Redmine

turns out the patch led to invalid SQL for project custom fields, here is an updated version which overrides CustomField#visibility_by_project_condition in ProjectCustomField to work with the correct project_key (that is, projects.id instead of projects.project_id).

I'll update these patches in order to be applied on top of #31859. Jens Krämer, maybe you'll have time to review my work.

I've attached the patch that adds per role visibility settings for project.

Working on it, I've observed an inconsistent behaviour (which I consider it a defect/security issue), the project custom fields not visible for normal users are still visible in project settings for those users who have access to project settings. This issue can be easily reproduced using the test test_settings_should_not_display_custom_fields_not_visible_for_user added by me in test/functional/projects_controller_test.

Also, in order to keep the current behaviour where a custom field can be displayed in project#show only for admin users, we cannot validate the roles values when saving a project custom field (as we do for issues/spent entries) in order to allow saving a custom field with "to these roles only:" checked, but without any role checked (which is the equivalent of visible: false). Otherwise, we need to add a new option to visibility in order to allow "admin only".

Tests pass: https://gitlab.com/redmine-org/redmine/pipelines/76036437

Jens Krämer, Go Maeda, what do you think about these changes?

Attached the patch for version custom fields.
Jens, do you remember why did you override the @safe_attributes= method in your proposed patch for Version?

Tests pass: https://gitlab.com/redmine-org/redmine/pipelines/77404580

Jens Krämer wrote:

Marius Ionescu - From the looks of it I would say I did that to prevent a user from setting the values of fields they cannot see through a crafted request. The same logic is present in the issue model. strictly speaking the same should be done for projects.

Got it, thanks. Next week I’ll add new patches to implement this logic to Spent time, Project and Version.

Until then, we can deliver this one.

Committed the patch. Thank you for your contribution.