diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb index 369291a3c..f225e8394 100644 --- a/app/helpers/application_helper.rb +++ b/app/helpers/application_helper.rb @@ -1307,6 +1307,13 @@ module ApplicationHelper name = remove_double_quotes(identifier) u = User.visible.find_by("LOWER(login) = :s AND type = 'User'", :s => name.downcase) link = link_to_user(u, :only_path => only_path, :class => 'user-mention', :mention => true) if u + if u && obj && !obj.visible?(u) + link += content_tag( + 'span', l(:notice_invalid_mention), + class: 'icon-only icon-warning', + title: l(:notice_invalid_mention) + ) + end end end (leading + (link || "#{project_prefix}#{prefix}#{repo_prefix}#{sep}#{identifier}#{comment_suffix}")) diff --git a/config/locales/en.yml b/config/locales/en.yml index 1584f5ef2..a927f4d87 100644 --- a/config/locales/en.yml +++ b/config/locales/en.yml @@ -195,6 +195,7 @@ en: notice_issue_not_closable_by_blocking_issue: "This issue cannot be closed because it is blocked by at least one open issue." notice_issue_not_reopenable_by_closed_parent_issue: "This issue cannot be reopened because its parent issue is closed." notice_invalid_watcher: "Invalid watcher: User will not receive any notifications because they do not have access to view this object." + notice_invalid_mention: "Invalid mention: User will not receive mention notifications because it does not have access to view this object." error_can_t_load_default_data: "Default configuration could not be loaded: %{value}" error_scm_not_found: "The entry or revision was not found in the repository." diff --git a/test/helpers/application_helper_test.rb b/test/helpers/application_helper_test.rb index 82991888d..1c14d62d4 100644 --- a/test/helpers/application_helper_test.rb +++ b/test/helpers/application_helper_test.rb @@ -612,6 +612,23 @@ class ApplicationHelperTest < Redmine::HelperTest end end + def test_mention_link_to_users_who_are_not_authorised_to_view_the_object + set_language_if_valid 'en' + with_settings :text_formatting => 'textile' do + issue = Issue.find(4) + assert_not issue.visible?(User.find(3)) + + expected_output = + link_to_user(User.find(3), only_path: true, class: 'user-mention', mention: true) + + content_tag('span', l(:notice_invalid_mention), + class: 'icon-only icon-warning', title: l(:notice_invalid_mention)) + assert_equal "

#{expected_output}

", textilizable("@#{User.find(3).login}", :object => issue) + + journal = Journal.find(2) + assert_equal '

#note-2

', textilizable('#note-2', :object => journal) + end + end + def test_link_to_note_within_the_same_page with_settings :text_formatting => 'textile' do issue = Issue.find(1)