Nemcio/Redmine
1
0
Fork 0
mirror of https://github.com/redmine/redmine.git synced 2026-03-29 16:50:54 +02:00
Code Issues Packages Projects Releases Activity

Merged r20970 from trunk to 4.1-stable (#35045).

Browse Source 
git-svn-id: http://svn.redmine.org/redmine/branches/4.1-stable@20972 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Go MAEDA
2021-04-25 13:10:21 +00:00
parent 1d4042d262
commit 77fa0fc4d4
2 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
app/models/mail_handler.rb
View File

@@ -225,8 +225,7 @@ class MailHandler < ActionMailer::Base
# check permission
unless handler_options[:no_permission_check]
unless user.allowed_to?(:add_issue_notes, issue.project) ||
user.allowed_to?(:edit_issues, issue.project)
unless issue.notes_addable?
raise UnauthorizedAction, "not allowed to add notes on issues to project [#{issue.project.name}]"
end
end

6
test/unit/mail_handler_test.rb
View File

@@ -1005,9 +1005,11 @@ class MailHandlerTest < ActiveSupport::TestCase
end
end
def test_reply_to_a_issue_without_permission
def test_reply_to_an_issue_without_permission
set_tmp_attachments_directory
Role.all.each {|r| r.remove_permission! :add_issue_notes, :edit_issues}
# "add_issue_notes" permission is explicit required to allow users to add notes
# "edit_issue" permission no longer includes the "add_issue_notes" permission
Role.all.each {|r| r.remove_permission! :add_issue_notes}
assert_no_difference 'Issue.count' do
assert_no_difference 'Journal.count' do
assert_not submit_email('ticket_reply_with_status.eml')