Defect #30121

Projects API should not return invisible trackers

Added by Alex Stanev almost 3 years ago. Updated 8 months ago.

Status:ClosedStart date:
Priority:NormalDue date:
Assignee:Go MAEDA% Done:

0%

Category:REST API
Target version:4.2.0
Resolution:Fixed Affected version:3.4.6

Description

Currently projects API returns all trackers, assigned to given project. This is inconsistency with web view, which shows only trackers, visible to the user. They are the only usable to current user anyways.
This is invoked like this: projects/PROJECTID.json?include=trackers
The problem is in redmine/app/helpers/projects_helper.rb, where the line:

project.trackers.each do |tracker|

should be changed to
project.trackers.visible.each do |tracker|

30121-api-will-return-trackers-with-role-based.patch Magnifier (2.06 KB) Yuichi HARADA, 2018-12-13 02:52


Related issues

Related to Redmine - Feature #285: Tracker role-based permissioning Closed

Associated revisions

Revision 20753
Added by Go MAEDA 8 months ago

Projects API should not return invisible trackers (#30121).

Patch by Yuichi HARADA.

History

#1 Updated by Go MAEDA almost 3 years ago

  • Related to Feature #285: Tracker role-based permissioning added

#2 Updated by Go MAEDA almost 3 years ago

  • Category set to REST API

#3 Updated by Go MAEDA almost 3 years ago

  • Status changed from New to Confirmed

Confirmed the problem. Thank you for catching and reporting this.

#4 Updated by Yuichi HARADA almost 3 years ago

Alex Stanev wrote:

should be changed to

project.trackers.visible.each do |tracker|

I think that project.rolled_up_trackers(false).visible is better than project.trackers.visible .
I changed it as follows.

diff --git a/app/helpers/projects_helper.rb b/app/helpers/projects_helper.rb
index 794546163..64d6fea83 100644
--- a/app/helpers/projects_helper.rb
+++ b/app/helpers/projects_helper.rb
@@ -115,7 +115,7 @@ module ProjectsHelper

   def render_api_includes(project, api)
     api.array :trackers do
-      project.trackers.each do |tracker|
+      project.rolled_up_trackers(false).visible.each do |tracker|
         api.tracker(:id => tracker.id, :name => tracker.name)
       end
     end if include_in_api_response?('trackers')

I made a patch, and attach it.

#5 Updated by Alex Stanev almost 3 years ago

Hi, thanks for you help!
This approach will also do the trick, can't test it right now.
Also maybe Go will require test for this.

#6 Updated by Marius BALTEANU over 2 years ago

  • Target version set to Candidate for next minor release

#7 Updated by vzvu 3k6k 8 months ago

LGTM. We (matobaa, sanak and me) have verified the following with trunk (revision 20744).

  • The bug reported in the issue has been fixed by your patch.
  • All tests are also successful.

In the patch, we noticed that the argument of rolled_up_trackers is false instead of Setting.display_subprojects_issues? as in ProjectsController#show. We assume this is because the sub project trackers are probably not needed with this API.

#8 Updated by Go MAEDA 8 months ago

  • Subject changed from Projects API should return only trackers, visible to the user to Projects API should not return invisible trackers
  • Target version changed from Candidate for next minor release to 4.1.2

Setting the target version to 4.1.2.

#9 Updated by Go MAEDA 8 months ago

  • Status changed from Confirmed to Resolved
  • Assignee set to Go MAEDA

Committed the patch. Thank you all for your contribution.

#10 Updated by Go MAEDA 8 months ago

  • Status changed from Resolved to Closed
  • Target version changed from 4.1.2 to 4.2.0
  • Resolution set to Fixed

Also available in: Atom PDF