Added per user custom queries.

Any logged in user can now save queries (they are not visible to the other users).
Only users with explicit permission can manage queries that are visible to anyone.
The queries list is removed from the "Reports" view. It can now be accessed from the issues list.

git-svn-id: http://redmine.rubyforge.org/svn/trunk@566 e93f8b46-1217-0410-a6f0-8f06a7374b81

app/controllers/queries_controller.rb

@@ -1,5 +1,5 @@
 # redMine - project management software
-# Copyright (C) 2006  Jean-Philippe Lang
+# Copyright (C) 2006-2007  Jean-Philippe Lang
 #
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License
@@ -16,9 +16,35 @@
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
 class QueriesController < ApplicationController
-  layout 'base'
-  before_filter :require_login, :find_query
+  layout 'base'  
+  before_filter :require_login, :except => :index
+  before_filter :find_project, :check_project_privacy
 
+  def index
+    @queries = @project.queries.find(:all, 
+                                     :order => "name ASC",
+                                     :conditions => ["is_public = ? or user_id = ?", true, (logged_in_user ? logged_in_user.id : 0)])
+  end
+  
+  def new
+    @query = Query.new(params[:query])
+    @query.project = @project
+    @query.user = logged_in_user
+    @query.executed_by = logged_in_user
+    @query.is_public = false unless logged_in_user.authorized_to(@project, 'projects/add_query')
+    
+    params[:fields].each do |field|
+      @query.add_filter(field, params[:operators][field], params[:values][field])
+    end if params[:fields]
+    
+    if request.post? and @query.save
+      flash[:notice] = l(:notice_successful_create)
+      redirect_to :controller => 'projects', :action => 'list_issues', :id => @project, :query_id => @query
+      return
+    end
+    render :layout => false if request.xhr?
+  end
+  
   def edit
     if request.post?
       @query.filters = {}
@@ -26,6 +52,7 @@ class QueriesController < ApplicationController
         @query.add_filter(field, params[:operators][field], params[:values][field])
       end if params[:fields]
       @query.attributes = params[:query]
+      @query.is_public = false unless logged_in_user.authorized_to(@project, 'projects/add_query')
           
       if @query.save
         flash[:notice] = l(:notice_successful_update)
@@ -36,16 +63,19 @@ class QueriesController < ApplicationController
 
   def destroy
     @query.destroy if request.post?
-    redirect_to :controller => 'reports', :action => 'issue_report', :id => @project
+    redirect_to :controller => 'queries', :project_id => @project
   end
   
 private
-  def find_query
-    @query = Query.find(params[:id])
-    @query.executed_by = logged_in_user
-    @project = @query.project
-    # check if user is allowed to manage queries (same permission as add_query)
-    authorize('projects', 'add_query')
+  def find_project
+    if params[:id]
+      @query = Query.find(params[:id])
+      @query.executed_by = logged_in_user
+      @project = @query.project
+      render_403 unless @query.editable_by?(logged_in_user)
+    else
+      @project = Project.find(params[:project_id])
+    end
   rescue ActiveRecord::RecordNotFound
     render_404
   end