Merged r23529-r23533 from trunk to 6.0-stable (#42352).

git-svn-id: https://svn.redmine.org/redmine/branches/6.0-stable@23534 e93f8b46-1217-0410-a6f0-8f06a7374b81

test/unit/user_query_test.rb

@@ -209,6 +209,30 @@ class UserQueryTest < ActiveSupport::TestCase
     assert_equal [2, 1], users.pluck(:id)
   end
 
+  def test_user_query_is_only_visible_to_admins
+    q = UserQuery.new(name: '_')
+    assert q.save
+
+    admin = User.admin(true).first
+    user = User.admin(false).first
+
+    assert q.visible?(admin)
+    assert_include q, UserQuery.visible(admin).to_a
+
+    assert_not q.visible?(user)
+    assert_not_include q, UserQuery.visible(user)
+  end
+
+  def test_user_query_is_only_editable_by_admins
+    q = UserQuery.new(name: '_')
+
+    admin = User.admin(true).first
+    user = User.admin(false).first
+
+    assert q.editable_by?(admin)
+    assert_not q.editable_by?(user)
+  end
+
   def find_users_with_query(query)
     User.where(query.statement).to_a
   end