Redmine

I believe I have tracked down the problem.

1. checks if user has move issue rights
2. builds an allowed projects list by calling allowed_target_projects_on_move in issue.rb:
3. which checks projects for move rights, not add rights...

So for copy, the program checks for move-out and move-in rights. But move-in rights is really add rights.

I think instead, move rights should be checked at source project and then add rights at destination project. This should block a user from copying issues into a project where they do not have add issue rights.

issues_controller.rb snippet

  # Bulk edit/copy a set of issues
  def bulk_edit
    @issues.sort!
    @copy = params[:copy].present?
    @notes = params[:notes]

    if User.current.allowed_to?(:move_issues, @projects)   # <----------- this is correct: can user move/copy in the first place
      @allowed_projects = Issue.allowed_target_projects_on_move   # <-------- i think this is wrong: target projects should only be add rights
      if params[:issue]
        @target_project = @allowed_projects.detect {|p| p.id.to_s == params[:issue][:project_id].to_s}
        if @target_project
          target_projects = [@target_project]
        end
      end
    end
    target_projects ||= @projects

I made a small patch and destination projects are now only ones with Add issue rights.

Unresolved: If the user does not change the project pull down from (No change), then new issues will still be created even when the permissions should not allow it. This is past my knowledge point now.

1. Modify models\issue.rb file:
   

     # Returns a scope of projects that user can move issues to
     def self.allowed_target_projects_on_move(user=User.current)
       Project.where(Project.allowed_to_condition(user, :move_issues))
     end
   
     # Returns a scope of projects that user can add issues to          # <--- new
     def self.allowed_target_projects_on_copy(user=User.current)        # <--- new
       Project.where(Project.allowed_to_condition(user, :add_issues))   # <--- new
     end                                                                # <--- new
   

2. Modify controllers\issues_controller.rb file:
   

     # Bulk edit/copy a set of issues
     def bulk_edit
       @issues.sort!
       @copy = params[:copy].present?
       @notes = params[:notes]
   
       if User.current.allowed_to?(:move_issues, @projects)
         #@allowed_projects = Issue.allowed_target_projects_on_move    # <---- comment out
         @allowed_projects = Issue.allowed_target_projects_on_copy     # <---- new line
         if params[:issue]
           @target_project = @allowed_projects.detect {|p| p.id.to_s == params[:issue][:project_id].to_s}
           if @target_project
             target_projects = [@target_project]
           end
         end
       end
       target_projects ||= @projects