Project

General

Profile

Actions

Defect #41465

open

User without log_time permission can access /time_entry/imports/new

Added by Kenta Kumojima 16 days ago. Updated 14 days ago.

Status:
Confirmed
Priority:
Normal
Assignee:
-
Category:
Importers
Target version:
Start date:
Due date:
% Done:

0%

Estimated time:
Resolution:
Affected version:

Description

User without log_time permission can access /time_entry/imports/new. (this user has import_time_entry permission)
if the user try to import, internal error occured.

ActionView::Template::Error (undefined method `activities' for nil:NilClass

    project.activities
           ^^^^^^^^^^^):

Causes:
NoMethodError (undefined method `activities' for nil:NilClass

    project.activities
           ^^^^^^^^^^^)
     7: <p>
     8:   <label for="import_mapping_activity"><%= l(:field_activity) %></label>
     9:   <%= mapping_select_tag @import, 'activity', :required => true,
    10:         :values => @import.allowed_target_activities.sorted.map {|t| [t.name, t.id]} %>
    11: </p>
    12:
    13: <div class="splitcontent">

app/models/time_entry_import.rb:52:in `allowed_target_activities'
app/views/imports/_time_entries_fields_mapping.html.erb:10
app/views/imports/_time_entries_mapping.html.erb:4
app/views/imports/mapping.html.erb:4
app/views/imports/mapping.html.erb:3
lib/redmine/sudo_mode.rb:78:in `sudo_mode'

so, this patch adds checking log_time permission to `TimeEntryImport.authorized?.`


Files

import_time_entry.patch (2.49 KB) import_time_entry.patch Kenta Kumojima, 2024-10-10 10:48
import_time_entry.patch (2.54 KB) import_time_entry.patch Kenta Kumojima, 2024-10-10 10:57
import_issue_and_time_entry.patch (5.08 KB) import_issue_and_time_entry.patch Kenta Kumojima, 2024-10-11 16:55
Actions #2

Updated by Go MAEDA 16 days ago

  • Tracker changed from Patch to Defect
  • Status changed from New to Confirmed

Thank you for detecting and reporting the issue.

I found IssueImport.authorized? has a similar problem. It should check :add_issues permission.

Actions #3

Updated by Go MAEDA 16 days ago

  • Target version set to 5.0.10
Actions #4

Updated by Kenta Kumojima 14 days ago

I found IssueImport.authorized? has a similar problem. It should check :add_issues permission.

I added checking add_issues permission when importing issues and updated patch.

Actions

Also available in: Atom PDF