Defect #42545
open
Commit message in issue history might be rendered in incorrect context
0%
Description
The commit messages of changesets associated with an issues are always rendered in the context of that issue in the issue's history view. This might not be the correct context if cross-project relations between issues and changesets are allowed and the changeset comes from a repository associated to another project.
For example if a commit message references a wiki page, the rendered wiki page link in the issue history will reference the wiki page of the issue's project instead of the wiki page of the repository's project.
Files
Updated by Felix Schäfer 9 days ago
The issue is because the textilizable method will use @project as the context if available. In the case of format_changeset_comments this might not always be the correct project context. Forcing the project to be the changeset's project solves this issue.
The attached patch solves the issue and adds a test. In the test the issue's project does not have the wiki module enabled and the issue history will not replace [[wiki]] with a link to a wiki page but will render the string [[wiki]] as is. With the fix this link is rendered correctly and links to the repository's project wiki page. Please note that the textilizable method checks the current user's permissions before rendering links, the change should not introduce security concerns.
Updated by