Redmine

  before_filter :check_issue_perms, :only => [:show, :edit]

  include ProjectsHelper

      @issues.map!{ |issue| issue_without_hidden_fields(issue) } # don't show forbidden fields

    @issue = issue_without_hidden_fields(@issue)

    @journals = journals_without_hidden_entries(@journals)

  def issue_fixed_version_allowed?(issue)

    ((not issue.fixed_version) ||

     (User.current.allowed_to?(:view_issues,

                               issue.fixed_version.project)))

  end

  def check_issue_perms

    @forbidden_fixed_version = (not issue_fixed_version_allowed?(@issue))

  end

  ## Filter journals to remove non allowed entries. This assumes there

  ## is only 1 parent, so it won't work with more depth. We want here

  ## to handle the _specific case_ of a user 'Joe' browsing 'Project

  ## B' issues. 'Project B' is a subproject of 'Project A' and

  ## inherits its versions. Joe can't see 'Project A, but issue

  ## fixed_versions has been set at some point to a version belonging

  ## to 'Project A', by an other member of 'Project B'. Joe should not

  ## see this sensitive information.

  def journals_without_hidden_entries(journals)

    unless (journals.empty? || (not @project.parent_id) ||

            (@project.parent_id && User.current.allowed_to?(:view_issues, @project.parent)))

      journals = journals.dup

      # we kill totally the journal entry when some of its elements are forbidden

      journals.delete_if do |j|

        j.details.map{ |d| (d.property == 'attr' &&

                            d.prop_key == 'fixed_version_id' &&

                            ((d.old_value &&

                              (@project.parent_id == Version.find(d.old_value.to_i).project_id)) ||

                             (d.value &&

                              (@project.parent_id == Version.find(d.value.to_i).project_id)))

                            ) }.include?(true)

      end

    end

    journals

  end

  ## Filter issue to remove non allowed fields. For more information,

  ## see documentation of journals_without_hidden_entries

  def issue_without_hidden_fields(issue)

    unless issue_fixed_version_allowed?(issue)

      issue = issue.dup

      issue.fixed_version = nil

    end

    issue

  end

      @version = @project.related_versions.find_by_id(params[:version_id])

    @versions = @project.related_versions.sort

    @versions = @project.related_versions.find(:all, :include => :attachments, :order => sort_clause).sort.reverse

    @versions = @project.related_versions.sort

    # retrieve_related_versions could be integrated right here.

    @versions = retrieve_related_versions

                             :conditions => { :effective_date => @calendar.startdt..@calendar.enddt})

    # add parent versions if relevant

    events += @project.related_versions.select{ |v| ((v.project_id == @project.parent_id) &&

                                                     v.effective_date) }

    # add parent versions if relevant

    @events += @project.related_versions.select{ |v| ((v.project_id == @project.parent_id) &&

                                                      v.effective_date) }

  def retrieve_related_versions

    related_versions=@project.related_versions

    # should this test be moved to projects_helper.rb : version_visible_issues ?

    params[:completed] ? related_versions : related_versions.select {|v| !v.completed? }

  end

      @rows = @project.related_versions.sort

      @versions = @project.related_versions.sort

  helper :projects

  include ProjectsHelper   

    @issues = version_visible_issues(@version,@project,@project.tracker_ids)

  ## return an array of the issues attached to version that a user should see

  ## As a convenience, allow limitation by trackers with Array of tracker_ids

  def version_visible_issues(version,project,tracker_ids=[],user=User.current)

    # Returns void when user can not see issues or if tracker_ids is void

    return [] if ((not user.allowed_to?(:view_issues,

                                        version.project)) or

                  tracker_ids.empty?)

    # user can see project issues, carry on, retrieve them ...

    issues = version.

      fixed_issues.find(:all,

                        :include => [:status, :tracker],

                        :conditions => ["tracker_id in (#{tracker_ids.join(',')})"],

                        :order => "#{Tracker.table_name}.position, #{Issue.table_name}.id")

    # Only keep issues from self, parent or children,

    related_projects=[project.id].concat(project.child_ids) # project and children

    related_projects.push project.parent.id if project.parent # parent if relevant

    related_projects = related_projects.select{|x| user.allowed_to?(:view_issues, Project.find(x))}

    # now only keep related issues. (issues from brother projects are discarded)

    issues.select {|x| related_projects.include?(x.project.id) }

  end

  ## Return versions attached to self, and to parent if relevant.

  ## Sorting is done in the SQL request to take advantage of cache

  def related_versions(user=User.current)

    Version.find(:all,

                 :conditions => {:project_id => if self.parent &&

                                                    user.allowed_to?(:view_issues,

                                                                     self.parent) then

                                                  [self.id, self.parent_id]

                                                else [self.id]; end},

                 :order => "effective_date ASC, name ASC ")

  end

      @available_filters["fixed_version_id"] = { :type => :list_optional, :order => 7, :values => @project.related_versions.sort.collect{|s| [s.name, s.id.to_s] } }

<%= unless (@project.related_versions.empty? || @forbidden_fixed_version) then

      content_tag('p', f.select(:fixed_version_id,

				(@project.related_versions.sort.collect {|v| [v.name, v.id]}),

				{ :include_blank => true }))

    end %>

<%= unless (@issue.fixed_version &&

            (not User.current.allowed_to?(:view_issues,

					  @issue.fixed_version.project)) ||

	    @project.related_versions.empty?) then

      content_tag('p', f.select(:fixed_version_id, 

				(@project.related_versions.sort.collect {|v| [v.name, v.id]}),

				{ :include_blank => true }))

    end %>

	for journal in @journals

                                   options_from_collection_for_select(@project.related_versions, :id, :name)) %></label>

  <p class="nodata"><%= l(:label_no_data) %></p>

  <div id="roadmap">

    <% @versions.each do |version| %>

      <% issues = version_visible_issues(version,@project,@selected_tracker_ids) %>

      <% next if (version.project.id != @project.id && issues.empty?) %>

      <%= tag 'a', :name => version.name %>

      <h3 class="icon22 icon22-package"><%= link_to h(version.name), :controller => 'versions', :action => 'show', :id => version %></h3>

      <%= render :partial => 'versions/overview', :locals => {:version => version} %>

      <%= render(:partial => "wiki/content", :locals => {:content => version.wiki_page.content}) if version.wiki_page %>

      <% if issues.size > 0 %>

	<fieldset class="related-issues"><legend><%= l(:label_related_issues) %></legend>

	  <ul>

	    <%- issues.each do |issue| -%>

              <li class="issue <%= 'closed' if issue.closed? %>">

		<%= link_to_issue(issue) %>:

		<%=h issue.subject %>

		<%= (" <em>(" + issue.project.name + ")</em>") unless issue.project.id == @project.id %>

</li>

	      <%- end -%>

	  </ul>

	</fieldset>

	<% end %>

      <% end %>

  </div>

  <% end %>

  <% content_for :sidebar do %>

    <% form_tag do %>

      <h3><%= l(:label_roadmap) %></h3>

      <% @trackers.each do |tracker| %>

	<label><%= check_box_tag "tracker_ids[]", tracker.id, (@selected_tracker_ids.include? tracker.id.to_s), :id => nil %>

	  <%= tracker.name %></label><br />

      <% end %>

      <br />

      <label for="completed"><%= check_box_tag "completed", 1, params[:completed] %> <%= l(:label_show_completed_versions) %></label>

      <p><%= submit_tag l(:button_apply), :class => 'button-small' %></p>

    <h3><%= l(:label_version_plural) %></h3>

    <% @versions.each do |version| %>

      <%= link_to version.name, "##{version.name}" %><br />

    <% end %>

  <% end %>

  <% html_title(l(:label_roadmap)) %>

<% if @issues.size > 0 %>

<% @issues.each do |issue| -%>

    <li class="issue <%= 'closed' if issue.closed? %>">

      <%= link_to_issue(issue) %>: <%=h issue.subject %>

      <%= (" <em>(" + issue.project.name + ")</em>") unless issue.project.id == @project.id %>

    </li>

              :if => Proc.new { |p| p.related_versions.any? }