Fixes #5 : Projects and subsequent DMSF children are now not permitted access to where the project does not have DMSF module enabled.

This commit is contained in:
Daniel Munn 2012-06-18 11:18:56 +01:00
parent c639e25f10
commit 6f7a4f2e4a
3 changed files with 17 additions and 23 deletions

View File

@ -48,8 +48,9 @@ module RedmineDmsf
# Does the object exist?
# If it is either a folder or a file, then it exists
# - 2012-06-15: Only if you're allowed to browse the project
# - 2012-06-18: Issue #5, ensure item is only listed if project is enabled for dmsf
def exist?
return false if project.nil? || !(folder? || file?)
return false if project.nil? || project.module_enabled?('dmsf').nil? || !(folder? || file?)
User.current.admin? ? true : User.current.allowed_to?(:view_dmsf_folders, project)
end

View File

@ -38,8 +38,10 @@ module RedmineDmsf
@children
end
# - 2012-06-18: Issue #5, ensure item is only listed if project is enabled for dmsf
def exist?
return false if (project.nil? || User.current.anonymous?)
return false if (project.module_enabled?('dmsf').nil?) #See Issue #5
return true if User.current.admin?
User.current.allowed_to?(:view_dmsf_folders, project)
end

View File

@ -1,24 +1,15 @@
# Read about fixtures at http://ar.rubyonrails.org/classes/Fixtures.html
# It is possible to use ERb template markup
one:
id: 1
--- !omap
- dmsf_folders_001:
id: 1
title: folder1
project_id: 1
dmsf_folder_id: NULL
user_id: 1
title: folder1
project_id: 1
dmsf_folder_id:
user_id: 1
two:
id: 2
title: folder2
project_id: 1
dmsf_folder_id: 1
user_id: 1
- dmsf_folders_002:
id: 2
title: folder2
project_id: 1
dmsf_folder_id: 1
user_id: 1