Fixed: issue details view discloses relations to issues that the user is not allowed to view (#2589).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@2343 e93f8b46-1217-0410-a6f0-8f06a7374b81
2009-01-31 13:22:29 +00:00
parent 2679150ed4
commit f021c856c1
3 changed files with 21 additions and 1 deletions
@@ -54,6 +54,11 @@ class Issue < ActiveRecord::Base
  named_scope :visible, lambda {|*args| { :include => :project,
                                          :conditions => Project.allowed_to_condition(args.first || User.current, :view_issues) } }
  
+  # Returns true if usr or current user is allowed to view the issue
+  def visible?(usr=nil)
+    (usr || User.current).allowed_to?(:view_issues, self.project)
+  end
+  
  def after_initialize
    if new_record?
      # set default values for new records only