Fixed: issue details view discloses relations to issues that the user is not allowed to view (#2589).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@2343 e93f8b46-1217-0410-a6f0-8f06a7374b81
2009-01-31 13:22:29 +00:00
parent 2679150ed4
commit f021c856c1
3 changed files with 21 additions and 1 deletions
@@ -8,7 +8,7 @@

 <% if @issue.relations.any? %>
 <table style="width:100%">
-<% @issue.relations.each do |relation| %>
+<% @issue.relations.select {|r| r.other_issue(@issue).visible? }.each do |relation| %>
 <tr>
 <td><%= l(relation.label_for(@issue)) %> <%= "(#{lwr(:actionview_datehelper_time_in_words_day, relation.delay)})" if relation.delay && relation.delay != 0 %>
    <%= h(relation.other_issue(@issue).project) + ' - ' if Setting.cross_project_issue_relations? %> <%= link_to_issue relation.other_issue(@issue) %></td>