00 2001 From: Marius BALTEANU Date: Sun, 1 Aug 2021 14:02:34 +0300 Subject: [PATCH 1/2] Adds tests for issue attachment edit by user without edit issue permission on tracker. --- test/functional/attachments_controller_test.rb | 17 +++++++++++++++++ test/functional/issues_controller_test.rb | 13 +++++++++++++ 2 files changed, 30 insertions(+) diff --git a/test/functional/attachments_controller_test.rb b/test/functional/attachments_controller_test.rb index f9f89ffd9..e7f6d3a2f 100644 --- a/test/functional/attachments_controller_test.rb +++ b/test/functional/attachments_controller_test.rb @@ -524,6 +524,23 @@ class AttachmentsControllerTest < Redmine::ControllerTest assert_response 403 end + def test_edit_all_issue_attachment_by_user_without_edit_issue_permission_on_tracker_should_return_404 + role = Role.find(2) + role.set_permission_trackers 'edit_issues', [2, 3] + role.save! + + @request.session[:user_id] = 2 + + get( + :edit_all, + :params => { + :object_type => 'issues', + :object_id => '4' + } + ) + assert_response 404 + end + def test_update_all @request.session[:user_id] = 2 patch( diff --git a/test/functional/issues_controller_test.rb b/test/functional/issues_controller_test.rb index b2ca3ed0c..c13a6db53 100644 --- a/test/functional/issues_controller_test.rb +++ b/test/functional/issues_controller_test.rb @@ -3157,6 +3157,19 @@ class IssuesControllerTest < Redmine::ControllerTest assert_select 'span.badge.badge-private', text: 'Private' end + def test_show_should_not_display_edit_attachment_icon_for_user_without_edit_issue_permission_on_tracker + role = Role.find(2) + role.set_permission_trackers 'edit_issues', [2, 3] + role.save! + + @request.session[:user_id] = 2 + + get :show, params: {id: 4} + + assert_response :success + assert_select 'div.attachments .icon-edit', 0 + end + def test_get_new @request.session[:user_id] = 2 get( -- 2.22.0