Fixed: users should not be able to add relations with issues they're not allowed to view (#2589).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@2323 e93f8b46-1217-0410-a6f0-8f06a7374b81

app/controllers/issue_relations_controller.rb

@@ -21,6 +21,9 @@ class IssueRelationsController < ApplicationController
   def new
     @relation = IssueRelation.new(params[:relation])
     @relation.issue_from = @issue
+    if params[:relation] && !params[:relation][:issue_to_id].blank?
+      @relation.issue_to = Issue.visible.find_by_id(params[:relation][:issue_to_id])
+    end
     @relation.save if request.post?
     respond_to do |format|
       format.html { redirect_to :controller => 'issues', :action => 'show', :id => @issue }